mirror of
https://github.com/github/codeql-action.git
synced 2025-12-28 02:00:12 +08:00
1500a13138
* Bump the npm group with 4 updates Bumps the npm group with 4 updates: [@octokit/types](https://github.com/octokit/types.ts), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin), [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) and [typescript](https://github.com/Microsoft/TypeScript). Updates `@octokit/types` from 12.3.0 to 12.4.0 - [Release notes](https://github.com/octokit/types.ts/releases) - [Commits](https://github.com/octokit/types.ts/compare/v12.3.0...v12.4.0) Updates `@typescript-eslint/eslint-plugin` from 6.13.2 to 6.14.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v6.14.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 6.13.2 to 6.14.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v6.14.0/packages/parser) Updates `typescript` from 5.3.2 to 5.3.3 - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](https://github.com/Microsoft/TypeScript/compare/v5.3.2...v5.3.3) --- updated-dependencies: - dependency-name: "@octokit/types" dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com> * Update checked-in dependencies * Update changelog and version after v3.22.11 * Update checked-in dependencies * improve handling of changelog processing for backports * change version numbers inside processing function as well * Apply suggestions from code review Co-authored-by: Henry Mercer <henry.mercer@me.com> * rename regex for clarity * preserve trailing whitespace when transforming CHANGELOG * raise explicit exception if EOF found when looking for changelog sections * add note on versioning approach to changelog * Bump the npm group with 2 updates (#2045) * Bump the npm group with 2 updates Bumps the npm group with 2 updates: [eslint](https://github.com/eslint/eslint) and [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import). Updates `eslint` from 8.55.0 to 8.56.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/compare/v8.55.0...v8.56.0) Updates `eslint-plugin-import` from 2.29.0 to 2.29.1 - [Release notes](https://github.com/import-js/eslint-plugin-import/releases) - [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md) - [Commits](https://github.com/import-js/eslint-plugin-import/compare/v2.29.0...v2.29.1) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: eslint-plugin-import dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com> * Update checked-in dependencies --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * clarify comment on versions in the changelog * clarify comment on versions in the changelog * Update default bundle to codeql-bundle-v2.15.5 * Add changelog note * update required checks script to handle release branches * add note about backporting check changes to v2 branch * Fix type error * Typecast `OLDEST_SUPPORTED_MAJOR_VERSION` when defined * Update changelog for v3.22.12 * Revert "Update version and changelog for v2.22.11" This reverts commite763762131. * Revert "Update checked-in dependencies" This reverts commit20d1a9b175. * Update version and changelog for v2.22.12 * Update checked-in dependencies * Resolve conflicts in v3->v2.22.12 merge --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Henry Mercer <henry.mercer@me.com> Co-authored-by: Nick Fyson <nickfyson@github.com> Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com> Co-authored-by: Angela P Wen <angelapwen@github.com> Co-authored-by: Aditya Sharad <adityasharad@github.com>
CodeQL Action
This action runs GitHub's industry-leading semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of queries, which have been developed by the community and the GitHub Security Lab to find common vulnerabilities in your code.
For a list of recent changes, see the CodeQL Action's changelog.
📢 Node 16 deprecation, upcoming CodeQL Action v3 📢
Announcement for users of this Action and code scanning workflows on GitHub.com:
- You will begin to see these warnings about Node.js 16 deprecation in your Actions logs on code scanning runs starting October 23, 2023.
- All code scanning workflows should continue to succeed regardless of the warning.
- The team at GitHub maintaining the CodeQL Action is aware of the deprecation timeline and actively working on creating another version of the CodeQL Action, v3, that will bump us to Node 20.
For more information, and to communicate with the maintaining team, please use this issue.
License
This project is released under the MIT License.
The underlying CodeQL CLI, used in this action, is licensed under the GitHub CodeQL Terms and Conditions. As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.
Usage
We recommend using default setup to configure CodeQL analysis for your repository. For more information, see "Configuring default setup for code scanning."
You can also configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration. For more information, see "Configuring advanced setup for code scanning" and "Customizing your advanced setup for code scanning."
Troubleshooting
Read about troubleshooting code scanning.
Contributing
This project welcomes contributions. See CONTRIBUTING.md for details on how to build, install, and contribute.