Sandbox::https://redirect.github.com/github/codeql-action/pull/4324

beer-sakthai · 2026-11-13T03:46:35Z

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
High risk: Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.
Third-party analyses - The changes affect the upload-sarif action.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.
Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).
Other - Please provide details.
None - I am not validating these changes.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.
Development/testing only - This change cannot cause any failures in production.
Other - Please provide details.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.
Other - Please provide details.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.
Special considerations - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

…in-n5m9pm Sync main with upstream github/codeql-action

The `*-xlarge` macOS runners are GitHub larger runners that are not available to this fork, so every job targeting them failed without starting. Switch to the standard hosted equivalents (macos-latest, macos-15, macos-14) in the PR-check sources and codeql.yml, and regenerate the PR-check workflows with pr-checks/sync.sh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6REV1f9XMQdyBtTufzb8e

This fork has CodeQL default setup enabled, which rejects SARIF from advanced configurations, so the `analyze-javascript (ubuntu-24.04)` and `analyze-other` jobs failed at upload. Default setup already scans this repository, so keep running the analyses but only upload when running in github/codeql-action. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6REV1f9XMQdyBtTufzb8e

…in-n5m9pm Fix fork CI: standard macOS runners and skip self-analysis uploads

Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

…nd_yarn-cb24140fdc Bump brace-expansion from 1.1.18 to 1.1.21 in the npm_and_yarn group across 1 directory

Expanded the security policy to include detailed reporting methods, security scope, response processes, and guidelines for responsible disclosure.

Removed unsupported OS versions from the matrix. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Bumps the npm-minor group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) | `0.5.1` | `0.7.0` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.1` | `1.16.2` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.4.1` | `1.4.3` | | [semver](https://github.com/npm/node-semver) | `7.8.5` | `7.8.6` | | [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon) | `22.0.1` | `22.0.2` | | [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `65.4.0` | `65.4.3` | | [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.72.0` | `8.72.1` | Updates `@actions/glob` from 0.5.1 to 0.7.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) Updates `follow-redirects` from 1.16.1 to 1.16.2 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.16.1...v1.16.2) Updates `node-forge` from 1.4.1 to 1.4.3 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.4.1...v1.4.3) Updates `semver` from 7.8.5 to 7.8.6 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.8.5...v7.8.6) Updates `@types/sinon` from 22.0.1 to 22.0.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon) Updates `eslint-plugin-jsdoc` from 65.4.0 to 65.4.3 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](gajus/eslint-plugin-jsdoc@v65.4.0...v65.4.3) Updates `globals` from 17.13.0 to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) Updates `typescript-eslint` from 8.72.0 to 8.72.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: follow-redirects dependency-version: 1.16.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: node-forge dependency-version: 1.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: semver dependency-version: 7.8.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@types/sinon" dependency-version: 22.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 65.4.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.72.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ava](https://github.com/avajs/ava) from 6.4.1 to 8.3.0. - [Release notes](https://github.com/avajs/ava/releases) - [Commits](avajs/ava@v6.4.1...v8.3.0) --- updated-dependencies: - dependency-name: ava dependency-version: 8.3.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@actions/http-client](https://github.com/actions/toolkit/tree/HEAD/packages/http-client) from 3.0.2 to 4.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/http-client/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/http-client) --- updated-dependencies: - dependency-name: "@actions/http-client" dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.19.43 to 26.6.6. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@actions/exec](https://github.com/actions/toolkit/tree/HEAD/packages/exec) from 2.0.0 to 3.0.0. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/exec/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/exec) --- updated-dependencies: - dependency-name: "@actions/exec" dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 2.0.3 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…inor-77e50b00c1 Bump the npm-minor group across 1 directory with 8 updates

….3.0 Bump ava from 6.4.1 to 8.3.0

…4.0.1

…ons/http-client-4.0.1 Bump @actions/http-client from 3.0.2 to 4.0.1

Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 2.0.3 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.19.2 to 26.6.6. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…hecks/actions/core-3.0.1 Bump @actions/core from 2.0.3 to 3.0.1 in /pr-checks

