Merge pull request #3263 from github/backport-v3.31.2-0499de31b

Merge releases/v4 into releases/v3
Rebuild
2026-10-31 20:01:33 +03:00 · 2025-10-30 15:01:09 +00:00 · 2025-10-30 14:37:32 +00:00 · 2025-10-30 14:34:26 +00:00 · 2025-10-30 14:34:25 +00:00 · 2025-10-30 14:34:25 +00:00
68 changed files with 13748 additions and 74260 deletions
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node24
+  using: node20
  main: index.js
@@ -16,9 +16,9 @@ runs:
      shell: bash

    - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
      with:
-        python-version: 3.12
+        python-version: '3.12'

    - name: Install dependencies
      run: |
@@ -79,7 +79,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: ${{ matrix.os }}-zstd-bundle.sarif
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -67,7 +67,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -78,7 +78,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -85,7 +85,7 @@ jobs:
        with:
          output: ${{ runner.temp }}/results
      - name: Upload SARIF
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -64,7 +64,7 @@ jobs:
        with:
          output: ${{ runner.temp }}/results
      - name: Upload SARIF
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -83,7 +83,7 @@ jobs:
          post-processed-sarif-path: ${{ runner.temp }}/post-processed
      - name: Upload security SARIF
        if: contains(matrix.analysis-kinds, 'code-scanning')
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: |
            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -91,14 +91,14 @@ jobs:
          retention-days: 7
      - name: Upload quality SARIF
        if: contains(matrix.analysis-kinds, 'code-quality')
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: |
            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
          path: ${{ runner.temp }}/results/javascript.quality.sarif
          retention-days: 7
      - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: |
            post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -56,7 +56,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
+        uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -15,7 +15,7 @@ defaults:

 jobs:
  check-expected-release-files:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim

    permissions:
      contents: read
@@ -79,7 +79,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
      - name: Check expected artifacts exist
        run: |
          LANGUAGES="cpp csharp go java javascript python"
@@ -73,7 +73,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
      - name: Check expected artifacts exist
        run: |
          VERSIONS="stable-v2.20.3 default linked nightly-latest"
@@ -16,7 +16,7 @@ permissions:
 jobs:
  sizeup:
    name: Label PR with size
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim

    steps:
      - name: Run sizeup
@@ -24,7 +24,7 @@ defaults:

 jobs:
  merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    if: github.repository == 'github/codeql-action'
    env:
@@ -48,6 +48,9 @@ jobs:
        with:
          fetch-depth: 0  # ensure we have all tags and can push commits
      - uses: actions/setup-node@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'

      - name: Update git config
        run: |
@@ -29,7 +29,7 @@ defaults:
 jobs:
  prepare:
    name: "Prepare release"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.repository == 'github/codeql-action'

    permissions:
@@ -10,7 +10,7 @@ defaults:

 jobs:
  publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    permissions:
      contents: read
      id-token: write
@@ -20,7 +20,7 @@ defaults:
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
@@ -26,7 +26,7 @@ jobs:

  update:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
@@ -77,7 +77,7 @@ jobs:

  backport:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -9,7 +9,7 @@ jobs:
  update-supported-enterprise-server-versions:
    name: Update Supported Enterprise Server Versions
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.repository == 'github/codeql-action'
    permissions:
      contents: write # needed to push commits
@@ -2,27 +2,31 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## [UNRELEASED]
+## 3.31.2 - 30 Oct 2025

 No user facing changes.

-## 4.31.0 - 24 Oct 2025
+## 3.31.1 - 30 Oct 2025
+
+- The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.
+
+## 3.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 4.30.9 - 17 Oct 2025
+## 3.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 4.30.8 - 10 Oct 2025
+## 3.30.8 - 10 Oct 2025

 No user facing changes.

-## 4.30.7 - 06 Oct 2025
+## 3.30.7 - 06 Oct 2025

- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
+No user facing changes.

 ## 3.30.6 - 02 Oct 2025

@@ -258,17 +262,13 @@ No user facing changes.
 ## 3.26.12 - 07 Oct 2024

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520)
-
  - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
-
  - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

 ## 3.26.11 - 03 Oct 2024

 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts.
-
  Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then.
-
  This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES.
 - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519)

@@ -391,12 +391,9 @@ No user facing changes.
 ## 3.25.0 - 15 Apr 2024

 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224)
-
  As a result, the following inputs and environment variables are now ignored:
-
  - The `setup-python-dependencies` input to the `init` Action
  - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable
-
  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.
 - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229)
 - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232)
@@ -32,14 +32,10 @@ inputs:
      and 13GB for macOS).
    required: false
  add-snippets:
-    description: Specify whether or not to add code snippets to the output sarif file.
+    description: Does not have any effect.
    required: false
-    default: "false"
    deprecationMessage: >-
-      The input "add-snippets" is deprecated and will be removed on the first release in August 2025.
-      When this input is set to true it is expected to add code snippets with an alert to the SARIF file.
-      However, since Code Scanning ignores code snippets provided as part of a SARIF file this is currently
-      a no operation. No alternative is available.
+      The input "add-snippets" has been removed and no longer has any effect.
  skip-queries:
    description: If this option is set, the CodeQL database will be built but no queries will be run on it. Thus, no results will be produced.
    required: false
@@ -98,6 +94,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
+  using: node20
  main: "../lib/analyze-action.js"
  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node24
+  using: node20
  main: '../lib/autobuild-action.js'
@@ -165,6 +165,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
+  using: node20
  main: '../lib/init-action.js'
  post: '../lib/init-action-post.js'
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.31.1",
+  "version": "3.31.2",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -24,7 +24,7 @@
  },
  "license": "MIT",
  "dependencies": {
-    "@actions/artifact": "^2.3.1",
+    "@actions/artifact": "^4.0.0",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
    "@actions/cache": "^4.1.0",
    "@actions/core": "^1.11.1",
@@ -38,8 +38,6 @@
    "@octokit/request-error": "^7.0.1",
    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
-    "console-log-level": "^1.4.1",
-    "del": "^8.0.0",
    "fast-deep-equal": "^3.1.3",
    "follow-redirects": "^1.15.11",
    "get-folder-size": "^5.0.0",
@@ -57,16 +55,15 @@
    "@eslint/eslintrc": "^3.3.1",
    "@eslint/js": "^9.38.0",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
-    "@octokit/types": "^15.0.0",
-    "@types/archiver": "^6.0.3",
-    "@types/console-log-level": "^1.4.5",
+    "@octokit/types": "^15.0.1",
+    "@types/archiver": "^6.0.4",
    "@types/follow-redirects": "^1.14.4",
    "@types/js-yaml": "^4.0.9",
    "@types/node": "20.19.9",
    "@types/node-forge": "^1.3.14",
    "@types/semver": "^7.7.1",
    "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.46.1",
+    "@typescript-eslint/eslint-plugin": "^8.46.2",
    "@typescript-eslint/parser": "^8.41.0",
    "ava": "^6.4.1",
    "esbuild": "^0.25.11",
@@ -27,7 +27,7 @@ steps:
      output: ${{ runner.temp }}/results
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: ${{ matrix.os }}-zstd-bundle.sarif
      path: ${{ runner.temp }}/results/javascript.sarif
@@ -12,7 +12,7 @@ steps:
      output: "${{ runner.temp }}/results"
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -25,7 +25,7 @@ steps:
      output: "${{ runner.temp }}/results"
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -17,7 +17,7 @@ steps:
    with:
      output: "${{ runner.temp }}/results"
  - name: Upload SARIF
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -11,7 +11,7 @@ steps:
    with:
      output: "${{ runner.temp }}/results"
  - name: Upload SARIF
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -39,7 +39,7 @@ steps:
      post-processed-sarif-path: "${{ runner.temp }}/post-processed"
  - name: Upload security SARIF
    if: contains(matrix.analysis-kinds, 'code-scanning')
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: |
        quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -47,14 +47,14 @@ steps:
      retention-days: 7
  - name: Upload quality SARIF
    if: contains(matrix.analysis-kinds, 'code-quality')
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: |
        quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
      path: "${{ runner.temp }}/results/javascript.quality.sarif"
      retention-days: 7
  - name: Upload post-processed SARIF
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@v5
    with:
      name: |
        post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -4,7 +4,7 @@ description: "Tests using RuboCop to analyze a multi-language repository and the
 versions: ["default"]
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
+    uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node24
+  using: node20
  main: '../lib/resolve-environment-action.js'
@@ -9,9 +9,15 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
 fi

 # Check if npm install is likely needed before proceeding
-if [ ! -d node_modules ] || [ package-lock.json -nt node_modules/.package-lock.json ]; then
-  echo "Running 'npm install' because 'node_modules/.package-lock.json' appears to be outdated..."
+if [ ! -d node_modules ]; then
+  echo "Running 'npm install' because 'node_modules' directory is missing."
+  npm install
+elif [ package.json -nt package-lock.json ]; then
+  echo "Running 'npm install' because 'package-lock.json' appears to be outdated."
+  npm install
+elif [ package-lock.json -nt node_modules/.package-lock.json ]; then
+  echo "Running 'npm install' because 'node_modules/.package-lock.json' appears to be outdated."
  npm install
 else
-  echo "Skipping 'npm install' because 'node_modules/.package-lock.json' appears to be up-to-date."
+  echo "Skipping 'npm install' because everything appears to be up-to-date."
 fi
@@ -35,5 +35,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node24
+  using: node20
  main: '../lib/setup-codeql-action.js'
@@ -78,7 +78,7 @@ test("analyze action with RAM & threads from environment variables", async (t) =
    t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
    t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=4992");
    t.assert(runQueriesStub.calledOnce);
-    t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
+    t.deepEqual(runQueriesStub.firstCall.args[2], "--threads=-1");
    t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=4992");
  });
 });
@@ -76,7 +76,7 @@ test("analyze action with RAM & threads from action inputs", async (t) => {
    t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
    t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=3012");
    t.assert(runQueriesStub.calledOnce);
-    t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
+    t.deepEqual(runQueriesStub.firstCall.args[2], "--threads=-1");
    t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=3012");
  });
 });
@@ -324,10 +324,16 @@ async function run() {
    );

    if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
+      // Warn if the removed `add-snippets` input is used.
+      if (actionsUtil.getOptionalInput("add-snippets") !== undefined) {
+        logger.warning(
+          "The `add-snippets` input has been removed and no longer has any effect.",
+        );
+      }
+
      runStats = await runQueries(
        outputDir,
        memory,
-        util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")),
        threads,
        diffRangePackDir,
        actionsUtil.getOptionalInput("category"),
@@ -37,7 +37,6 @@ test("status report fields", async (t) => {
    setupActionsVars(tmpDir, tmpDir);

    const memoryFlag = "";
-    const addSnippetsFlag = "";
    const threadsFlag = "";
    sinon.stub(uploadLib, "validateSarifFileSchema");

@@ -103,7 +102,6 @@ test("status report fields", async (t) => {
      const statusReport = await runQueries(
        tmpDir,
        memoryFlag,
-        addSnippetsFlag,
        threadsFlag,
        undefined,
        undefined,
@@ -3,7 +3,6 @@ import * as path from "path";
 import { performance } from "perf_hooks";

 import * as io from "@actions/io";
-import * as del from "del";
 import * as yaml from "js-yaml";

