From 9d4eb28961f1f3ab4fe71daf35ea25bd89f7d3eb Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 13:59:30 +0000 Subject: [PATCH 1/6] Rename `linux-arm64` PR check to `runner-images` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../workflows/{__linux-arm64.yml => __runner-images.yml} | 8 ++++---- pr-checks/checks/{linux-arm64.yml => runner-images.yml} | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) rename .github/workflows/{__linux-arm64.yml => __runner-images.yml} (94%) rename pr-checks/checks/{linux-arm64.yml => runner-images.yml} (98%) diff --git a/.github/workflows/__linux-arm64.yml b/.github/workflows/__runner-images.yml similarity index 94% rename from .github/workflows/__linux-arm64.yml rename to .github/workflows/__runner-images.yml index 02dab69f9f..c14782be6e 100644 --- a/.github/workflows/__linux-arm64.yml +++ b/.github/workflows/__runner-images.yml @@ -3,7 +3,7 @@ # pr-checks/sync.sh # to regenerate this file. -name: PR Check - Linux Arm64 +name: PR Check - Runner images env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GO111MODULE: auto @@ -47,16 +47,16 @@ defaults: shell: bash concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}} + group: runner-images-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}} jobs: - linux-arm64: + runner-images: strategy: fail-fast: false matrix: include: - os: ubuntu-24.04-arm version: nightly-latest - name: Linux Arm64 + name: Runner images if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read diff --git a/pr-checks/checks/linux-arm64.yml b/pr-checks/checks/runner-images.yml similarity index 98% rename from pr-checks/checks/linux-arm64.yml rename to pr-checks/checks/runner-images.yml index 29d3eea41e..e8b22e74ae 100644 --- a/pr-checks/checks/linux-arm64.yml +++ b/pr-checks/checks/runner-images.yml @@ -1,4 +1,4 @@ -name: "Linux Arm64" +name: "Runner images" description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code" operatingSystems: - os: ubuntu From 02e8a5ded2a965894b7463d7d8ee86272fd4c14f Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 14:01:20 +0000 Subject: [PATCH 2/6] Run `runner-images` check on the GitHub-hosted runner images with `linked` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/__runner-images.yml | 26 ++++++++++++++-- pr-checks/checks/runner-images.yml | 45 ++++++++++++++++++++++----- 2 files changed, 62 insertions(+), 9 deletions(-) diff --git a/.github/workflows/__runner-images.yml b/.github/workflows/__runner-images.yml index c14782be6e..8c7ce02f7c 100644 --- a/.github/workflows/__runner-images.yml +++ b/.github/workflows/__runner-images.yml @@ -54,8 +54,30 @@ jobs: fail-fast: false matrix: include: + - os: ubuntu-22.04 + version: linked + - os: ubuntu-22.04-arm + version: linked + - os: ubuntu-24.04 + version: linked - os: ubuntu-24.04-arm - version: nightly-latest + version: linked + - os: ubuntu-26.04 + version: linked + - os: ubuntu-26.04-arm + version: linked + - os: windows-2022 + version: linked + - os: windows-2025 + version: linked + - os: macos-15-large + version: linked + - os: macos-15-xlarge + version: linked + - os: macos-26-large + version: linked + - os: macos-26-xlarge + version: linked name: Runner images if: github.triggering_actor != 'dependabot[bot]' permissions: @@ -102,5 +124,5 @@ jobs: echo "Found database for $lang" done env: - LANGUAGES: cpp,csharp,go,java,javascript,python,ruby + LANGUAGES: cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }} CODEQL_ACTION_TEST_MODE: true diff --git a/pr-checks/checks/runner-images.yml b/pr-checks/checks/runner-images.yml index e8b22e74ae..70354e9ada 100644 --- a/pr-checks/checks/runner-images.yml +++ b/pr-checks/checks/runner-images.yml @@ -1,18 +1,49 @@ name: "Runner images" -description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code" +description: "An end-to-end integration test checking that CodeQL can analyze interpreted and compiled code on the GitHub-hosted runner images" +# This check runs on each image listed in +# https://github.com/actions/runner-images#available-images, except for: +# - `ubuntu-slim`, which is intended for lightweight jobs rather than builds like this one. +# - `windows-11-arm`, since CodeQL doesn't support Windows on Arm64. +# - `xcode-27`, a preview image that the `unsupported-macos` check