Merge releases/v4 into releases/v3 #3237

github-actions · 2025-10-24T17:12:32Z

Merging 4e94bd1 into releases/v3.

Conductor for this PR is @mbg.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
Wait for the "Rebuild" workflow to push a commit updating the distribution files.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

- Throws a `ConfigurationError` if parsing the YAML fails - Add a couple of tests for it

Mergeback v4.30.9 refs/heads/releases/v4 into main

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Michael B. Gale <mbg@github.com>

Add experimental functionality for labelling PRs by their size

Bumps the npm-minor group with 5 updates: | Package | From | To | | --- | --- | --- | | [octokit](https://github.com/octokit/octokit.js) | `5.0.3` | `5.0.4` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.37.0` | `9.38.0` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.46.0` | `8.46.1` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.46.0` | `8.46.1` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.10` | `0.25.11` | Updates `octokit` from 5.0.3 to 5.0.4 - [Release notes](https://github.com/octokit/octokit.js/releases) - [Commits](octokit/octokit.js@v5.0.3...v5.0.4) Updates `@eslint/js` from 9.37.0 to 9.38.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.38.0/packages/js) Updates `@typescript-eslint/eslint-plugin` from 8.46.0 to 8.46.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.46.0 to 8.46.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.1/packages/parser) Updates `esbuild` from 0.25.10 to 0.25.11 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.10...v0.25.11) --- updated-dependencies: - dependency-name: octokit dependency-version: 5.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@eslint/js" dependency-version: 9.38.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.46.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/parser" dependency-version: 8.46.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: esbuild dependency-version: 0.25.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…thub/workflows/actions/setup-node-6 Bump actions/setup-node from 5 to 6 in /.github/workflows

…r-5ed6ededba Bump the npm-minor group with 5 updates

Handle user errors for invalid `UserConfig`s and missing query files

Perform SARIF post-processing independently of upload

Also add tests for it and `getRequiredEnvParam`

Bump minimum CodeQL Bundle version to 2.17.6

Add `getOptionalEnvVar` helper

Add changelog entry for post-processing change

Merge main into releases/v4

This reverts commit ba42101.

This reverts commit 5f3f316.

….0-4e94bd11f

github-actions · 2025-10-24T17:18:45Z

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

Copilot

Pull Request Overview

This is a release-PR merging changes from releases/v4 into releases/v3. The primary purpose is to backport changes from version 4 to version 3, including bumping the minimum CodeQL version to 2.17.6 and modifying the SARIF file post-processing behavior to always occur regardless of upload settings.

Key changes:

Minimum CodeQL bundle version increased from 2.16.6 to 2.17.6
SARIF post-processing now always occurs, not just when uploading
New post-processed-sarif-path input added to the analyze action to optionally save post-processed SARIF files

Reviewed Changes

Copilot reviewed 63 out of 66 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
CHANGELOG.md	Documents the new 3.31.0 release with key changes
package.json	Version bump to 3.31.0 and dependency updates
src/codeql.ts	Updates minimum CodeQL version constant and error handling improvements
src/upload-lib.ts	Refactors upload logic to separate post-processing from uploading
src/upload-sarif.ts	Renames function and adds support for conditional uploading
src/util.ts	Adds new utility functions for environment variables and HTTP error handling
analyze/action.yml	Adds new `post-processed-sarif-path` input parameter
lib/*.js	Generated JavaScript files from TypeScript sources

mbg and others added 30 commits October 14, 2025 19:49

Use uploadSarif rather than uploadFiles in analyze action

2ade8a0

Add and use parseUserConfig

66df0bc

- Throws a `ConfigurationError` if parsing the YAML fails - Add a couple of tests for it

Add and validate UserConfig schema

ac922ab

Add additional regex to CliConfigErrorCategory.PackCannotBeFound

4f14649

Add checkExpectedLogMessages function to testing-utils

913cd47

Log validation errors

0822fb1

Include first 10 errors in exception message

d7a8ae5

Add FF for config validation

2c8f489

Make schema for QueryFilter less strict

9ce56a2

Update changelog and version after v4.30.9

b03dcd5

Rebuild

aa0f6ea

Merge pull request #3215 from github/mergeback/v4.30.9-to-main-16140ae1

d88a554

Mergeback v4.30.9 refs/heads/releases/v4 into main

Handle HTTP errors with httpStatusCode property

c64c407

Wrap API configuration errors when setting up CodeQL

a6b9514

Add experimental functionality for labelling PRs by their size

8c324fe

Update workflow name

519594f

Update .github/sizeup.yml

08e53be

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add score for XL

f2f52d0

Bump sizes a bit

c13672e

Comment version that is pinned

e9daf5b

Co-authored-by: Michael B. Gale <mbg@github.com>

Merge pull request #3218 from github/henrymercer/pr-sizes

6562050

Add experimental functionality for labelling PRs by their size

Rebuild

2357c43

Rebuild

06f31ec

Merge pull request #3220 from github/dependabot/github_actions/dot-gi…

bee06ec

…thub/workflows/actions/setup-node-6 Bump actions/setup-node from 5 to 6 in /.github/workflows

Merge pull request #3219 from github/dependabot/npm_and_yarn/npm-mino…

ffed63a

…r-5ed6ededba Bump the npm-minor group with 5 updates

Merge pull request #3203 from github/mbg/errors/more-user-errors

9b0ac1c

Handle user errors for invalid `UserConfig`s and missing query files

Require message field too

40e2646

Simplify API error checks

e6e649a

mbg and others added 13 commits October 24, 2025 14:59

Merge pull request #3222 from github/mbg/upload-lib/post-process

d75645b

Perform SARIF post-processing independently of upload

Add getOptionalEnvVar function

ad35676

Also add tests for it and `getRequiredEnvParam`

Merge pull request #3223 from github/henrymercer/bump-minimum

e576807

Bump minimum CodeQL Bundle version to 2.17.6

Use getOptionalEnvVar in writePostProcessedFiles

1ecd563

Merge pull request #3233 from github/mbg/getOptionalEnvVar

b843cbe

Add `getOptionalEnvVar` helper

Add changelog entry for post-processing change

08ada26

Merge pull request #3234 from github/mbg/changelog/post-processing

1d36546

Add changelog entry for post-processing change

Update changelog for v4.31.0

8f11182

Merge pull request #3235 from github/update-v4.31.0-1d36546c1

4e94bd1

Merge main into releases/v4

Revert "Update version and changelog for v3.30.9"

d3019ef

This reverts commit ba42101.

Revert "Rebuild"

12c6008

This reverts commit 5f3f316.

Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31…

28fc48d

….0-4e94bd11f

Update version and changelog for v3.31.0

7dd1575

github-actions bot added the Rebuild Re-transpile JS & re-generate workflows label Oct 24, 2025

github-actions bot assigned mbg Oct 24, 2025

github-actions bot added the size/XXL May be extremely hard to review label Oct 24, 2025

mbg added Rebuild Re-transpile JS & re-generate workflows and removed Rebuild Re-transpile JS & re-generate workflows size/XXL May be extremely hard to review labels Oct 24, 2025

github-actions bot added size/XXL May be extremely hard to review and removed Rebuild Re-transpile JS & re-generate workflows labels Oct 24, 2025

Rebuild

9e3918e

mbg marked this pull request as ready for review October 24, 2025 18:12

mbg requested a review from a team as a code owner October 24, 2025 18:12

Copilot AI review requested due to automatic review settings October 24, 2025 18:12

mbg approved these changes Oct 24, 2025

View reviewed changes

Copilot AI reviewed Oct 24, 2025

View reviewed changes

mbg merged commit d198d2f into releases/v3 Oct 24, 2025
238 checks passed

mbg deleted the backport-v3.31.0-4e94bd11f branch October 24, 2025 18:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Merge releases/v4 into releases/v3 #3237

Merge releases/v4 into releases/v3 #3237

Uh oh!

github-actions bot commented Oct 24, 2025 •

edited by mbg

Loading

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Merge releases/v4 into releases/v3 #3237

Merge releases/v4 into releases/v3 #3237

Uh oh!

Conversation

github-actions bot commented Oct 24, 2025 • edited by mbg Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Oct 24, 2025 •

edited by mbg

Loading