No user facing changes.
No user facing changes.
- Update default CodeQL bundle version to 2.13.0. #1649
- Bump the minimum CodeQL bundle version to 2.8.5. #1618
- Include the value of the
GITHUB_RUN_ATTEMPTenvironment variable in the telemetry sent to GitHub. #1640 - Improve the ease of debugging failed runs configured using default setup. The CodeQL Action will now upload diagnostic information to Code Scanning from failed runs configured using default setup. You can view this diagnostic information on the tool status page. #1619
No user facing changes.
- Update default CodeQL bundle version to 2.12.6. #1629
- Customers post-processing the SARIF output of the
analyzeAction before uploading it to Code Scanning will benefit from an improved debugging experience. #1598- The CodeQL Action will now upload a SARIF file with debugging information to Code Scanning on failed runs for customers using
upload: false. Previously, this was only available for customers using the default value of theuploadinput. - The
uploadinput to theanalyzeAction now accepts the following values:alwaysis the default value, which uploads the SARIF file to Code Scanning for successful and failed runs.failure-onlyis recommended for customers post-processing the SARIF file before uploading it to Code Scanning. This option uploads debugging information to Code Scanning for failed runs to improve the debugging experience.neveravoids uploading the SARIF file to Code Scanning even if the code scanning run fails. This is not recommended for external users since it complicates debugging.- The legacy
trueandfalseoptions will be interpreted asalwaysandfailure-onlyrespectively.
- The CodeQL Action will now upload a SARIF file with debugging information to Code Scanning on failed runs for customers using
- Update default CodeQL bundle version to 2.12.5. #1585
No user facing changes.
- Update default CodeQL bundle version to 2.12.4. #1561
- Update default CodeQL bundle version to 2.12.3. #1543
No user facing changes.
- Update default CodeQL bundle version to 2.12.2. #1518
- Fix an issue where customers using the CodeQL Action with the CodeQL Action sync tool would not be able to obtain the CodeQL tools. #1517
No user facing changes.
- Improve stability when choosing the default version of CodeQL to use in code scanning workflow runs on Actions on GitHub.com. #1475
- This change addresses customer reports of code scanning alerts on GitHub.com being closed and reopened during the rollout of new versions of CodeQL in the GitHub Actions runner images.
- No change is required for the majority of workflows, including:
- Workflows on GitHub.com hosted runners using the latest version (
v2) of the CodeQL Action. - Workflows on GitHub.com hosted runners that are pinned to specific versions of the CodeQL Action from
v2.2.0onwards. - Workflows on GitHub Enterprise Server.
- Workflows on GitHub.com hosted runners using the latest version (
- A change may be required for workflows on GitHub.com hosted runners that are pinned to specific versions of the CodeQL Action before
v2.2.0(e.g.v2.1.32):- Previously, these workflows would obtain the latest version of CodeQL from the Actions runner image.
- Now, these workflows will download an older, compatible version of CodeQL from GitHub Releases. To use this older version, no change is required. To use the newest version of CodeQL, please update your workflows to reference the latest version of the CodeQL Action (
v2).
- Internal changes
- These changes will not affect the majority of code scanning workflows. Continue reading only if your workflow uses @actions/tool-cache or relies on the precise location of CodeQL within the Actions tool cache.
- The tool cache now contains two recent CodeQL versions (previously one).
- Each CodeQL version is located under a directory named after the release date and version number, e.g. CodeQL 2.11.6 is now located under
CodeQL/2.11.6-20221211/x64/codeql(previouslyCodeQL/0.0.0-20221211/x64/codeql).
- The maximum number of SARIF runs per file has been increased from 15 to 20 for users uploading SARIF files to GitHub.com. This change will help ensure that Code Scanning can process SARIF files generated by third-party tools that have many runs. See the GitHub API documentation for a list of all the limits around uploading SARIF. This change will be released to GitHub Enterprise Server as part of GHES 3.9.
- Update default CodeQL bundle version to 2.12.1. #1498
- Fix a bug that forced the
initAction to run for at least two minutes on JavaScript. #1494
- CodeQL Action v1 is now deprecated, and is no longer updated or supported. For better performance, improved security, and new features, upgrade to v2. For more information, see this changelog post. #1467
- Python automatic dependency installation will no longer fail for projects using Poetry that specify
virtualenvs.options.no-pip = truein theirpoetry.toml. #1431 - Avoid printing a stack trace and error message when the action fails to find the SHA at the current directory. This will happen in several non-error states and so we now avoid cluttering the log with this message. #1485
- Update default CodeQL bundle version to 2.12.0. #1466
- Update default CodeQL bundle version to 2.11.6. #1433
- Update default CodeQL bundle version to 2.11.5. #1412
- Add a step that tries to upload a SARIF file for the workflow run when that workflow run fails. This will help better surface failed code scanning workflow runs. #1393
- Python automatic dependency installation will no longer consider dependency code installed in venv as user-written, for projects using Poetry that specify
virtualenvs.in-project = truein theirpoetry.toml. #1419
No user facing changes.
- Update default CodeQL bundle version to 2.11.4. #1391
- Fixed a bug where some the
initaction and theanalyzeaction would have different sets of experimental feature flags enabled. #1384
- Go is now analyzed in the same way as other compiled languages such as C/C++, C#, and Java. This completes the rollout of the feature described in CodeQL Action version 2.1.27. #1322
- Bump the minimum CodeQL bundle version to 2.6.3. #1358
- Update default CodeQL bundle version to 2.11.3. #1348
- Update the ML-powered additional query pack for JavaScript to version 0.4.0. #1351
- The
rb/weak-cryptographic-algorithmRuby query has been updated to no longer report uses of hash functions such asMD5andSHA1even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. For more information, see the corresponding change in the github/codeql repository. #1344
- Improve the error message when using CodeQL bundle version 2.7.2 and earlier in a workflow that runs on a runner image such as
ubuntu-22.04that uses glibc version 2.34 and later. #1334
- Update default CodeQL bundle version to 2.11.2. #1320
- Update default CodeQL bundle version to 2.11.1. #1294
- Replace uses of GitHub Actions command
set-outputbecause it is now deprecated. See more information in the GitHub Changelog. #1301
- We are rolling out a feature of the CodeQL Action in October 2022 that changes the way that Go code is analyzed to be more consistent with other compiled languages like C/C++, C#, and Java. You do not need to alter your code scanning workflows. If you encounter any problems, please file an issue or open a private ticket with GitHub Support and request an escalation to engineering.
- Update default CodeQL bundle version to 2.11.0. #1267
- We will soon be rolling out a feature of the CodeQL Action that stores some information used to make future runs faster in the GitHub Actions cache. Initially, this will only be enabled on JavaScript repositories, but we plan to add more languages to this soon. The new feature can be disabled by passing the
trap-caching: falseoption to your workflow'sinitstep, for example if you are already using the GitHub Actions cache for a different purpose and are near the storage limit for it. - Add support for Python automatic dependency installation with Poetry 1.2 #1258
No user facing changes.
- Allow CodeQL packs to be downloaded from GitHub Enterprise Server instances, using the new
registriesinput for theinitaction. #1221 - Update default CodeQL bundle version to 2.10.5. #1240
- Downloading CodeQL packs has been moved to the
initstep. Previously, CodeQL packs were downloaded during theanalyzestep. #1218 - Update default CodeQL bundle version to 2.10.4. #1224
- The newly released Poetry 1.2 is not yet supported. In the most common case where the CodeQL Action is automatically installing Python dependencies, it will continue to install and use Poetry 1.1 on its own. However, in certain cases such as with self-hosted runners, you may need to ensure Poetry 1.1 is installed yourself.
- Improve error messages when the code scanning configuration file includes an invalid
queriesblock or an invalidquery-filtersblock. #1208 - Fix a bug where Go build tracing could fail on Windows. #1209
No user facing changes.