…hecks/types/node-26.6.6 Bump @types/node from 24.19.2 to 26.6.6 in /pr-checks

…s/node-26.6.6 Bump @types/node from 20.19.43 to 26.6.6

…ons/exec-3.0.0 Bump @actions/exec from 2.0.0 to 3.0.0

Copilot

🟡 Changes recommended

Critical workflow and dependency-file defects remain, including malformed CodeQL steps, an invalid and inconsistent lockfile, and duplicate manifest keys that prevent the intended dependency upgrades and CI coverage from taking effect.

8 open issues

What changed in this PR

This PR updates project and PR-check dependencies, expands macOS CI coverage, adds a repository security policy, and modifies the CodeQL self-analysis workflow.

Changes:

Upgrades runtime, development, and PR-check dependencies.
Adds or adjusts macOS coverage across Swift and multi-language validation workflows.
Adds SECURITY.md and updates CodeQL analysis workflow steps.
Regenerates related workflow matrix files.

File	Description
SECURITY.md	Adds repository security policy and vulnerability-reporting guidance.
pr-checks/package.json	Updates dependencies used by PR-check scripts.
pr-checks/checks/swift-custom-build.yml	Adds macOS runner coverage for Swift custom-build checks.
pr-checks/checks/swift-autobuild.yml	Adds macOS runner coverage for Swift autobuild checks.
pr-checks/checks/per-language-bundle-validation.yml	Adds Swift bundle validation matrix coverage.
pr-checks/checks/multi-language-autodetect.yml	Adjusts macOS runner and legacy Swift testing configuration.
pr-checks/checks/all-platform-bundle.yml	Adds an additional macOS runner configuration for bundle testing.
package.json	Updates root runtime and development dependencies.
package-lock.json	Updates the dependency lockfile.
.github/workflows/codeql.yml	Adds and modifies CodeQL analysis workflow steps.
.github/workflows/__swift-custom-build.yml	Updates the generated Swift custom-build workflow matrix.
.github/workflows/__swift-autobuild.yml	Updates the generated Swift autobuild workflow matrix.
.github/workflows/__per-language-bundle-validation.yml	Updates the generated per-language validation matrix.
.github/workflows/__multi-language-autodetect.yml	Updates the generated multi-language workflow matrix.
.github/workflows/__all-platform-bundle.yml	Updates the generated all-platform bundle workflow matrix.

_{Review effort: Lite (dynamic)}

+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Initialize CodeQL
+      uses: ./init
+      id: init


+    "@actions/core": "^3.0.1",
    "@actions/exec": "^2.0.0",
+    "@actions/core": "^2.0.3",
+    "@actions/exec": "^3.0.0",
    "@actions/github": "^8.0.1",
    "@actions/glob": "^0.5.0",
+    "@actions/http-client": "^4.0.1",
+    "@actions/glob": "^0.7.0",
    "@actions/http-client": "^3.0.0",
    "@actions/io": "^2.0.0",


  - os: macos
+    runner-image: macos-latest
    runner-image: macos-26-xlarge


  - os: macos
+    runner-image: macos-latest
    runner-image: macos-26-xlarge


+      os: macos-latest
+      version: nightly-latest
      os: macos-26-xlarge
      version: linked
      build-mode: autobuild


  - os: macos
+    runner-image: macos-latest
    runner-image: macos-26-xlarge


  - os: macos
+    runner-image: macos-latest
    runner-image: macos-26-xlarge


+- **Repository owner:** `beer-sakthai`
+- **Security email:** `[ADD YOUR SECURITY EMAIL HERE]`


…ow templates

beer-sakthai and others added 29 commits September 23, 2026 18:04

Merge pull request #5 from beer-sakthai/claude/branch-commit-merge-ma…

9eeb533

…in-n5m9pm Sync main with upstream github/codeql-action

Merge pull request #6 from beer-sakthai/claude/branch-commit-merge-ma…

84f4a46

…in-n5m9pm Fix fork CI: standard macOS runners and skip self-analysis uploads

Merge pull request #7 from beer-sakthai/dependabot/npm_and_yarn/npm_a…

224dc51

…nd_yarn-cb24140fdc Bump brace-expansion from 1.1.18 to 1.1.21 in the npm_and_yarn group across 1 directory

Merge branch 'main' into main

299edd7

Enhance security policy with detailed guidelines

4afab37

Expanded the security policy to include detailed reporting methods, security scope, response processes, and guidelines for responsible disclosure.