 import { getTemporaryDirectory, PullRequestBranches } from "./actions-util";
@@ -437,7 +436,6 @@ export function addSarifExtension(
 export async function runQueries(
  sarifFolder: string,
  memoryFlag: string,
-  addSnippetsFlag: string,
  threadsFlag: string,
  diffRangePackDir: string | undefined,
  automationDetailsId: string | undefined,
@@ -627,7 +625,6 @@ export async function runQueries(
      databasePath,
      queries,
      sarifFile,
-      addSnippetsFlag,
      threadsFlag,
      enableDebugLogging ? "-vv" : "-v",
      sarifRunPropertyFlag,
@@ -671,7 +668,7 @@ export async function runFinalize(
  logger: Logger,
 ): Promise<DatabaseCreationTimings> {
  try {
-    await del.deleteAsync(outputDir, { force: true });
+    await fs.promises.rm(outputDir, { force: true, recursive: true });
  } catch (error: any) {
    if (error?.code !== "ENOENT") {
      throw error;
@@ -169,4 +169,32 @@ test("wrapApiConfigurationError correctly wraps specific configuration errors",
    res,
    new util.ConfigurationError("Resource not accessible by integration"),
  );
+
+  // Enablement errors.
+  const enablementErrorMessages = [
+    "Code Security must be enabled for this repository to use code scanning",
+    "Advanced Security must be enabled for this repository to use code scanning",
+    "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
+  ];
+  const transforms = [
+    (msg: string) => msg,
+    (msg: string) => msg.toLowerCase(),
+    (msg: string) => msg.toLocaleUpperCase(),
+  ];
+
+  for (const enablementErrorMessage of enablementErrorMessages) {
+    for (const transform of transforms) {
+      const enablementError = new util.HTTPError(
+        transform(enablementErrorMessage),
+        403,
+      );
+      res = api.wrapApiConfigurationError(enablementError);
+      t.deepEqual(
+        res,
+        new util.ConfigurationError(
+          api.getFeatureEnablementError(enablementError.message),
+        ),
+      );
+    }
+  }
 });
@@ -1,7 +1,6 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
 import * as retry from "@octokit/plugin-retry";
-import consoleLogLevel from "console-log-level";

 import { getActionVersion, getRequiredInput } from "./actions-util";
 import { Logger } from "./logging";
@@ -50,7 +49,12 @@ function createApiClientWithDetails(
    githubUtils.getOctokitOptions(auth, {
      baseUrl: apiDetails.apiURL,
      userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: consoleLogLevel({ level: "debug" }),
+      log: {
+        debug: core.debug,
+        info: core.info,
+        warn: core.warning,
+        error: core.error,
+      },
    }),
  );
 }
@@ -279,6 +283,20 @@ export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
  });
 }

+function isEnablementError(msg: string) {
+  return [
+    /Code Security must be enabled/i,
+    /Advanced Security must be enabled/i,
+    /Code Scanning is not enabled/i,
+  ].some((pattern) => pattern.test(msg));
+}
+
+// TODO: Move to `error-messages.ts` after refactoring import order to avoid cycle
+// since `error-messages.ts` currently depends on this file.
+export function getFeatureEnablementError(message: string): string {
+  return `Please verify that the necessary features are enabled: ${message}`;
+}
+
 export function wrapApiConfigurationError(e: unknown) {
  const httpError = asHTTPError(e);
  if (httpError !== undefined) {
@@ -300,6 +318,11 @@ export function wrapApiConfigurationError(e: unknown) {
        "Please check that your token is valid and has the required permissions: contents: read, security-events: write",
      );
    }
+    if (httpError.status === 403 && isEnablementError(httpError.message)) {
+      return new ConfigurationError(
+        getFeatureEnablementError(httpError.message),
+      );
+    }
    if (httpError.status === 429) {
      return new ConfigurationError("API rate limit exceeded");
    }
@@ -5,7 +5,6 @@ import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as io from "@actions/io";
 import * as toolcache from "@actions/tool-cache";
 import test, { ExecutionContext } from "ava";
-import * as del from "del";
 import * as yaml from "js-yaml";
 import nock from "nock";
 import * as sinon from "sinon";
@@ -557,7 +556,7 @@ const injectedConfigMacro = test.macro({
      const augmentedConfig = yaml.load(fs.readFileSync(configFile, "utf8"));
      t.deepEqual(augmentedConfig, expectedConfig);

-      await del.deleteAsync(configFile, { force: true });
+      await fs.promises.rm(configFile, { force: true });
    });
  },

@@ -1046,7 +1045,7 @@ test("Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OP
  );
  t.truthy(configArg, "Should have injected a codescanning config");
  const configFile = configArg!.split("=")[1];
-  await del.deleteAsync(configFile, { force: true });
+  await fs.promises.rm(configFile, { force: true });
 });

 export function stubToolRunnerConstructor(
@@ -167,7 +167,6 @@ export interface CodeQL {
    databasePath: string,
    querySuitePaths: string[] | undefined,
    sarifFile: string,
-    addSnippetsFlag: string,
    threadsFlag: string,
    verbosityFlag: string | undefined,
    sarifRunPropertyFlag: string | undefined,
@@ -817,7 +816,6 @@ export async function getCodeQLForCmd(
      databasePath: string,
      querySuitePaths: string[] | undefined,
      sarifFile: string,
-      addSnippetsFlag: string,
      threadsFlag: string,
      verbosityFlag: string,
      sarifRunPropertyFlag: string | undefined,
@@ -836,7 +834,6 @@ export async function getCodeQLForCmd(
        "--format=sarif-latest",
        verbosityFlag,
        `--output=${sarifFile}`,
-        addSnippetsFlag,
        "--print-diagnostics-summary",
        "--print-metrics-summary",
        "--sarif-add-baseline-file-info",
@@ -5,7 +5,6 @@ import * as artifact from "@actions/artifact";
 import * as artifactLegacy from "@actions/artifact-legacy";
 import * as core from "@actions/core";
 import archiver from "archiver";
-import * as del from "del";

 import { getOptionalInput, getTemporaryDirectory } from "./actions-util";
 import { dbIsFinalized } from "./analyze";
@@ -345,7 +344,7 @@ async function createPartialDatabaseBundle(
  );
  // See `bundleDb` for explanation behind deleting existing db bundle.
  if (fs.existsSync(databaseBundlePath)) {
-    await del.deleteAsync(databaseBundlePath, { force: true });
+    await fs.promises.rm(databaseBundlePath, { force: true });
  }
  const output = fs.createWriteStream(databaseBundlePath);
  const zip = archiver("zip");
@@ -137,4 +137,10 @@ export enum EnvVar {
   * This setting is more specific than `CODEQL_ACTION_TEST_MODE`, which implies this option.
   */
  SKIP_SARIF_UPLOAD = "CODEQL_ACTION_SKIP_SARIF_UPLOAD",
+
+  /**
+   * Whether to skip workflow validation. Intended for internal use, where we know that
+   * the workflow is valid and validation is not necessary.
+   */
+  SKIP_WORKFLOW_VALIDATION = "CODEQL_ACTION_SKIP_WORKFLOW_VALIDATION",
 }
@@ -86,7 +86,7 @@ import {
  getErrorMessage,
  BuildMode,
 } from "./util";
-import { validateWorkflow } from "./workflow";
+import { checkWorkflow } from "./workflow";

 /**
 * Sends a status report indicating that the `init` Action is starting.
@@ -288,16 +288,9 @@ async function run() {
    toolsSource = initCodeQLResult.toolsSource;
    zstdAvailability = initCodeQLResult.zstdAvailability;

-    core.startGroup("Validating workflow");
-    const validateWorkflowResult = await validateWorkflow(codeql, logger);
-    if (validateWorkflowResult === undefined) {
-      logger.info("Detected no issues with the code scanning workflow.");
-    } else {
-      logger.warning(
-        `Unable to validate code scanning workflow: ${validateWorkflowResult}`,
-      );
-    }
-    core.endGroup();
+    // Check the workflow for problems. If there are any problems, they are reported
+    // to the workflow log. No exceptions are thrown.
+    await checkWorkflow(logger, codeql);

    // Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for Rust if between 2.19.3 (included) and 2.22.1 (excluded)
    // We need to set this environment variable before initializing the config, otherwise Rust
@@ -13,7 +13,15 @@ export interface Logger {
 }

 export function getActionsLogger(): Logger {
-  return core;
+  return {
+    debug: core.debug,
+    info: core.info,
+    warning: core.warning,
+    error: core.error,
+    isDebug: core.isDebug,
+    startGroup: core.startGroup,
+    endGroup: core.endGroup,
+  };
 }

 export function getRunnerLogger(debugMode: boolean): Logger {
@@ -9,7 +9,7 @@ import * as semver from "semver";

 import { CommandInvocationError } from "./actions-util";
 import { Logger } from "./logging";
-import { assertNever, cleanUpGlob, isBinaryAccessible } from "./util";
+import { assertNever, cleanUpPath, isBinaryAccessible } from "./util";

 const MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 const MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
@@ -217,7 +217,7 @@ export async function extractTarZst(
      });
    });
  } catch (e) {
-    await cleanUpGlob(dest, "extraction destination directory", logger);
+    await cleanUpPath(dest, "extraction destination directory", logger);
    throw e;
  }
 }
@@ -12,7 +12,7 @@ import * as semver from "semver";

 import { formatDuration, Logger } from "./logging";
 import * as tar from "./tar";
-import { cleanUpGlob, getErrorMessage, getRequiredEnvParam } from "./util";
+import { cleanUpPath, getErrorMessage, getRequiredEnvParam } from "./util";

 /**
 * High watermark to use when streaming the download and extraction of the CodeQL tools.
@@ -130,7 +130,7 @@ export async function downloadAndExtract(

    // If we failed during processing, we want to clean up the destination directory
    // before we try again.
-    await cleanUpGlob(dest, "CodeQL bundle", logger);
+    await cleanUpPath(dest, "CodeQL bundle", logger);
  }

  const toolsDownloadStart = performance.now();
@@ -167,7 +167,7 @@ export async function downloadAndExtract(
      )}).`,
    );
  } finally {
-    await cleanUpGlob(archivedBundlePath, "CodeQL bundle archive", logger);
+    await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger);
  }

  return {
@@ -101,16 +101,6 @@ test("getMemoryFlag() throws if the ram input is < 0 or NaN", async (t) => {
  }
 });

-test("getAddSnippetsFlag() should return the correct flag", (t) => {
-  t.deepEqual(util.getAddSnippetsFlag(true), "--sarif-add-snippets");
-  t.deepEqual(util.getAddSnippetsFlag("true"), "--sarif-add-snippets");
-
-  t.deepEqual(util.getAddSnippetsFlag(false), "--no-sarif-add-snippets");
-  t.deepEqual(util.getAddSnippetsFlag(undefined), "--no-sarif-add-snippets");
-  t.deepEqual(util.getAddSnippetsFlag("false"), "--no-sarif-add-snippets");
-  t.deepEqual(util.getAddSnippetsFlag("foo bar"), "--no-sarif-add-snippets");
-});
-
 test("getThreadsFlag() should return the correct --threads flag", (t) => {
  const numCpus = os.cpus().length;

@@ -534,3 +524,12 @@ test("getCgroupCpuCountFromCpus returns undefined if the CPU file exists but is
    );
  });
 });
+
+test("checkDiskUsage succeeds and produces positive numbers", async (t) => {
+  process.env["GITHUB_WORKSPACE"] = os.tmpdir();
+  const diskUsage = await util.checkDiskUsage(getRunnerLogger(true));
+  if (t.truthy(diskUsage)) {
+    t.true(diskUsage.numAvailableBytes > 0);
+    t.true(diskUsage.numTotalBytes > 0);
+  }
+});
@@ -6,7 +6,6 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as exec from "@actions/exec/lib/exec";
 import * as io from "@actions/io";
-import * as del from "del";
 import getFolderSize from "get-folder-size";
 import * as yaml from "js-yaml";
 import * as semver from "semver";
@@ -167,7 +166,7 @@ export async function withTmpDir<T>(
 ): Promise<T> {
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "codeql-action-"));
  const result = await body(tmpDir);
-  await del.deleteAsync(tmpDir, { force: true });
+  await fs.promises.rm(tmpDir, { force: true, recursive: true });
  return result;
 }

@@ -343,21 +342,6 @@ export function getMemoryFlag(
  return `--ram=${megabytes}`;
 }

-/**
- * Get the codeql flag to specify whether to add code snippets to the sarif file.
- *
- * @returns string
- */
-export function getAddSnippetsFlag(
-  userInput: string | boolean | undefined,
-): string {
-  if (typeof userInput === "string") {
-    // have to process specifically because any non-empty string is truthy
-    userInput = userInput.toLowerCase() === "true";
-  }
-  return userInput ? "--sarif-add-snippets" : "--no-sarif-add-snippets";
-}
-
 /**
 * Get the value of the codeql `--threads` flag specified for the `threads`
 * input. If no value was specified, all available threads will be used.
@@ -756,7 +740,7 @@ export async function bundleDb(
  // from somewhere else or someone trying to make the action upload a
  // non-database file.
  if (fs.existsSync(databaseBundlePath)) {
-    await del.deleteAsync(databaseBundlePath, { force: true });
+    await fs.promises.rm(databaseBundlePath, { force: true });
  }
  await codeql.databaseBundle(databasePath, databaseBundlePath, dbName);
  return databaseBundlePath;
@@ -1099,15 +1083,6 @@ export async function checkDiskUsage(
  logger: Logger,
 ): Promise<DiskUsage | undefined> {
  try {
-    // We avoid running the `df` binary under the hood for macOS ARM runners with SIP disabled.
-    if (
-      process.platform === "darwin" &&
-      (process.arch === "arm" || process.arch === "arm64") &&
-      !(await checkSipEnablement(logger))
-    ) {
-      return undefined;
-    }
-
    const diskUsage = await fsPromises.statfs(
      getRequiredEnvParam("GITHUB_WORKSPACE"),
    );
@@ -1265,19 +1240,13 @@ export async function checkSipEnablement(
  }
 }

-export async function cleanUpGlob(glob: string, name: string, logger: Logger) {
+export async function cleanUpPath(file: string, name: string, logger: Logger) {
  logger.debug(`Cleaning up ${name}.`);
  try {
-    const deletedPaths = await del.deleteAsync(glob, { force: true });
-    if (deletedPaths.length === 0) {
-      logger.warning(
-        `Failed to clean up ${name}: no files found matching ${glob}.`,
-      );
-    } else if (deletedPaths.length === 1) {
-      logger.debug(`Cleaned up ${name}.`);
-    } else {
-      logger.debug(`Cleaned up ${name} (${deletedPaths.length} files).`);
-    }
+    await fs.promises.rm(file, {
+      force: true,
+      recursive: true,
+    });
  } catch (e) {
    logger.warning(`Failed to clean up ${name}: ${e}.`);
  }
@@ -2,9 +2,17 @@ import test, { ExecutionContext } from "ava";
 import * as yaml from "js-yaml";
 import * as sinon from "sinon";

-import { getCodeQLForTesting } from "./codeql";
-import { setupTests } from "./testing-utils";
+import * as actionsUtil from "./actions-util";
+import { createStubCodeQL, getCodeQLForTesting } from "./codeql";
+import { EnvVar } from "./environment";
 import {
+  checkExpectedLogMessages,
+  getRecordingLogger,
+  LoggedMessage,
+  setupTests,
+} from "./testing-utils";
+import {
+  checkWorkflow,
  CodedError,
  formatWorkflowCause,
  formatWorkflowErrors,
@@ -13,6 +21,7 @@ import {
  Workflow,
  WorkflowErrors,
 } from "./workflow";
+import * as workflow from "./workflow";

 function errorCodes(
  actual: CodedError[],
@@ -870,3 +879,78 @@ test("getCategoryInputOrThrow throws error for workflow with multiple calls to a
    },
  );
 });
+
+test("checkWorkflow - validates workflow if `SKIP_WORKFLOW_VALIDATION` is not set", async (t) => {
+  const messages: LoggedMessage[] = [];
+  const codeql = createStubCodeQL({});
+
+  sinon.stub(actionsUtil, "isDynamicWorkflow").returns(false);
+  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
+  validateWorkflow.resolves(undefined);
+
+  await checkWorkflow(getRecordingLogger(messages), codeql);
+
+  t.assert(
+    validateWorkflow.calledOnce,
+    "`checkWorkflow` unexpectedly did not call `validateWorkflow`",
+  );
+  checkExpectedLogMessages(t, messages, [
+    "Detected no issues with the code scanning workflow.",
+  ]);
+});
+
+test("checkWorkflow - logs problems with workflow validation", async (t) => {
+  const messages: LoggedMessage[] = [];
+  const codeql = createStubCodeQL({});
+
+  sinon.stub(actionsUtil, "isDynamicWorkflow").returns(false);
+  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
+  validateWorkflow.resolves("problem");
+
+  await checkWorkflow(getRecordingLogger(messages), codeql);
+
+  t.assert(
+    validateWorkflow.calledOnce,
+    "`checkWorkflow` unexpectedly did not call `validateWorkflow`",
+  );
+  checkExpectedLogMessages(t, messages, [
+    "Unable to validate code scanning workflow: problem",
+  ]);
+});
+
+test("checkWorkflow - skips validation if `SKIP_WORKFLOW_VALIDATION` is `true`", async (t) => {
+  process.env[EnvVar.SKIP_WORKFLOW_VALIDATION] = "true";
+
+  const messages: LoggedMessage[] = [];
+  const codeql = createStubCodeQL({});
+
+  sinon.stub(actionsUtil, "isDynamicWorkflow").returns(false);
+  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
+
+  await checkWorkflow(getRecordingLogger(messages), codeql);
+
+  t.assert(
+    validateWorkflow.notCalled,
+    "`checkWorkflow` called `validateWorkflow` unexpectedly",
+  );
+  t.is(messages.length, 0);
+});
+
+test("checkWorkflow - skips validation for `dynamic` workflows", async (t) => {
+  const messages: LoggedMessage[] = [];
+  const codeql = createStubCodeQL({});
+
+  const isDynamicWorkflow = sinon
+    .stub(actionsUtil, "isDynamicWorkflow")
+    .returns(true);
+  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
+
+  await checkWorkflow(getRecordingLogger(messages), codeql);
+
+  t.assert(isDynamicWorkflow.calledOnce);
+  t.assert(
+    validateWorkflow.notCalled,
+    "`checkWorkflow` called `validateWorkflow` unexpectedly",
+  );
+  t.is(messages.length, 0);
+});
@@ -5,8 +5,10 @@ import zlib from "zlib";
 import * as core from "@actions/core";
 import * as yaml from "js-yaml";

+import { isDynamicWorkflow } from "./actions-util";
 import * as api from "./api-client";
 import { CodeQL } from "./codeql";
+import { EnvVar } from "./environment";
 import { Logger } from "./logging";
 import {
  getRequiredEnvParam,
@@ -216,7 +218,7 @@ function hasWorkflowTrigger(triggerName: string, doc: Workflow): boolean {
  return Object.prototype.hasOwnProperty.call(doc.on, triggerName);
 }

-export async function validateWorkflow(
+async function validateWorkflow(
  codeql: CodeQL,
  logger: Logger,
 ): Promise<undefined | string> {
@@ -462,3 +464,36 @@ export function getCheckoutPathInputOrThrow(
    ) || getRequiredEnvParam("GITHUB_WORKSPACE") // if unspecified, checkout_path defaults to ${{ github.workspace }}
  );
 }
+
+/**
+ * A wrapper around `validateWorkflow` which reports the outcome.
+ *
+ * @param logger The logger to use.
+ * @param codeql The CodeQL instance.
+ */
+export async function checkWorkflow(logger: Logger, codeql: CodeQL) {
+  // Check the workflow for problems, unless `SKIP_WORKFLOW_VALIDATION` is `true`
+  // or the workflow trigger is `dynamic`.
+  if (
+    !isDynamicWorkflow() &&
+    process.env[EnvVar.SKIP_WORKFLOW_VALIDATION] !== "true"
+  ) {
+    core.startGroup("Validating workflow");
+    const validateWorkflowResult = await internal.validateWorkflow(
+      codeql,
+      logger,
+    );
+    if (validateWorkflowResult === undefined) {
+      logger.info("Detected no issues with the code scanning workflow.");
+    } else {
+      logger.debug(
+        `Unable to validate code scanning workflow: ${validateWorkflowResult}`,
+      );
+    }
+    core.endGroup();
+  }
+}
+
+export const internal = {
+  validateWorkflow,
+};
@@ -29,6 +29,6 @@ outputs:
  proxy_urls:
    description: A stringified JSON array of objects containing the types and URLs of the configured registries.
 runs:
-  using: node24
+  using: node20
  main: "../lib/start-proxy-action.js"
  post: "../lib/start-proxy-action-post.js"
@@ -41,6 +41,6 @@ outputs:

      { "code-scanning": "some-id", "code-quality": "some-other-id" }
 runs:
-  using: node24
+  using: node20
  main: '../lib/upload-sarif-action.js'
  post: '../lib/upload-sarif-action-post.js'
Author	SHA1	Message	Date
Henry Mercer	5d5cd550d3	Merge pull request #3263 from github/backport-v3.31.2-0499de31b Merge releases/v4 into releases/v3	2025-10-30 15:01:09 +00:00
github-actions[bot]	c6eb09db21	Rebuild	2025-10-30 14:37:32 +00:00
github-actions[bot]	09db9044dc	Update version and changelog for v3.31.2	2025-10-30 14:34:26 +00:00
github-actions[bot]	d3cd47d8d6	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.2-0499de31b	2025-10-30 14:34:25 +00:00
github-actions[bot]	8e9caa5100	Revert "Rebuild" This reverts commit `c2805e0a04`.	2025-10-30 14:34:25 +00:00
github-actions[bot]	23a6333b88	Revert "Update version and changelog for v3.31.1" This reverts commit `c0d3370b54`.	2025-10-30 14:34:24 +00:00
Henry Mercer	0499de31b9	Merge pull request #3261 from github/henrymercer/setup-python Set up Python in mergeback workflow	2025-10-30 14:30:19 +00:00
Henry Mercer	3b96745d2b	Set up Python in mergeback workflow	2025-10-30 14:06:12 +00:00
Michael B. Gale	8a06050a8c	Merge pull request #3259 from github/update-v4.31.2-9576b5cbe Merge main into releases/v4	2025-10-30 13:47:48 +00:00
github-actions[bot]	752a642cb2	Update changelog for v4.31.2	2025-10-30 13:27:33 +00:00
Michael B. Gale	9576b5cbe8	Merge pull request #3258 from github/mbg/enablement-errors/case-insensitive Make `isEnablementError` case-insensitive	2025-10-30 11:59:43 +00:00
Henry Mercer	cc8843728c	Merge pull request #3257 from github/henrymercer/ubuntu-slim Run lightweight workflows on `ubuntu-slim`	2025-10-30 11:44:22 +00:00
Michael B. Gale	f0e9bf07f4	Make `isEnablementError` case-insensitive	2025-10-30 11:37:07 +00:00
Henry Mercer	2a3599c520	Run lightweight workflows on `ubuntu-slim`	2025-10-30 11:25:32 +00:00
Henry Mercer	514ff4d116	Merge pull request #3256 from github/henrymercer/resolve-bad-merge Remove unused `console-log-level` dependency	2025-10-30 11:19:24 +00:00
Henry Mercer	aab1c2f931	Merge pull request #3253 from github/mergeback/v4.31.1-to-main-5fe9434c Mergeback v4.31.1 refs/heads/releases/v4 into main	2025-10-30 11:04:54 +00:00
Henry Mercer	c503cb4fbb	Merge pull request #3254 from github/backport-v3.31.1-5fe9434cd Merge releases/v4 into releases/v3	2025-10-30 11:00:54 +00:00
Henry Mercer	b2bffa615d	Remove unused `console-log-level` dependency This was added back by a bad merge.	2025-10-30 10:40:23 +00:00
github-actions[bot]	c2805e0a04	Rebuild	2025-10-30 10:35:44 +00:00
github-actions[bot]	e7811794d3	Rebuild	2025-10-30 10:31:33 +00:00
github-actions[bot]	c0d3370b54	Update version and changelog for v3.31.1	2025-10-30 10:31:02 +00:00
github-actions[bot]	ddd0dc746a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.1-5fe9434cd	2025-10-30 10:31:01 +00:00
github-actions[bot]	2f607936ce	Revert "Rebuild" This reverts commit `9e3918e481`.	2025-10-30 10:31:00 +00:00
github-actions[bot]	37e7dfbaa0	Revert "Update version and changelog for v3.31.0" This reverts commit `7dd1575dac`.	2025-10-30 10:31:00 +00:00
github-actions[bot]	c7a5b09374	Merge remote-tracking branch 'origin/main' into mergeback/v4.31.1-to-main-5fe9434c	2025-10-30 10:30:29 +00:00
github-actions[bot]	cbcb06a3ae	Update changelog and version after v4.31.1	2025-10-30 10:29:22 +00:00
Henry Mercer	5fe9434cd2	Merge pull request #3252 from github/update-v4.31.1-777daa0c7 Merge main into releases/v4	2025-10-30 10:28:34 +00:00
Henry Mercer	8d50be301c	Merge pull request #3245 from github/dependabot/github_actions/dot-github/workflows/actions/download-artifact-6 Bump actions/download-artifact from 5 to 6 in /.github/workflows	2025-10-30 10:02:36 +00:00
github-actions[bot]	237497c8f0	Update changelog for v4.31.1	2025-10-30 09:40:55 +00:00
Michael B. Gale	777daa0c71	Merge pull request #3239 from github/mbg/remove/add-snippets Remove `add-snippets` input	2025-10-29 13:32:20 +00:00
Michael B. GaleandEsben Sparre Andreasen	74c8748a6f	Update analyze/action.yml Co-authored-by: Esben Sparre Andreasen <esbena@github.com>	2025-10-29 10:34:13 +00:00
Michael B. Gale	34c50c1d29	Merge pull request #3251 from github/mbg/user-error/enablement Turn enablement errors into configuration errors	2025-10-29 09:57:38 +00:00
Michael B. Gale	4ae68afd84	Warn if the `add-snippets` input is used	2025-10-29 09:29:28 +00:00
Michael B. Gale	52a7bd7b6e	Check for 403 status	2025-10-29 08:35:19 +00:00
Michael B. Gale	194ba0ee2d	Make error message tests less brittle	2025-10-29 08:29:11 +00:00
Michael B. Gale	53acf0b8aa	Turn enablement errors into configuration errors	2025-10-28 21:17:30 +00:00
Henry Mercer	ac9aeee226	Merge pull request #3249 from github/henrymercer/api-logging Use Actions logger in API client	2025-10-28 17:05:58 +00:00
Henry Mercer	d49e837b8c	Merge branch 'main' into henrymercer/api-logging	2025-10-28 16:49:10 +00:00
Henry Mercer	3d988b275a	Pass minimal copy of `core`	2025-10-28 16:33:21 +00:00
Henry Mercer	8cc18acfa4	Merge pull request #3250 from github/henrymercer/prefer-fs-delete Use Node `fs` APIs instead of `del`	2025-10-28 15:45:56 +00:00
Henry Mercer	ea5cb4a016	Merge branch 'main' into henrymercer/prefer-fs-delete	2025-10-28 15:26:42 +00:00
Henry Mercer	e1c8976a56	Merge pull request #3247 from github/henrymercer/disk-usage-node-api Check disk usage using Node.js API	2025-10-28 15:24:12 +00:00
Henry Mercer	4256e2e2a0	Merge branch 'main' into henrymercer/disk-usage-node-api	2025-10-28 15:05:13 +00:00
Henry Mercer	66459ea37c	Apply suggestion	2025-10-28 15:04:31 +00:00
Henry Mercer	1af9394995	Merge pull request #3244 from github/dependabot/github_actions/dot-github/workflows/actions-minor-b11285d543 Bump ruby/setup-ruby from 1.265.0 to 1.267.0 in /.github/workflows in the actions-minor group across 1 directory	2025-10-28 13:28:36 +00:00
Henry Mercer	311fc42780	Merge pull request #3242 from github/dependabot/npm_and_yarn/npm-minor-75b724c14c Bump the npm-minor group with 4 updates	2025-10-28 13:25:25 +00:00
Henry Mercer	284bf9b047	Merge pull request #3241 from github/dependabot/github_actions/dot-github/workflows/actions/upload-artifact-5 Bump actions/upload-artifact from 4 to 5 in /.github/workflows	2025-10-28 13:23:08 +00:00
Henry Mercer	a53e78ee2a	Merge pull request #3243 from github/dependabot/npm_and_yarn/actions/artifact-4.0.0 Bump @actions/artifact from 2.3.1 to 4.0.0	2025-10-28 13:12:23 +00:00
Henry Mercer	d84f470a9a	Improve method naming	2025-10-28 13:06:14 +00:00
Henry Mercer	41c0a26213	Use Node `fs` APIs instead of `del`	2025-10-28 13:00:25 +00:00
Henry Mercer	d4ba404a20	Tweak assertions	2025-10-28 12:50:22 +00:00
Henry Mercer	55895ef678	Stub `GITHUB_WORKSPACE` in test	2025-10-28 12:45:22 +00:00