- Add the ability to filter queries from a code scanning run by using the
query-filtersoption in the code scanning configuration file. #1098 - In debug mode, debug artifacts are now uploaded even if a step in the Actions workflow fails. #1159
- Update default CodeQL bundle version to 2.10.3. #1178
- The combination of python2 and Pipenv is no longer supported. #1181
- Update default CodeQL bundle version to 2.10.2. #1156
- Update default CodeQL bundle version to 2.10.1. #1143
- You can now quickly debug a job that uses the CodeQL Action by re-running the job from the GitHub UI and selecting the "Enable debug logging" option. #1132
- You can now see diagnostic messages produced by the analysis in the logs of the
analyzeAction by enabling debug mode. To enable debug mode, passdebug: trueto theinitAction, or enable step debug logging. This feature is available for CodeQL CLI version 2.10.0 and later. #1133
- CodeQL query packs listed in the
packsconfiguration field will be skipped if their target language is not being analyzed in the current Actions job. Previously, this would throw an error. #1116 - The combination of python2 and poetry is no longer supported. See actions/setup-python#374 for more details. #1124
- Update default CodeQL bundle version to 2.10.0. #1123
No user facing changes.
- Update default CodeQL bundle version to 2.9.4. #1100
- Update default CodeQL bundle version to 2.9.3. #1084
- Update default CodeQL bundle version to 2.9.2. #1074
- Update default CodeQL bundle version to 2.9.1. #1056
- When
wait-for-processingis enabled, the workflow will now fail if there were any errors that occurred during processing of the analysis results.
- Add
working-directoryinput to theautobuildaction. #1024 - The
analyzeandupload-sarifactions will now wait up to 2 minutes for processing to complete after they have uploaded the results so they can report any processing errors that occurred. This behavior can be disabled by setting thewait-for-processingaction input to"false". #1007 - Update default CodeQL bundle version to 2.9.0.
- Fix a bug where status reporting fails on Windows. #1042
- Update default CodeQL bundle version to 2.8.5. #1014
- Fix error where the init action would fail due to a GitHub API request that was taking too long to complete #1025
- A bug where additional queries specified in the workflow file would sometimes not be respected has been fixed. #1018
- [v2+ only] The CodeQL Action now runs on Node.js v16. #1000
- Update default CodeQL bundle version to 2.8.4. #990
- Fix a bug where an invalid
commit_oidwas being sent to code scanning when a custom checkout path was being used. #956
- Update default CodeQL bundle version to 2.8.3.
- The CodeQL runner is now deprecated and no longer being released. For more information, see CodeQL runner deprecation.
- Fix two bugs that cause action failures with GHES 3.3 or earlier. #978
- Fix
not a permitted keyinvalid requests with GHES 3.1 or earlier - Fix
RUNNER_ARCH environment variable must be seterrors with GHES 3.3 or earlier
- Fix
- Update default CodeQL bundle version to 2.8.2. #950
- Fix a bug where old results can be uploaded if the languages in a repository change when using a non-ephemeral self-hosted runner. #955
- Fix a bug where the CLR traces can continue tracing even after tracing should be stopped. #938
- Due to potential issues for GHES 3.1–3.3 customers who are using recent versions of the CodeQL Action via GHES Connect, the CodeQL Action now uses Node.js v12 rather than Node.js v16. #937
- The CodeQL CLI versions up to and including version 2.4.4 are not compatible with the CodeQL Action 1.1.1 and later. The Action will emit an error if it detects that it is being used by an incompatible version of the CLI. #931
- Update default CodeQL bundle version to 2.8.1. #925
- The CodeQL Action now uses Node.js v16. #909
- Beware that the CodeQL build tracer in this release (and in all earlier releases) is incompatible with Windows 11 and Windows Server 2022. This incompatibility affects database extraction for compiled languages: cpp, csharp, go, and java. As a result, analyzing these languages with the
windows-latestorwindows-2022Actions virtual environments is currently unsupported. If you use any of these languages, please use thewindows-2019Actions virtual environment or otherwise avoid these specific Windows versions until a new release fixes this incompatibility.
- Add
sarif-idas an output for theupload-sarifandanalyzeactions. #889 - Add
refandshainputs to theanalyzeaction, which override the defaults provided by the GitHub Action context. #889 - Update default CodeQL bundle version to 2.8.0. #911
- Remove
experimentalmessage when using custom CodeQL packages. #888 - Add a better warning message stating that experimental features will be disabled if the workflow has been triggered by a pull request from a fork or the
security-events: writepermission is not present. #882
- Display a better error message when encountering a workflow that runs the
codeql-action/initaction multiple times. #876 - Update default CodeQL bundle version to 2.7.6. #877
- The feature to wait for SARIF processing to complete after upload has been disabled by default due to a bug in its interaction with pull requests from forks.
- Update default CodeQL bundle version to 2.7.5. #866
- Fix a bug where SARIF files were failing upload due to an invalid test for unique categories. #872
- The
analyzeandupload-sarifactions will now wait up to 2 minutes for processing to complete after they have uploaded the results so they can report any processing errors that occurred. This behavior can be disabled by setting thewait-for-processingaction input to"false". #855
- Update default CodeQL bundle version to 2.7.3. #842
No user facing changes.
- Update default CodeQL bundle version to 2.7.2. #827
- The
upload-sarifaction now allows multiple uploads in a single job, as long as they have different categories. #801 - Update default CodeQL bundle version to 2.7.1. #816
- The
initstep of the Action now supportsramandthreadsinputs to limit resource use of CodeQL extractors. These inputs also serve as defaults to the subsequentanalyzestep, which finalizes the database and executes queries. #738 - When used with CodeQL 2.7.1 or above, the Action now includes custom query help in the analysis results uploaded to GitHub code scanning, if available. To add help text for a custom query, create a Markdown file next to the
.qlfile containing the query, using the same base name but the file extension.md. #804
- Update default CodeQL bundle version to 2.7.0. #795
No user facing changes.
No user facing changes.
- Fixed a bug where some builds were no longer being traced correctly. #766
- Update default CodeQL bundle version to 2.6.3. #761
No user facing changes.
- Update default CodeQL bundle version to 2.6.2. #746
- Update default CodeQL bundle version to 2.6.1. #733
- Update default CodeQL bundle version to 2.6.0. #712
- Update baseline lines of code counter for python. All multi-line strings are counted as code. #714
- Remove old baseline LoC injection #715
- Update README to include a sample permissions block. #689
- Update default CodeQL bundle version to 2.5.9. #687
- Fix an issue where a summary of diagnostics information from CodeQL was not output to the logs of the
analyzestep of the Action. #672
No user facing changes.
- Update default CodeQL bundle version to 2.5.8. #631
No user facing changes.
- The
initstep of the Action now supports asource-rootinput as a path to the root source-code directory. By default, the path is relative to$GITHUB_WORKSPACE. #607 - The
initstep will now try to install a few Python tools needed by this Action when running on a self-hosted runner. #616
- The
analyzestep of the Action now supports askip-queriesoption to merely build the CodeQL database without analyzing. This functionality is not present in the runner. Additionally, the step will no longer fail if it encounters a finalized database, and will instead continue with query execution. #602 - Update the warning message when the baseline lines of code count is unavailable. #608
- Fix
RUNNER_TEMP environment variable must be setwhen using runner. #594 - Fix counting of lines of code for C# projects. #586
No user facing changes.
- Fix out of memory in hash computation. #550
- Clean up logging during analyze results. #557
- Add
--finalize-datasettodatabase finalizecall, freeing up some disk space after database creation. #558
- Pass the
--sarif-group-rules-by-packargument to CodeQL CLI invocations that generate SARIF. This means the SARIF rule object for each query will now be found underneath its corresponding query pack inruns[].tool.extensions. #546 - Output the location of CodeQL databases created in the analyze step. #543