runs on. operatingSystems: + # The Ubuntu 22.04 images have brownouts from 23 March 2027 and are retired on 17 April 2027, so + # remove them before the brownouts start. + # See https://github.com/actions/runner-images/issues/14254. + - os: ubuntu + runner-image: ubuntu-22.04 + - os: ubuntu + runner-image: ubuntu-22.04-arm + - os: ubuntu + runner-image: ubuntu-24.04 - os: ubuntu runner-image: ubuntu-24.04-arm -# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this -# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an -# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner. + - os: ubuntu + runner-image: ubuntu-26.04 + - os: ubuntu + runner-image: ubuntu-26.04-arm + - os: windows + runner-image: windows-2022 + - os: windows + runner-image: windows-2025 + # Use larger runners for macOS to keep these jobs off the critical path. + - os: macos + runner-image: macos-15-large + - os: macos + runner-image: macos-15-xlarge + - os: macos + runner-image: macos-26-large + - os: macos + runner-image: macos-26-xlarge +# Other PR checks cover the supported CodeQL versions, so this check only tests the linked version. +# Linux Arm64 bundles are only available for CodeQL 2.27.0 and later, so older stable versions +# can't run on the Arm64 images. versions: - - nightly-latest + - linked installGo: true installDotNet: true -# The set of languages CodeQL supports on this platform, excluding Swift (macOS only). +# The languages to build and analyze. CodeQL only supports Swift on macOS. env: - LANGUAGES: cpp,csharp,go,java,javascript,python,ruby + LANGUAGES: "cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}" steps: - uses: ./../action/init with: From 3a7f564e339a3d339dd12be916292b352bc42b3e Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 14:14:41 +0000 Subject: [PATCH 3/6] Rerun failed `runner-images` jobs in the Deflake workflow Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/deflake.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml index 27024b3780..b4089fc35e 100644 --- a/.github/workflows/deflake.yml +++ b/.github/workflows/deflake.yml @@ -61,6 +61,7 @@ on: - "PR Check - Remote config file" - "PR Check - Resolve environment" - "PR Check - Ruby analysis" + - "PR Check - Runner images" - "PR Check - Rust analysis" - "PR Check - Split workflow" - "PR Check - Start proxy" From b5a363211902ad0b34a96d743184d76dc3d2f113 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 14:02:22 +0000 Subject: [PATCH 4/6] Run `analyze-javascript` only on `ubuntu-26.04` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cc7d3de991..bac0ba9c9a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -74,14 +74,8 @@ jobs: strategy: fail-fast: false matrix: - os: - - ubuntu-22.04 - - ubuntu-24.04 - - windows-2022 - - windows-2025 - - macos-15-xlarge tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }} - runs-on: ${{ matrix.os }} + runs-on: ubuntu-26.04 permissions: contents: read @@ -107,7 +101,7 @@ jobs: uses: ./analyze with: category: "/language:javascript" - upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} + upload: ${{ (!matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} analyze-other: if: github.triggering_actor != 'dependabot[bot]' From 97d0cc029d68005e4403a9cf72f69d1d226797dd Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 14:56:24 +0000 Subject: [PATCH 5/6] Only run `analyze-javascript` with the default CodeQL bundle Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql.yml | 57 +----------------------------------- 1 file changed, 1 insertion(+), 56 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bac0ba9c9a..73045aedb4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,62 +19,8 @@ env: CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks jobs: - # Identify the CodeQL tool versions to use in the analysis job. - check-codeql-versions: - if: github.triggering_actor != 'dependabot[bot]' - runs-on: ubuntu-26.04 - outputs: - versions: ${{ steps.compare.outputs.versions }} - - permissions: - contents: read - # We currently need `security-events: read` to access feature flags. - security-events: read - - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set up default CodeQL bundle - id: setup-default - uses: ./setup-codeql - - name: Set up linked CodeQL bundle - id: setup-linked - uses: ./setup-codeql - with: - tools: linked - - name: Compare default and linked CodeQL bundle versions - id: compare - env: - CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }} - CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }} - run: | - CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)" - CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)" - echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT" - echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED" - - # If we're running on a pull request, run with both bundles, even if `tools: linked` would - # be the same as `tools: null`. This allows us to make the job for each of the bundles a - # required status check. - # - # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be - # the same as running with `tools: null`. - if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then - VERSIONS_JSON='[null]' - else - VERSIONS_JSON='[null, "linked"]' - fi - - # Output a JSON-encoded list with the distinct versions to test against. - echo "Suggested matrix config for analysis job: $VERSIONS_JSON" - echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT - analyze-javascript: if: github.triggering_actor != 'dependabot[bot]' - needs: [check-codeql-versions] - strategy: - fail-fast: false - matrix: - tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }} runs-on: ubuntu-26.04 permissions: @@ -90,7 +36,6 @@ jobs: with: languages: javascript config-file: ./.github/codeql/codeql-config-javascript.yml - tools: ${{ matrix.tools }} # confirm steps.init.outputs.codeql-path points to the codeql binary - name: Print CodeQL Version run: > @@ -101,7 +46,7 @@ jobs: uses: ./analyze with: category: "/language:javascript" - upload: ${{ (!matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} + upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }} analyze-other: if: github.triggering_actor != 'dependabot[bot]' From a6827a39dec02dbb97adcc9fabd86aab02b0823a Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 9 Nov 2026 18:24:06 +0000 Subject: [PATCH 6/6] Merge `analyze-javascript` and `analyze-other` into one matrixed job Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/codeql/codeql-config-actions.yml | 5 +++ .github/workflows/codeql.yml | 48 ++++++------------------ 2 files changed, 16 insertions(+), 37 deletions(-) create mode 100644 .github/codeql/codeql-config-actions.yml diff --git a/.github/codeql/codeql-config-actions.yml b/.github/codeql/codeql-config-actions.yml new file mode 100644 index 0000000000..dda7a42c16 --- /dev/null +++ b/.github/codeql/codeql-config-actions.yml @@ -0,0 +1,5 @@ +paths-ignore: + - lib + - tests +queries: + - uses: security-and-quality diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 73045aedb4..86741ec455 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,10 +19,17 @@ env: CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks jobs: - analyze-javascript: + analyze: if: github.triggering_actor != 'dependabot[bot]' runs-on: ubuntu-26.04 + strategy: + fail-fast: false + matrix: + language: + - actions + - javascript + permissions: contents: read security-events: write @@ -34,48 +41,15 @@ jobs: uses: ./init id: init with: - languages: javascript - config-file: ./.github/codeql/codeql-config-javascript.yml + languages: ${{ matrix.language }} + build-mode: none + config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml # confirm steps.init.outputs.codeql-path points to the codeql binary - name: Print CodeQL Version run: > "$CODEQL" version --format=json env: CODEQL: ${{steps.init.outputs.codeql-path}} - - name: Perform CodeQL Analysis - uses: ./analyze - with: - category: "/language:javascript" - upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }} - - analyze-other: - if: github.triggering_actor != 'dependabot[bot]' - runs-on: ubuntu-26.04 - - strategy: - fail-fast: false - matrix: - include: - - language: actions - - permissions: - contents: read - security-events: write - - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Initialize CodeQL - uses: ./init - with: - languages: ${{ matrix.language }} - build-mode: none - config: > - paths-ignore: - - lib - - tests - queries: - - uses: security-and-quality - name: Perform CodeQL Analysis uses: ./analyze with: