Address code review feedback

- Remove awkward blank lines left after removing eslint-disable comments
- Add baseUrl to tsconfig.json for proper paths resolution

Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com>

.github/pull_request_template.md

@@ -23,13 +23,13 @@ For internal use only. Please select the risk level of this change:
 Workflow types:
 
 - **Advanced setup** - Impacts users who have custom CodeQL workflows.
-- **Managed** - Impacts users with `dynamic` workflows (Default Setup, Code Quality, ...).
+- **Managed** - Impacts users with `dynamic` workflows (Default Setup, CCR, ...).
 
 Products:
 
 - **Code Scanning** - The changes impact analyses when `analysis-kinds: code-scanning`.
 - **Code Quality** - The changes impact analyses when `analysis-kinds: code-quality`.
-- **Other first-party** - The changes impact other first-party analyses.
+- **CCR** - The changes impact analyses for Copilot Code Reviews.
 - **Third-party analyses** - The changes affect the `upload-sarif` action.
 
 Environments:
@@ -54,7 +54,6 @@ Environments:
 
 - **Feature flags** - All new or changed code paths can be fully disabled with corresponding feature flags.
 - **Rollback** - Change can only be disabled by rolling back the release or releasing a new version with a fix.
-- **Development/testing only** - This change cannot cause any failures in production.
 - **Other** - Please provide details.
 
 #### How will you know if something goes wrong after this change is released?

.github/update-release-branch.py

@@ -71,9 +71,8 @@ def open_pr(
     body.append('')
     body.append('Contains the following pull requests:')
     for pr in pull_requests:
-      # Use PR author if they are GitHub staff, otherwise use the merger
-      display_user = get_pr_author_if_staff(pr) or get_merger_of_pr(repo, pr)
-      body.append(f'- #{pr.number} (@{display_user})')
+      merger = get_merger_of_pr(repo, pr)
+      body.append(f'- #{pr.number} (@{merger})')
 
   # List all commits not part of a PR
   if len(commits_without_pull_requests) > 0:
@@ -169,14 +168,6 @@ def get_pr_for_commit(commit):
 def get_merger_of_pr(repo, pr):
   return repo.get_commit(pr.merge_commit_sha).author.login
 
-# Get the PR author if they are GitHub staff, otherwise None.
-def get_pr_author_if_staff(pr):
-  if pr.user is None:
-    return None
-  if getattr(pr.user, 'site_admin', False):
-    return pr.user.login
-  return None
-
 def get_current_version():
   with open('package.json', 'r') as f:
     return json.load(f)['version']
@@ -190,9 +181,9 @@ def replace_version_package_json(prev_version, new_version):
       print(line.replace(prev_version, new_version), end='')
     else:
       prev_line_is_codeql = False
-      print(line, end='')
+      print(line, end='') 
     if '\"name\": \"codeql\",' in line:
-        prev_line_is_codeql = True
+        prev_line_is_codeql = True 
 
 def get_today_string():
   today = datetime.datetime.today()

.github/workflows/__all-platform-bundle.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__analyze-ref-input.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__autobuild-action.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__autobuild-working-dir.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__build-mode-autobuild.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__build-mode-manual.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__build-mode-none.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__build-mode-rollback.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__bundle-from-toolcache.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
@@ -59,7 +56,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
+        run: npm install @actions/tool-cache
       - name: Check toolcache contains CodeQL
         continue-on-error: true
         uses: actions/github-script@v8

.github/workflows/__bundle-toolcache.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
@@ -71,7 +68,7 @@ jobs:
             const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
             fs.rmdirSync(codeqlPath, { recursive: true });
       - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
+        run: npm install @actions/tool-cache
       - name: Check toolcache does not contain CodeQL
         uses: actions/github-script@v8
         with:

.github/workflows/__bundle-zstd.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__ccr.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From nightly'
+name: PR Check - CCR
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
@@ -32,16 +29,32 @@ defaults:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-nightly-${{github.ref}}
+  group: ccr-${{github.ref}}
 jobs:
-  bundle-from-nightly:
+  ccr:
     strategy:
       fail-fast: false
       matrix:
         include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: ubuntu-latest
+            version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: ubuntu-latest
+            version: default
           - os: ubuntu-latest
             version: linked
-    name: 'Bundle: From nightly'
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: CCR
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -58,15 +71,17 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - id: init
-        uses: ./../action/init
-        env:
-          CODEQL_ACTION_FORCE_NIGHTLY: true
+      - uses: ./../action/init
+        id: init
         with:
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
           languages: javascript
-      - name: Fail if the CodeQL version is not a nightly
-        if: "!contains(steps.init.outputs.codeql-version, '+')"
-        run: exit 1
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - uses: ./../action/analyze
+        id: analysis
+        with:
+          upload-database: false
+
     env:
+      CODEQL_ACTION_ANALYSIS_KEY: dynamic/copilot-pull-request-reviewer/codeql-action-test
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__config-export.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__config-input.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__cpp-deptrace-disabled.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__cpp-deptrace-enabled.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__diagnostics-export.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__export-file-baseline-information.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__extractor-ram-threads.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__global-proxy.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-custom-queries.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-tracing-autobuilder.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__init-with-registries.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__javascript-source-root.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__job-run-uuid-sarif.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__language-aliases.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__local-bundle.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__multi-language-autodetect.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__overlay-init-fallback.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__packaging-config-inputs-js.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__packaging-config-js.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__packaging-inputs-js.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__quality-queries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: PR Check - Analysis kinds
+name: PR Check - Quality queries input
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
@@ -32,9 +29,9 @@ defaults:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analysis-kinds-${{github.ref}}
+  group: quality-queries-${{github.ref}}
 jobs:
-  analysis-kinds:
+  quality-queries:
     strategy:
       fail-fast: false
       matrix:
@@ -48,9 +45,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
-            version: linked
-            analysis-kinds: risk-assessment
           - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning
@@ -60,10 +54,7 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
-            version: nightly-latest
-            analysis-kinds: risk-assessment
-    name: Analysis kinds
+    name: Quality queries input
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -90,24 +81,30 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
           post-processed-sarif-path: ${{ runner.temp }}/post-processed
-
-      - name: Upload SARIF files
+      - name: Upload security SARIF
+        if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/upload-artifact@v6
         with:
           name: |
-            analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: ${{ runner.temp }}/results/*.sarif
+            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
+          path: ${{ runner.temp }}/results/javascript.sarif
+          retention-days: 7
+      - name: Upload quality SARIF
+        if: contains(matrix.analysis-kinds, 'code-quality')
+        uses: actions/upload-artifact@v6
+        with:
+          name: |
+            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
+          path: ${{ runner.temp }}/results/javascript.quality.sarif
           retention-days: 7
-
       - name: Upload post-processed SARIF
         uses: actions/upload-artifact@v6
         with:
           name: |
-            post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
+            post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
           path: ${{ runner.temp }}/post-processed
           retention-days: 7
           if-no-files-found: error
-
       - name: Check quality query does not appear in security SARIF
         if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@v8
@@ -125,7 +122,6 @@ jobs:
         with:
           script: ${{ env.CHECK_SCRIPT }}
     env:
-      CODEQL_ACTION_RISK_ASSESSMENT_ID: 1
       CHECK_SCRIPT: |
         const fs = require('fs');
 

.github/workflows/__remote-config.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__resolve-environment-action.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__rubocop-multi-language.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
@@ -59,7 +56,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+        uses: ruby/setup-ruby@90be1154f987f4dc0fe0dd0feedac9e473aa4ba8 # v1.286.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__ruby.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__rust.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__split-workflow.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__start-proxy.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__submit-sarif-failure.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__swift-autobuild.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__swift-custom-build.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__unset-environment.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__upload-ref-sha-input.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__upload-sarif.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/__with-checkout-path.yml

@@ -18,9 +18,6 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  merge_group:
-    types:
-      - checks_requested
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:

.github/workflows/codeql.yml

@@ -7,8 +7,6 @@ on:
     # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
     # by other workflows.
     types: [opened, synchronize, reopened, ready_for_review]
-  merge_group:
-    types: [checks_requested]
   schedule:
     # Weekly on Sunday.
     - cron: '30 1 * * 0'
@@ -66,7 +64,7 @@ jobs:
         #
         # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
         # the same as running with `tools: null`.
-        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LATEST" ]]; then
+        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LATEST" ]]; then
           VERSIONS_JSON='[null]'
         else
           VERSIONS_JSON='[null, "linked"]'
@@ -110,7 +108,7 @@ jobs:
       uses: ./analyze
       with:
         category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -145,4 +143,3 @@ jobs:
       uses: ./analyze
       with:
         category: "/language:${{ matrix.language }}"
-        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}

.github/workflows/codescanning-config-cli.yml

@@ -23,11 +23,9 @@ on:
     - synchronize
     - reopened
     - ready_for_review
-  merge_group:
-    types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
+  workflow_dispatch: {}
 
 defaults:
   run:

.github/workflows/debug-artifacts-failure-safe.yml

@@ -14,11 +14,9 @@ on:
     - synchronize
     - reopened
     - ready_for_review
-  merge_group:
-    types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
+  workflow_dispatch: {}
 
 defaults:
   run:

.github/workflows/debug-artifacts-safe.yml

@@ -13,11 +13,9 @@ on:
     - synchronize
     - reopened
     - ready_for_review
-  merge_group:
-    types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
+  workflow_dispatch: {}
 
 defaults:
   run:

.github/workflows/label-pr-size.yml

@@ -17,7 +17,6 @@ jobs:
   sizeup:
     name: Label PR with size
     runs-on: ubuntu-slim
-    if: github.event.pull_request.merged != true
 
     steps:
       - name: Run sizeup

.github/workflows/pr-checks.yml

@@ -6,8 +6,6 @@ on:
     # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
     # by other workflows.
     types: [opened, synchronize, reopened, ready_for_review]
-  merge_group:
-    types: [checks_requested]
   workflow_dispatch:
 
 defaults:
@@ -82,7 +80,7 @@ jobs:
           category: eslint
 
   check-node-version:
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]'
     name: Check Action Node versions
     runs-on: ubuntu-latest
     timeout-minutes: 45

.github/workflows/python312-windows.yml

@@ -7,8 +7,6 @@ on:
     # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
     # by other workflows.
     types: [opened, synchronize, reopened, ready_for_review]
-  merge_group:
-    types: [checks_requested]
   schedule:
     # Weekly on Monday.
     - cron: '0 0 * * 1'

.github/workflows/query-filters.yml

@@ -11,11 +11,9 @@ on:
     - synchronize
     - reopened
     - ready_for_review
-  merge_group:
-    types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
+  workflow_dispatch: {}
 
 defaults:
   run:

.github/workflows/rebuild.yml

@@ -111,7 +111,7 @@ jobs:
             # Otherwise, just commit the changes.
             if git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
               echo "In progress merge detected, finishing it up."
-              git merge --continue --no-edit
+              git merge --continue
             else
               echo "No in-progress merge detected, committing changes."
               git commit -m "Rebuild"

.github/workflows/script/update-required-checks.sh

@@ -29,7 +29,7 @@ fi
 echo "Getting checks for $GITHUB_SHA"
 
 # Ignore any checks with "https://", CodeQL, LGTM, Update, and ESLint checks.
-CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") or . == "Agent" or . == "Cleanup artifacts" or . == "Prepare" or . == "Upload results" or . == "Label PR with size" | not)] | unique | sort')"
+CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") or . == "Agent" or . == "Cleanup artifacts" or . == "Prepare" or . == "Upload results" | not)] | unique | sort')"
 
 echo "$CHECKS" | jq
 

.github/workflows/test-codeql-bundle-all.yml

@@ -13,11 +13,9 @@ on:
     - synchronize
     - reopened
     - ready_for_review
-  merge_group:
-    types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
+  workflow_dispatch: {}
 defaults:
   run:
     shell: bash

CHANGELOG.md

@@ -2,36 +2,9 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## 4.32.5 - 02 Mar 2026
+## [UNRELEASED]
 
-- Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
-- Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
-- The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. [#3515](https://github.com/github/codeql-action/pull/3515)
-- Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. [#3516](https://github.com/github/codeql-action/pull/3516)
-- Added an experimental change which lowers the minimum disk space requirement for [improved incremental analysis](https://github.com/github/roadmap/issues/1158), enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. [#3498](https://github.com/github/codeql-action/pull/3498)
-- Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
-- The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)
-
-## 4.32.4 - 20 Feb 2026
-
-- Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
-- Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
-- When the CodeQL Action is run [with debugging enabled in Default Setup](https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup) and [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries), the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. [#3486](https://github.com/github/codeql-action/pull/3486)
-- Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
-- Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)
-
-## 4.32.3 - 13 Feb 2026
-
-- Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)
-
-## 4.32.2 - 05 Feb 2026
-
-- Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)
-
-## 4.32.1 - 02 Feb 2026
-
-- A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
-- Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)
+No user facing changes.
 
 ## 4.32.0 - 26 Jan 2026
 

README.md

@@ -72,22 +72,14 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
-| `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
-| `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
-| `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |
-| `v3.28.6` | `2.20.3` | Enterprise Server 3.15 | |
+| `v3.28.21`  | `2.21.3` | Enterprise Server 3.18 | |
+| `v3.28.12`  | `2.20.7` | Enterprise Server 3.17 | |
+| `v3.28.6`  | `2.20.3` | Enterprise Server 3.16 | |
+| `v3.28.6`  | `2.20.3` | Enterprise Server 3.15 | |
 | `v3.28.6` | `2.20.3` | Enterprise Server 3.14 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 
-## Keeping the CodeQL Action up to date in advanced setups
-
-If you are using an [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning), we recommend referencing the CodeQL Action using a major version tag (e.g. `v4`) in your workflow file. This ensures your workflow automatically picks up the latest release within that major version, including bug fixes, new features, and updated CodeQL CLI versions.
-
-If you pin to a specific commit SHA or patch version tag, ensure you keep it updated (e.g. via [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)). Some CodeQL Action features are enabled by server-side flags that may be removed over time, which can cause old versions to lose functionality.
-
 ## Troubleshooting
 
 Read about [troubleshooting code scanning](https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning).

eslint.config.mjs

@@ -1,14 +1,27 @@
-import { fixupPluginRules } from "@eslint/compat";
+// Automatically generated by running npx @eslint/migrate-config .eslintrc.json
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { fixupConfigRules, fixupPluginRules } from "@eslint/compat";
+import { FlatCompat } from "@eslint/eslintrc";
 import js from "@eslint/js";
+import typescriptEslint from "@typescript-eslint/eslint-plugin";
+import tsParser from "@typescript-eslint/parser";
+import filenames from "eslint-plugin-filenames";
 import github from "eslint-plugin-github";
-import { importX, createNodeResolver } from "eslint-plugin-import-x";
-import { createTypeScriptImportResolver } from "eslint-import-resolver-typescript";
+import _import from "eslint-plugin-import";
 import noAsyncForeach from "eslint-plugin-no-async-foreach";
 import jsdoc from "eslint-plugin-jsdoc";
-import tseslint from "typescript-eslint";
 import globals from "globals";
 
-const githubFlatConfigs = github.getFlatConfigs();
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const compat = new FlatCompat({
+  baseDirectory: __dirname,
+  recommendedConfig: js.configs.recommended,
+  allConfig: js.configs.all,
+});
 
 export default [
   {
@@ -23,29 +36,29 @@ export default [
       ".github/**/*",
     ],
   },
-  // eslint recommended config
-  js.configs.recommended,
-  // Type-checked rules from typescript-eslint
-  ...tseslint.configs.recommendedTypeChecked,
-  ...tseslint.configs.strict,
-  // eslint-plugin-github recommended config
-  githubFlatConfigs.recommended,
-  // eslint-plugin-github typescript config
-  ...githubFlatConfigs.typescript,
-  // import-x TypeScript settings
-  // This is needed for import-x rules to properly parse TypeScript files.
-  {
-    settings: importX.flatConfigs.typescript.settings,
-  },
+  ...fixupConfigRules(
+    compat.extends(
+      "eslint:recommended",
+      "plugin:@typescript-eslint/recommended",
+      "plugin:@typescript-eslint/recommended-requiring-type-checking",
+      "plugin:github/recommended",
+      "plugin:github/typescript",
+      "plugin:import/typescript",
+    ),
+  ),
   {
     plugins: {
-      "import-x": importX,
-      "no-async-foreach": fixupPluginRules(noAsyncForeach),
+      "@typescript-eslint": fixupPluginRules(typescriptEslint),
+      filenames: fixupPluginRules(filenames),
+      github: fixupPluginRules(github),
+      import: fixupPluginRules(_import),
+      "no-async-foreach": noAsyncForeach,
       "jsdoc": jsdoc,
     },
 
     languageOptions: {
-      ecmaVersion: "latest",
+      parser: tsParser,
+      ecmaVersion: 5,
       sourceType: "module",
 
       globals: {
@@ -65,17 +78,11 @@ export default [
 
         typescript: {},
       },
-      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size"],
-      "import-x/resolver-next": [
-        createTypeScriptImportResolver(),
-        createNodeResolver({
-          extensions: [".ts", ".js", ".json"],
-        }),
-      ],
+      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size", "@actions/github"],
     },
 
     rules: {
-      "github/filenames-match-regex": ["error", "^[a-z0-9-]+(\\.test)?$"],
+      "filenames/match-regex": ["error", "^[a-z0-9-]+(\\.test)?$"],
       "i18n-text/no-en": "off",
 
       "import/extensions": [
@@ -87,10 +94,7 @@ export default [
 
       "import/no-amd": "error",
       "import/no-commonjs": "error",
-      // import/no-cycle does not seem to work with ESLint 9.
-      // Use import-x/no-cycle from eslint-plugin-import-x instead.
-      "import/no-cycle": "off",
-      "import-x/no-cycle": "error",
+      "import/no-cycle": "error",
       "import/no-dynamic-require": "error",
 
       "import/no-extraneous-dependencies": [
@@ -128,8 +132,6 @@ export default [
       "no-async-foreach/no-async-foreach": "error",
       "no-sequences": "error",
       "no-shadow": "off",
-      // This is overly restrictive with unsetting `EnvVar`s
-      "@typescript-eslint/no-dynamic-delete": "off",
       "@typescript-eslint/no-shadow": "error",
       "@typescript-eslint/prefer-optional-chain": "error",
       "one-var": ["error", "never"],
@@ -150,9 +152,12 @@ export default [
 
     rules: {
       "@typescript-eslint/no-explicit-any": "off",
+      "@typescript-eslint/no-unsafe-argument": "off",
       "@typescript-eslint/no-unsafe-assignment": "off",
+      "@typescript-eslint/no-unsafe-call": "off",
       "@typescript-eslint/no-unsafe-enum-comparison": "off",
       "@typescript-eslint/no-unsafe-member-access": "off",
+      "@typescript-eslint/no-unsafe-return": "off",
       "@typescript-eslint/no-var-requires": "off",
       "@typescript-eslint/prefer-regexp-exec": "off",
       "@typescript-eslint/require-await": "off",

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.24.2",
-  "cliVersion": "2.24.2",
-  "priorBundleVersion": "codeql-bundle-v2.24.1",
-  "priorCliVersion": "2.24.1"
+  "bundleVersion": "codeql-bundle-v2.24.0",
+  "cliVersion": "2.24.0",
+  "priorBundleVersion": "codeql-bundle-v2.23.9",
+  "priorCliVersion": "2.23.9"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.32.5",
+  "version": "4.32.1",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -24,33 +24,34 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@actions/artifact": "^5.0.3",
+    "@actions/artifact": "^5.0.2",
     "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^5.0.5",
-    "@actions/core": "^2.0.3",
+    "@actions/cache": "^5.0.3",
+    "@actions/core": "^2.0.2",
     "@actions/exec": "^2.0.0",
-    "@actions/github": "^8.0.1",
+    "@actions/github": "^9.0.0",
     "@actions/glob": "^0.5.0",
     "@actions/http-client": "^3.0.0",
     "@actions/io": "^2.0.0",
-    "@actions/tool-cache": "^3.0.1",
+    "@actions/tool-cache": "^3.0.0",
     "@octokit/plugin-retry": "^8.0.0",
     "@schemastore/package": "0.0.10",
     "archiver": "^7.0.1",
     "fast-deep-equal": "^3.1.3",
     "follow-redirects": "^1.15.11",
     "get-folder-size": "^5.0.0",
-    "https-proxy-agent": "^7.0.6",
     "js-yaml": "^4.1.1",
     "jsonschema": "1.4.1",
     "long": "^5.3.2",
     "node-forge": "^1.3.3",
-    "semver": "^7.7.4",
+    "semver": "^7.7.3",
     "uuid": "^13.0.0"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^2.0.2",
+    "@eslint/compat": "^2.0.1",
+    "@eslint/eslintrc": "^3.3.3",
+    "@eslint/js": "^9.39.2",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
     "@octokit/types": "^16.0.0",
     "@types/archiver": "^7.0.0",
@@ -60,20 +61,21 @@
     "@types/node-forge": "^1.3.14",
     "@types/semver": "^7.7.1",
     "@types/sinon": "^21.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.53.1",
+    "@typescript-eslint/parser": "^8.48.0",
     "ava": "^6.4.1",
-    "esbuild": "^0.27.3",
-    "eslint": "^9.39.2",
+    "esbuild": "^0.27.2",
+    "eslint": "^8.57.1",
     "eslint-import-resolver-typescript": "^3.8.7",
-    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-import-x": "^4.16.1",
-    "eslint-plugin-jsdoc": "^62.6.0",
+    "eslint-plugin-filenames": "^1.3.2",
+    "eslint-plugin-github": "^5.1.8",
+    "eslint-plugin-import": "2.29.1",
+    "eslint-plugin-jsdoc": "^62.2.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^11.1.0",
-    "globals": "^17.3.0",
-    "nock": "^14.0.11",
+    "nock": "^14.0.10",
     "sinon": "^21.0.1",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.56.0"
+    "typescript": "^5.9.3"
   },
   "overrides": {
     "@actions/tool-cache": {

pr-checks/checks/bundle-from-nightly.yml

@@ -1,15 +0,0 @@
-name: "Bundle: From nightly"
-description: "The nightly CodeQL bundle should be used when forced"
-versions:
-  - linked # overruled by the FF set below
-steps:
-  - id: init
-    uses: ./../action/init
-    env:
-      CODEQL_ACTION_FORCE_NIGHTLY: true
-    with:
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-      languages: javascript
-  - name: Fail if the CodeQL version is not a nightly
-    if: "!contains(steps.init.outputs.codeql-version, '+')"
-    run: exit 1

pr-checks/checks/bundle-from-toolcache.yml

@@ -4,7 +4,7 @@ versions:
   - toolcache
 steps:
   - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache@3
+    run: npm install @actions/tool-cache
   - name: Check toolcache contains CodeQL
     continue-on-error: true
     uses: actions/github-script@v8

pr-checks/checks/bundle-toolcache.yml

@@ -16,7 +16,7 @@ steps:
         const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
         fs.rmdirSync(codeqlPath, { recursive: true });
   - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache@3
+    run: npm install @actions/tool-cache
   - name: Check toolcache does not contain CodeQL
     uses: actions/github-script@v8
     with:

pr-checks/checks/ccr.yml

@@ -0,0 +1,16 @@
+name: "CCR"
+description: "A standard analysis in CCR mode"
+env:
+  CODEQL_ACTION_ANALYSIS_KEY: "dynamic/copilot-pull-request-reviewer/codeql-action-test"
+steps:
+  - uses: ./../action/init
+    id: init
+    with:
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - uses: ./../action/analyze
+    id: analysis
+    with:
+      upload-database: false
+

pr-checks/checks/quality-queries.yml

@@ -1,9 +1,8 @@
-name: "Analysis kinds"
-description: "Tests basic functionality for different `analysis-kinds` inputs."
+name: "Quality queries input"
+description: "Tests that queries specified in the quality-queries input are used."
 versions: ["linked", "nightly-latest"]
-analysisKinds: ["code-scanning", "code-quality", "code-scanning,code-quality", "risk-assessment"]
+analysisKinds: ["code-scanning", "code-quality", "code-scanning,code-quality"]
 env:
-  CODEQL_ACTION_RISK_ASSESSMENT_ID: 1
   CHECK_SCRIPT: |
     const fs = require('fs');
 
@@ -38,24 +37,30 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
       post-processed-sarif-path: "${{ runner.temp }}/post-processed"
-
-  - name: Upload SARIF files
+  - name: Upload security SARIF
+    if: contains(matrix.analysis-kinds, 'code-scanning')
     uses: actions/upload-artifact@v6
     with:
       name: |
-        analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-      path: "${{ runner.temp }}/results/*.sarif"
+        quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
+      path: "${{ runner.temp }}/results/javascript.sarif"
+      retention-days: 7
+  - name: Upload quality SARIF
+    if: contains(matrix.analysis-kinds, 'code-quality')
+    uses: actions/upload-artifact@v6
+    with:
+      name: |
+        quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
+      path: "${{ runner.temp }}/results/javascript.quality.sarif"
       retention-days: 7
-
   - name: Upload post-processed SARIF
     uses: actions/upload-artifact@v6
     with:
       name: |
-        post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
+        post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
       path: "${{ runner.temp }}/post-processed"
       retention-days: 7
       if-no-files-found: error
-
   - name: Check quality query does not appear in security SARIF
     if: contains(matrix.analysis-kinds, 'code-scanning')
     uses: actions/github-script@v8

pr-checks/checks/rubocop-multi-language.yml

@@ -4,7 +4,7 @@ description: "Tests using RuboCop to analyze a multi-language repository and the
 versions: ["default"]
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+    uses: ruby/setup-ruby@90be1154f987f4dc0fe0dd0feedac9e473aa4ba8 # v1.286.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

pr-checks/sync.py

@@ -308,9 +308,6 @@ for file in sorted((this_dir / 'checks').glob('*.yml')):
                 'pull_request': {
                     'types': ["opened", "synchronize", "reopened", "ready_for_review"]
                 },
-                'merge_group': {
-                    'types': ['checks_requested']
-                },
                 'schedule': [{'cron': SingleQuotedScalarString('0 5 * * *')}],
                 'workflow_dispatch': {
                     'inputs': workflowInputs

src/actions-util.test.ts

@@ -5,6 +5,7 @@ import {
   fixCodeQualityCategory,
   getPullRequestBranches,
   isAnalyzingPullRequest,
+  isCCR,
   isDefaultSetup,
   isDynamicWorkflow,
 } from "./actions-util";
@@ -256,8 +257,16 @@ test("isDynamicWorkflow() returns true if event name is `dynamic`", (t) => {
   t.false(isDynamicWorkflow());
 });
 
+test("isCCR() returns true when expected", (t) => {
+  process.env.GITHUB_EVENT_NAME = "dynamic";
+  process.env[EnvVar.ANALYSIS_KEY] = "dynamic/copilot-pull-request-reviewer";
+  t.assert(isCCR());
+  t.false(isDefaultSetup());
+});
+
 test("isDefaultSetup() returns true when expected", (t) => {
   process.env.GITHUB_EVENT_NAME = "dynamic";
   process.env[EnvVar.ANALYSIS_KEY] = "dynamic/github-code-scanning";
   t.assert(isDefaultSetup());
+  t.false(isCCR());
 });

src/actions-util.ts

@@ -8,6 +8,7 @@ import * as io from "@actions/io";
 import { JSONSchemaForNPMPackageJsonFiles } from "@schemastore/package";
 
 import type { Config } from "./config-utils";
+import { EnvVar } from "./environment";
 import { Logger } from "./logging";
 import {
   doesDirectoryExist,
@@ -254,7 +255,15 @@ export function isDynamicWorkflow(): boolean {
 
 /** Determines whether we are running in default setup. */
 export function isDefaultSetup(): boolean {
-  return isDynamicWorkflow();
+  return isDynamicWorkflow() && !isCCR();
+}
+
+/* The analysis key prefix used for CCR. */
+const CCR_KEY_PREFIX = "dynamic/copilot-pull-request-reviewer";
+
+/** Determines whether we are running in CCR. */
+export function isCCR(): boolean {
+  return process.env[EnvVar.ANALYSIS_KEY]?.startsWith(CCR_KEY_PREFIX) || false;
 }
 
 export function prettyPrintInvocation(cmd: string, args: string[]): string {

src/analyses.test.ts

@@ -1,23 +1,15 @@
-import path from "path";
-
 import test from "ava";
 import * as sinon from "sinon";
 
 import * as actionsUtil from "./actions-util";
 import {
   AnalysisKind,
-  CodeScanning,
-  compatibilityMatrix,
-  RiskAssessment,
-  getAnalysisConfig,
   getAnalysisKinds,
   parseAnalysisKinds,
   supportedAnalysisKinds,
 } from "./analyses";
-import { EnvVar } from "./environment";
 import { getRunnerLogger } from "./logging";
 import { setupTests } from "./testing-utils";
-import { AssessmentPayload } from "./upload-lib/types";
 import { ConfigurationError } from "./util";
 
 setupTests(test);
@@ -75,107 +67,3 @@ test("getAnalysisKinds - throws if `analysis-kinds` input is invalid", async (t)
   requiredInputStub.withArgs("analysis-kinds").returns("no-such-thing");
   await t.throwsAsync(getAnalysisKinds(getRunnerLogger(true), true));
 });
-
-// Test the compatibility matrix by looping through all analysis kinds.
-const analysisKinds = Object.values(AnalysisKind);
-for (let i = 0; i < analysisKinds.length; i++) {
-  const analysisKind = analysisKinds[i];
-
-  for (let j = i + 1; j < analysisKinds.length; j++) {
-    const otherAnalysis = analysisKinds[j];
-
-    if (analysisKind === otherAnalysis) continue;
-    if (compatibilityMatrix[analysisKind].has(otherAnalysis)) {
-      test(`getAnalysisKinds - allows ${analysisKind} with ${otherAnalysis}`, async (t) => {
-        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-        requiredInputStub
-          .withArgs("analysis-kinds")
-          .returns([analysisKind, otherAnalysis].join(","));
-        const result = await getAnalysisKinds(getRunnerLogger(true), true);
-        t.is(result.length, 2);
-      });
-    } else {
-      test(`getAnalysisKinds - throws if ${analysisKind} is enabled with ${otherAnalysis}`, async (t) => {
-        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-        requiredInputStub
-          .withArgs("analysis-kinds")
-          .returns([analysisKind, otherAnalysis].join(","));
-        await t.throwsAsync(getAnalysisKinds(getRunnerLogger(true), true), {
-          instanceOf: ConfigurationError,
-          message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,
-        });
-      });
-    }
-  }
-}
-
-test("Code Scanning configuration does not accept other SARIF extensions", (t) => {
-  for (const analysisKind of supportedAnalysisKinds) {
-    if (analysisKind === AnalysisKind.CodeScanning) continue;
-
-    const analysis = getAnalysisConfig(analysisKind);
-    const sarifPath = path.join("path", "to", `file${analysis.sarifExtension}`);
-
-    // The Code Scanning configuration's `sarifPredicate` should not accept a path which
-    // ends in a different configuration's `sarifExtension`.
-    t.false(CodeScanning.sarifPredicate(sarifPath));
-  }
-});
-
-test("Risk Assessment configuration transforms SARIF upload payload", (t) => {
-  process.env[EnvVar.RISK_ASSESSMENT_ID] = "1";
-  const payload = RiskAssessment.transformPayload({
-    commit_oid: "abc",
-    sarif: "sarif",
-    ref: "ref",
-    workflow_run_attempt: 1,
-    workflow_run_id: 1,
-    checkout_uri: "uri",
-    tool_names: [],
-  }) as AssessmentPayload;
-
-  const expected: AssessmentPayload = { sarif: "sarif", assessment_id: 1 };
-  t.deepEqual(expected, payload);
-});
-
-test("Risk Assessment configuration throws for negative assessment IDs", (t) => {
-  process.env[EnvVar.RISK_ASSESSMENT_ID] = "-1";
-  t.throws(
-    () =>
-      RiskAssessment.transformPayload({
-        commit_oid: "abc",
-        sarif: "sarif",
-        ref: "ref",
-        workflow_run_attempt: 1,
-        workflow_run_id: 1,
-        checkout_uri: "uri",
-        tool_names: [],
-      }),
-    {
-      instanceOf: Error,
-      message: (msg) =>
-        msg.startsWith(`${EnvVar.RISK_ASSESSMENT_ID} must not be negative: `),
-    },
-  );
-});
-
-test("Risk Assessment configuration throws for invalid IDs", (t) => {
-  process.env[EnvVar.RISK_ASSESSMENT_ID] = "foo";
-  t.throws(
-    () =>
-      RiskAssessment.transformPayload({
-        commit_oid: "abc",
-        sarif: "sarif",
-        ref: "ref",
-        workflow_run_attempt: 1,
-        workflow_run_id: 1,
-        checkout_uri: "uri",
-        tool_names: [],
-      }),
-    {
-      instanceOf: Error,
-      message: (msg) =>
-        msg.startsWith(`${EnvVar.RISK_ASSESSMENT_ID} must not be NaN: `),
-    },
-  );
-});

src/analyses.ts

@@ -3,30 +3,14 @@ import {
   getOptionalInput,
   getRequiredInput,
 } from "./actions-util";
-import { EnvVar } from "./environment";
 import { Logger } from "./logging";
-import {
-  AssessmentPayload,
-  BasePayload,
-  UploadPayload,
-} from "./upload-lib/types";
-import { ConfigurationError, getRequiredEnvParam } from "./util";
+import { ConfigurationError } from "./util";
 
 export enum AnalysisKind {
   CodeScanning = "code-scanning",
   CodeQuality = "code-quality",
-  RiskAssessment = "risk-assessment",
 }
 
-export type CompatibilityMatrix = Record<AnalysisKind, Set<AnalysisKind>>;
-
-/** A mapping from analysis kinds to other analysis kinds which can be enabled concurrently. */
-export const compatibilityMatrix: CompatibilityMatrix = {
-  [AnalysisKind.CodeScanning]: new Set([AnalysisKind.CodeQuality]),
-  [AnalysisKind.CodeQuality]: new Set([AnalysisKind.CodeScanning]),
-  [AnalysisKind.RiskAssessment]: new Set(),
-};
-
 // Exported for testing. A set of all known analysis kinds.
 export const supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
 
@@ -83,7 +67,7 @@ export async function getAnalysisKinds(
     return cachedAnalysisKinds;
   }
 
-  const analysisKinds = await parseAnalysisKinds(
+  cachedAnalysisKinds = await parseAnalysisKinds(
     getRequiredInput("analysis-kinds"),
   );
 
@@ -101,27 +85,12 @@ export async function getAnalysisKinds(
   // if an input to `quality-queries` was specified. We should remove this once
   // `quality-queries` is no longer used.
   if (
-    !analysisKinds.includes(AnalysisKind.CodeQuality) &&
+    !cachedAnalysisKinds.includes(AnalysisKind.CodeQuality) &&
     qualityQueriesInput !== undefined
   ) {
-    analysisKinds.push(AnalysisKind.CodeQuality);
+    cachedAnalysisKinds.push(AnalysisKind.CodeQuality);
   }
 
-  // Check that all enabled analysis kinds are compatible with each other.
-  for (const analysisKind of analysisKinds) {
-    for (const otherAnalysisKind of analysisKinds) {
-      if (analysisKind === otherAnalysisKind) continue;
-
-      if (!compatibilityMatrix[analysisKind].has(otherAnalysisKind)) {
-        throw new ConfigurationError(
-          `${analysisKind} and ${otherAnalysisKind} cannot be enabled at the same time`,
-        );
-      }
-    }
-  }
-
-  // Cache the analysis kinds and return them.
-  cachedAnalysisKinds = analysisKinds;
   return cachedAnalysisKinds;
 }
 
@@ -132,7 +101,6 @@ export const codeQualityQueries: string[] = ["code-quality"];
 enum SARIF_UPLOAD_ENDPOINT {
   CODE_SCANNING = "PUT /repos/:owner/:repo/code-scanning/analysis",
   CODE_QUALITY = "PUT /repos/:owner/:repo/code-quality/analysis",
-  RISK_ASSESSMENT = "PUT /repos/:owner/:repo/code-scanning/risk-assessment",
 }
 
 // Represents configurations for different analysis kinds.
@@ -152,8 +120,6 @@ export interface AnalysisConfig {
   fixCategory: (logger: Logger, category?: string) => string | undefined;
   /** A prefix for environment variables used to track the uniqueness of SARIF uploads. */
   sentinelPrefix: string;
-  /** Transforms the upload payload in an analysis-specific way. */
-  transformPayload: (payload: UploadPayload) => BasePayload;
 }
 
 // Represents the Code Scanning analysis configuration.
@@ -164,11 +130,9 @@ export const CodeScanning: AnalysisConfig = {
   sarifExtension: ".sarif",
   sarifPredicate: (name) =>
     name.endsWith(CodeScanning.sarifExtension) &&
-    !CodeQuality.sarifPredicate(name) &&
-    !RiskAssessment.sarifPredicate(name),
+    !CodeQuality.sarifPredicate(name),
   fixCategory: (_, category) => category,
   sentinelPrefix: "CODEQL_UPLOAD_SARIF_",
-  transformPayload: (payload) => payload,
 };
 
 // Represents the Code Quality analysis configuration.
@@ -180,38 +144,6 @@ export const CodeQuality: AnalysisConfig = {
   sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
   fixCategory: fixCodeQualityCategory,
   sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_",
-  transformPayload: (payload) => payload,
-};
-
-/**
- * Retrieves the CSRA assessment id from an environment variable and adds it to the payload.
- * @param payload The base payload.
- */
-function addAssessmentId(payload: UploadPayload): AssessmentPayload {
-  const rawAssessmentId = getRequiredEnvParam(EnvVar.RISK_ASSESSMENT_ID);
-  const assessmentId = parseInt(rawAssessmentId, 10);
-  if (Number.isNaN(assessmentId)) {
-    throw new Error(
-      `${EnvVar.RISK_ASSESSMENT_ID} must not be NaN: ${rawAssessmentId}`,
-    );
-  }
-  if (assessmentId < 0) {
-    throw new Error(
-      `${EnvVar.RISK_ASSESSMENT_ID} must not be negative: ${rawAssessmentId}`,
-    );
-  }
-  return { sarif: payload.sarif, assessment_id: assessmentId };
-}
-
-export const RiskAssessment: AnalysisConfig = {
-  kind: AnalysisKind.RiskAssessment,
-  name: "code scanning risk assessment",
-  target: SARIF_UPLOAD_ENDPOINT.RISK_ASSESSMENT,
-  sarifExtension: ".csra.sarif",
-  sarifPredicate: (name) => name.endsWith(RiskAssessment.sarifExtension),
-  fixCategory: (_, category) => category,
-  sentinelPrefix: "CODEQL_UPLOAD_CSRA_SARIF_",
-  transformPayload: addAssessmentId,
 };
 
 /**
@@ -228,8 +160,6 @@ export function getAnalysisConfig(kind: AnalysisKind): AnalysisConfig {
       return CodeScanning;
     case AnalysisKind.CodeQuality:
       return CodeQuality;
-    case AnalysisKind.RiskAssessment:
-      return RiskAssessment;
   }
 }
 
@@ -237,8 +167,4 @@ export function getAnalysisConfig(kind: AnalysisKind): AnalysisConfig {
 // we want to scan a folder containing SARIF files in an order that finds the more
 // specific extensions first. This constant defines an array in the order of analyis
 // configurations with more specific extensions to less specific extensions.
-export const SarifScanOrder: AnalysisConfig[] = [
-  RiskAssessment,
-  CodeQuality,
-  CodeScanning,
-];
+export const SarifScanOrder = [CodeQuality, CodeScanning];

src/analyze-action.ts

@@ -30,10 +30,10 @@ import {
 } from "./dependency-caching";
 import { getDiffInformedAnalysisBranches } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
-import { initFeatures } from "./feature-flags";
+import { Features } from "./feature-flags";
 import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
-import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay";
+import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay-database-utils";
 import { getRepositoryNwo } from "./repository";
 import * as statusReport from "./status-report";
 import {
@@ -293,7 +293,7 @@ async function run(startedAt: Date) {
 
     util.checkActionVersion(actionsUtil.getActionVersion(), gitHubVersion);
 
-    const features = initFeatures(
+    const features = new Features(
       gitHubVersion,
       repositoryNwo,
       actionsUtil.getTemporaryDirectory(),

src/analyze.test.ts

@@ -4,7 +4,7 @@ import * as path from "path";
 import test from "ava";
 import * as sinon from "sinon";
 
-import { CodeQuality, CodeScanning, RiskAssessment } from "./analyses";
+import { CodeQuality, CodeScanning } from "./analyses";
 import {
   runQueries,
   defaultSuites,
@@ -155,6 +155,5 @@ test("addSarifExtension", (t) => {
       addSarifExtension(CodeQuality, language),
       `${language}.quality.sarif`,
     );
-    t.is(addSarifExtension(RiskAssessment, language), `${language}.csra.sarif`);
   }
 });