Merge branch 'main' into henrymercer/slim-pr-checks

2026-05-29 05:00:55 +03:00 · 2025-09-24 19:29:32 +02:00
parent 4082f8c39f 8e25b3435d
commit a34e1cd60b
64 changed files with 72 additions and 5 deletions
@@ -21,8 +21,8 @@ updates:
          - "*"
  - package-ecosystem: github-actions
    directories:
-      - "/"
-      - "/.github/actions" # All subdirectories outside of "/.github/workflows" must be explicitly included.
+      - "/.github/workflows"
+      - "/.github/actions"
    schedule:
      interval: weekly
    labels:
@@ -53,6 +53,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: All-platform bundle
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: "Analyze: 'ref' and 'sha' from inputs"
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: autobuild-action
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -55,6 +55,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Autobuild direct tracing (custom working directory)
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Autobuild working directory
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -55,6 +55,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Build mode autobuild
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode manual
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -41,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode none
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode rollback
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: 'Bundle: Caching checks'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: 'Bundle: Zstandard checks'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Clean up database cluster directory
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -41,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Config export
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Config input
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -41,6 +41,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies (Linux)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -41,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Diagnostic export
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,6 +53,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Export file baseline information
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Extractor ram and threads options test
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -41,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Proxy test
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -51,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Go: Custom queries'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: diagnostic when Go is changed after init step'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: diagnostic when `file` is not installed'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: workaround for indirect tracing'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -83,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with autobuilder step'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -83,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with custom build steps'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -83,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with legacy workflow'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Packaging: Download using registries'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      packages: read
@@ -43,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Custom source root
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Job run UUID added to SARIF
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Language aliases
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Local CodeQL bundle
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -83,6 +83,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Multi-language repository
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -41,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Overlay database init fallback
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,6 +53,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Packaging: Config and input passed to the CLI'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,6 +53,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Packaging: Config and input'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,6 +53,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Packaging: Config file'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,6 +53,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Packaging: Action input'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -55,6 +55,7 @@ jobs:
            version: nightly-latest
            analysis-kinds: code-scanning,code-quality
    name: Quality queries input
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -51,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Remote config file
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Resolve environment
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -39,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: RuboCop multi-language
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Ruby analysis
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -47,6 +47,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Rust analysis
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,6 +59,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Split workflow
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: Start proxy
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Submit SARIF after failure
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: write # needed to upload the SARIF file
@@ -39,6 +39,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using autobuild
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,6 +53,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using a custom build command
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -51,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Test unsetting environment variables
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Upload-sarif: code quality endpoint'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: "Upload-sarif: 'ref' and 'sha' from inputs"
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Use a custom `checkout_path`
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -23,6 +23,7 @@ env:
 jobs:
  # Identify the CodeQL tool versions to use in the analysis job.
  check-codeql-versions:
+    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    outputs:
      versions: ${{ steps.compare.outputs.versions }}
@@ -75,6 +76,7 @@ jobs:
        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT

  analyze-javascript:
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: [check-codeql-versions]
    strategy:
      fail-fast: false
@@ -110,6 +112,7 @@ jobs:
        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}

  analyze-other:
+    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-latest

    strategy:
@@ -28,6 +28,7 @@ defaults:

 jobs:
  code-scanning-config-tests:
+    if: github.triggering_actor != 'dependabot[bot]'
    continue-on-error: true

    permissions:
@@ -24,6 +24,7 @@ defaults:

 jobs:
  upload-artifacts:
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -70,6 +71,7 @@ jobs:
          expect-error: true
  download-and-check-artifacts:
    name: Download and check debug artifacts after failure in analyze
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
@@ -23,6 +23,7 @@ defaults:

 jobs:
  upload-artifacts:
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -64,6 +65,7 @@ jobs:
        id: analysis
  download-and-check-artifacts:
    name: Download and check debug artifacts
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
@@ -15,6 +15,7 @@ defaults:
 jobs:
  unit-tests:
    name: Unit Tests
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -31,7 +32,7 @@ jobs:
        run: git config --global core.autocrlf false

      - uses: actions/checkout@v5
-      
+
      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
@@ -75,7 +76,7 @@ jobs:
          category: eslint

  check-node-version:
-    if: github.event.pull_request
+    if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]'
    name: Check Action Node versions
    runs-on: ubuntu-latest
    timeout-minutes: 45
@@ -18,6 +18,7 @@ defaults:

 jobs:
  test-setup-python-scripts:
+    if: github.triggering_actor != 'dependabot[bot]'
    env:
      CODEQL_ACTION_TEST_MODE: true
    timeout-minutes: 45
@@ -22,6 +22,7 @@ defaults:
 jobs:
  query-filters:
    name: Query Filters Tests
+    if: github.triggering_actor != 'dependabot[bot]'
    timeout-minutes: 45
    runs-on: ubuntu-latest
    permissions:
@@ -28,6 +28,7 @@ jobs:
        - os: ubuntu-latest
          version: nightly-latest
    name: 'CodeQL Bundle All'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -46,7 +47,7 @@ jobs:
      uses: ./../action/init
      with:
        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby 
+        languages: cpp,csharp,go,java,javascript,python,ruby
        tools: ${{ steps.prepare-test.outputs.tools-url }}
    - name: Build code
      run: ./build.sh