Henry Mercer	fe16891f40	Add unit test for `checkDiskUsage`	2025-10-28 12:40:23 +00:00
Henry Mercer	57c7b6afb6	Disable SIP disablement check	2025-10-28 12:35:41 +00:00
Michael B. Gale	44aeac1a37	Merge branch 'main' into dependabot/github_actions/dot-github/workflows/actions/download-artifact-6	2025-10-28 12:21:17 +00:00
Henry Mercer	8b1e55d11e	Use Actions logger in API client This allows us to remove the `console-log-level` dependency.	2025-10-28 12:15:03 +00:00
Henry Mercer	20900ee769	Build: Run npm install when `package-lock.json` out of date	2025-10-28 11:52:42 +00:00
Michael B. Gale	ad8ad9829e	Merge pull request #3240 from github/mbg/allow-skip-workflow-validation Support skipping workflow validation	2025-10-28 11:46:08 +00:00
dependabot[bot]	9c39f0afb0	Bump actions/download-artifact from 5 to 6 in /.github/workflows Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 6. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-27 18:05:01 +00:00
github-actions[bot]	fcc1377ac6	Rebuild	2025-10-27 17:54:41 +00:00
dependabot[bot]	b5bbb5ab73	Bump ruby/setup-ruby Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.265.0 to 1.267.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/ab177d40ee5483edb974554986f56b33477e21d0...d5126b9b3579e429dd52e51e68624dda2e05be25) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.267.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-27 17:52:58 +00:00
github-actions[bot]	723a9469fd	Rebuild	2025-10-27 17:41:35 +00:00
dependabot[bot]	f9eed03ba2	Bump @actions/artifact from 2.3.1 to 4.0.0 Bumps [@actions/artifact](https://github.com/actions/toolkit/tree/HEAD/packages/artifact) from 2.3.1 to 4.0.0. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/artifact/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/@actions/cache@4.0.0/packages/artifact) --- updated-dependencies: - dependency-name: "@actions/artifact" dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-27 17:39:59 +00:00
github-actions[bot]	df9e49e9e8	Rebuild	2025-10-27 17:37:24 +00:00
dependabot[bot]	c9d47e2ee9	Bump the npm-minor group with 4 updates Bumps the npm-minor group with 4 updates: [@octokit/types](https://github.com/octokit/types.ts), [@types/archiver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/archiver), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser). Updates `@octokit/types` from 15.0.0 to 15.0.1 - [Release notes](https://github.com/octokit/types.ts/releases) - [Commits](https://github.com/octokit/types.ts/compare/v15.0.0...v15.0.1) Updates `@types/archiver` from 6.0.3 to 6.0.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/archiver) Updates `@typescript-eslint/eslint-plugin` from 8.46.1 to 8.46.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.2/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.46.1 to 8.46.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.2/packages/parser) --- updated-dependencies: - dependency-name: "@octokit/types" dependency-version: 15.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@types/archiver" dependency-version: 6.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.46.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/parser" dependency-version: 8.46.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-27 17:35:52 +00:00
github-actions[bot]	714962e17a	Rebuild	2025-10-27 17:30:37 +00:00
dependabot[bot]	42f957bb51	Bump actions/upload-artifact from 4 to 5 in /.github/workflows Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-27 17:28:57 +00:00
Michael B. Gale	52cec4178d	Downgrade log message from warning to debug level	2025-10-27 17:02:01 +00:00
Michael B. Gale	55c083790a	Move `checkWorkflow` to `workflow.ts`	2025-10-27 17:01:23 +00:00
Michael B. Gale	50601762ea	Also skip workflow validation for `dynamic` workflows	2025-10-27 16:10:08 +00:00
Michael B. Gale	06fbd897c4	Move workflow check to a function in `init.ts` and add tests	2025-10-27 15:57:44 +00:00
Michael B. Gale	127851b399	Add environment variable for skipping workflow validation	2025-10-27 15:42:43 +00:00
Michael B. Gale	db47d17142	Remove `add-snippets` input	2025-10-27 12:53:23 +00:00
Michael B. Gale	d198d2fabf	Merge pull request #3237 from github/backport-v3.31.0-4e94bd11f Merge releases/v4 into releases/v3	2025-10-24 19:30:34 +01:00
github-actions[bot]	9e3918e481	Rebuild	2025-10-24 17:18:40 +00:00
github-actions[bot]	7dd1575dac	Update version and changelog for v3.31.0	2025-10-24 17:11:07 +00:00
github-actions[bot]	28fc48d83c	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.0-4e94bd11f	2025-10-24 17:11:06 +00:00
github-actions[bot]	12c6008004	Revert "Rebuild" This reverts commit `5f3f3164ad`.	2025-10-24 17:11:05 +00:00
github-actions[bot]	d3019effb0	Revert "Update version and changelog for v3.30.9" This reverts commit `ba42101490`.	2025-10-24 17:11:05 +00:00
Henry Mercer	42213152a8	Merge pull request #3216 from github/backport-v3.30.9-16140ae1a Merge releases/v4 into releases/v3	2025-10-17 17:09:13 +01:00
Henry Mercer	e677e67801	Run `setup-codeql` on Node 20 for v3	2025-10-17 16:53:18 +01:00
github-actions[bot]	5f3f3164ad	Rebuild	2025-10-17 15:34:40 +00:00
github-actions[bot]	ba42101490	Update version and changelog for v3.30.9	2025-10-17 15:24:34 +00:00
github-actions[bot]	f11af5849b	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.30.9-16140ae1a	2025-10-17 15:24:33 +00:00
github-actions[bot]	ba5430dc86	Revert "Rebuild" This reverts commit `948223fe01`.	2025-10-17 15:24:33 +00:00
github-actions[bot]	13e883e119	Revert "Update version and changelog for v3.30.8" This reverts commit `a37add20d4`.	2025-10-17 15:24:32 +00:00
Michael B. Gale	755f44910c	Merge pull request #3201 from github/backport-v3.30.8-2a6736cca Merge releases/v4 into releases/v3	2025-10-10 18:20:36 +01:00
github-actions[bot]	948223fe01	Rebuild	2025-10-10 16:56:34 +00:00
github-actions[bot]	a37add20d4	Update version and changelog for v3.30.8	2025-10-10 16:50:13 +00:00
github-actions[bot]	ab163cf08b	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.30.8-2a6736cca	2025-10-10 16:50:12 +00:00
github-actions[bot]	319796f085	Revert "Rebuild" This reverts commit `c551c50310`.	2025-10-10 16:50:12 +00:00
github-actions[bot]	bd1ac56295	Revert "Update version and changelog for v3.30.7" This reverts commit `b264e15259`.	2025-10-10 16:50:12 +00:00
Mario Campos	a8d1ac45b9	Merge pull request #3187 from github/backport-v3.30.7-e296a9355 Merge releases/v4 into releases/v3	2025-10-07 10:58:53 -05:00
github-actions[bot]	c551c50310	Rebuild	2025-10-07 15:33:29 +00:00
Mario Campos	01f1a24033	Downgrade action.yml to use Node.js 20 instead of Node.js 24 for v3	2025-10-07 10:29:22 -05:00
github-actions[bot]	b264e15259	Update version and changelog for v3.30.7	2025-10-07 15:23:05 +00:00