Update OS matrix in CodeQL workflow

0d3f9cf

Removed unsupported OS versions from the matrix. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge pull request #8 from beer-sakthai/dependabot/npm_and_yarn/npm-m…

0535b0e

…inor-77e50b00c1 Bump the npm-minor group across 1 directory with 8 updates

Merge branch 'main' into dependabot/npm_and_yarn/ava-8.3.0

1af68df

Merge pull request #9 from beer-sakthai/dependabot/npm_and_yarn/ava-8…

bad77bc

….3.0 Bump ava from 6.4.1 to 8.3.0

Merge branch 'main' into dependabot/npm_and_yarn/actions/http-client-…

752bc5f

…4.0.1

Merge pull request #10 from beer-sakthai/dependabot/npm_and_yarn/acti…

524612e

…ons/http-client-4.0.1 Bump @actions/http-client from 3.0.2 to 4.0.1

Merge branch 'main' into dependabot/npm_and_yarn/actions/exec-3.0.0

7697b42

Merge branch 'main' into dependabot/npm_and_yarn/actions/core-3.0.1

cdac7cd

Merge pull request #14 from beer-sakthai/dependabot/npm_and_yarn/pr-c…

942230a

…hecks/actions/core-3.0.1 Bump @actions/core from 2.0.3 to 3.0.1 in /pr-checks

Merge pull request #15 from beer-sakthai/dependabot/npm_and_yarn/pr-c…

bbb50b1

…hecks/types/node-26.6.6 Bump @types/node from 24.19.2 to 26.6.6 in /pr-checks

Merge pull request #11 from beer-sakthai/dependabot/npm_and_yarn/type…

8ea38ce

…s/node-26.6.6 Bump @types/node from 20.19.43 to 26.6.6

Merge pull request #12 from beer-sakthai/dependabot/npm_and_yarn/acti…

7204069

…ons/exec-3.0.0 Bump @actions/exec from 2.0.0 to 3.0.0

Merge branch 'main' into dependabot/npm_and_yarn/actions/core-3.0.1

f256d36

beer-sakthai requested a review from a team as a code owner November 13, 2026 03:46

Copilot AI dynamic review requested due to automatic review settings November 13, 2026 03:46

Copilot started reviewing on behalf of beer-sakthai November 13, 2026 03:47

View session

Copilot AI reviewed Nov 13, 2026

View reviewed changes

beer-sakthai added 4 commits November 13, 2026 03:55

Fix duplicate keys in package.json and clean package-lock.json

016ad2f

Fix syntax error and duplicate steps in codeql.yml

39eedc8

Fix duplicate runner-image and matrix entries in pr-checks and workfl…

bd81588

…ow templates

Merge main and fix dependencies in package.json and package-lock.json

88fe7d0

dependabot Bot deleted the dependabot/npm_and_yarn/actions/core-3.0.1 branch November 13, 2026 04:55

Navigation Menu

Repository navigation

Dependabot/npm and yarn/actions/core 3.0.1 - #4324

Dependabot/npm and yarn/actions/core 3.0.1#4324
beer-sakthai wants to merge 33 commits into
github:mainfrom
beer-sakthai:dependabot/npm_and_yarn/actions/core-3.0.1

beer-sakthai commented Nov 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		- Repository owner: `beer-sakthai`
		- Security email: `[ADD YOUR SECURITY EMAIL HERE]`

Conversation

beer-sakthai commented Nov 13, 2026

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants