### Description
This PR updates `.github/labeler.yml` to include path mappings for several teams and functional areas that were previously missing or listed as empty comments. It ensures that incoming Pull Requests are automatically categorized and routed to the correct reviewers.
### Motivation
Currently, many PRs in the Bazel repository (such as those involving Starlark, Windows-specific code, or Bzlmod) require manual labeling by maintainers. By filling in these gaps, we reduce manual triage overhead and speed up the review cycle by automatically identifying the relevant **team-** and **area-** labels based on the files changed.
**Teams added/updated:**
- `team-Rules-Server`
- `team-Starlark-Interpreter`
- `team-Starlark-Integration`
- `team-Rules-API`
- `team-Loading-API`
- `team-Core`
- `team-Bazel`
**Areas added/updated:**
- `area-Bzlmod`
- `area-EngProd`
- `area-Windows`
### Build API Changes
No
### Checklist
- [ ] I have added tests for the new use cases (if any).
- [ ] I have updated the documentation (if applicable).
### Release Notes
RELNOTES: None
Closes#29046.
PiperOrigin-RevId: 890314715
Change-Id: Ia38e20e894e8e5f9775251775ac2e5deffab12d5
This is a []
This is a PR to help you upgrade to the latest standards in Github Actions.
Please merge this PR to accept the changes. NOTE: if you do not accept this PR, it may be force merged by the GHSS team. See http://b/485167538 for more details.
Closes#28706.
PiperOrigin-RevId: 872270312
Change-Id: I3649c9237fab2cb786e7a99c8b7ea2c4c6c4c551
This will allow this action can be triggered on PRs from third party forks. There is no security risk since we do not run any code from the PR.
PiperOrigin-RevId: 871707339
Change-Id: I3b1a55c07b96c660933561cfdb96521af1079ed8
This PR implements a GitHub Action to automatically label PRs approved by trusted community contributors.
Closes#28613.
PiperOrigin-RevId: 871221627
Change-Id: I60e4ce7b5cfe58cf29d808cf86c5d483627313a9
### Description
Add a PR template for Bazel
### Motivation
This template encourages contributors to provide clear descriptions, explain the motivation behind their changes, and verify basic checks (testing, documentation). It also includes a specific section for Build API Changes to help us better manage and review Build API updates or breaking changes.
### Build API Changes
No
### Checklist
- [x] I have added tests for the new use cases (if any).
- [x] I have updated the documentation (if applicable).
### Release Notes
RELNOTES: None
Closes#28610.
PiperOrigin-RevId: 870901456
Change-Id: I5b46caa8398358f8625637cabb85fc08f62ba338
Replaces satyanandak with deepalak56 in the list of default assignees for new bug reports.
PiperOrigin-RevId: 862128285
Change-Id: I97c71f77c8db93a8712b81691ffb4edea70a43a5
This PR introduces a new SSL certificate monitoring workflow for Bazel domains.
**Core Changes:**
- **Automated SSL Check**: Adds a daily workflow and Python script to monitor SSL certificate expirations.
- **Intelligent Issue Reporting**: Creates a GitHub issue when certificates are expiring, or adds a comment to an existing open issue to avoid duplicates.
- **PR Validation**: Automatically validates changes to the monitoring script or domain configuration in Pull Requests.
- **Configuration**: Includes a customizable list of domains and warning thresholds in `.github/config/ssl_domains.yaml`.
Closes#28176.
PiperOrigin-RevId: 854199226
Change-Id: I4aec5af9a06875ab6fe6ed2350cd7d40f2c1cad3
Bumps the github-actions group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.13.2` | `2.14.0` |
| [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) | `e3c3c35f22c5df604bf4aedef03ad39a36b2285a` | `9332050935221e54b97feecd6e890ed8b6272999` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.0` | `6.0.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `6.0.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.31.5` | `4.31.9` |
| [actions/stale](https://github.com/actions/stale) | `10.1.0` | `10.1.1` |
Updates `step-security/harden-runner` from 2.13.2 to 2.14.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.14.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.</li>
<li>Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.13.3...v2.14.0">https://github.com/step-security/harden-runner/compare/v2.13.3...v2.14.0</a></p>
<h2>v2.13.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Fixed an issue where process events were not uploaded in certain edge cases.</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.13.2...v2.13.3">https://github.com/step-security/harden-runner/compare/v2.13.2...v2.13.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="20cf305ff2"><code>20cf305</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/622">#622</a> from step-security/feature/custom-property-skip</li>
<li><a href="c51e8eeb6c"><code>c51e8ee</code></a> feat: skip agent install and post step on subsequent runs for GitHub-hosted r...</li>
<li><a href="e152b90204"><code>e152b90</code></a> feat: skip harden-runner based on repository custom property</li>
<li><a href="ee1faec052"><code>ee1faec</code></a> feat: replace skip-harden-runner with skip-on-custom-property input</li>
<li><a href="1dc7c17646"><code>1dc7c17</code></a> feat: add skip-harden-runner input to conditionally skip execution</li>
<li><a href="df199fb7be"><code>df199fb</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/620">#620</a> from step-security/rc-29</li>
<li><a href="03d096a772"><code>03d096a</code></a> update agent</li>
<li><a href="40901073af"><code>4090107</code></a> fix: update agent</li>
<li>See full diff in <a href="95d9a5deda...20cf305ff2">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from e3c3c35f22c5df604bf4aedef03ad39a36b2285a to 9332050935221e54b97feecd6e890ed8b6272999
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="9332050935"><code>9332050</code></a> Implement matrix exclude (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2421">#2421</a>)</li>
<li><a href="45d2158b3a"><code>45d2158</code></a> Fix regex escaping in excluded platforms query (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2420">#2420</a>)</li>
<li><a href="c5142bda32"><code>c5142bd</code></a> Exclude tests incompatible with the current platform using target_compatible_...</li>
<li><a href="a1dfff1694"><code>a1dfff1</code></a> Bump webpki from 0.22.0 to 0.22.2 in /agent (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1749">#1749</a>)</li>
<li><a href="2c9b8898f6"><code>2c9b889</code></a> Bump mio from 0.8.6 to 0.8.11 in /agent (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1892">#1892</a>)</li>
<li><a href="f3a9fccc8b"><code>f3a9fcc</code></a> Bump urllib3 from 1.26.19 to 2.6.0 in /buildkite/docker/ubuntu1604 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2415">#2415</a>)</li>
<li><a href="55e6135742"><code>55e6135</code></a> Update Docker image from ubuntu2404 to ubuntu2004 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2417">#2417</a>)</li>
<li><a href="80a06a5dfb"><code>80a06a5</code></a> Update Docker image to Ubuntu 24.04</li>
<li><a href="bc92ee7cd9"><code>bc92ee7</code></a> Fix pagination for fetching PRs, commits, and reviews in bcr-pr-reviewer (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2416">#2416</a>)</li>
<li><a href="64c9ba2d7f"><code>64c9ba2</code></a> BCR PR reviewer: add presubmit-auto-run for known module maintainer (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2414">#2414</a>)</li>
<li>Additional commits viewable in <a href="e3c3c35f22...9332050935">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/checkout` from 6.0.0 to 6.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
<li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="8e8c483db8"><code>8e8c483</code></a> Clarify v6 README (<a href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li>
<li><a href="033fa0dc0b"><code>033fa0d</code></a> Add worktree support for persist-credentials includeIf (<a href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li>
<li><a href="c2d88d3ecc"><code>c2d88d3</code></a> Update all references from v5 and v4 to v6 (<a href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li>
<li>See full diff in <a href="1af3b93b68...8e8c483db8">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 5.0.0 to 6.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>v6 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using: node24</code>) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Upload Artifact Node 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
<li>fix: update <code>@actions/artifact</code> for Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
<li>prepare release v6.0.0 for Node.js 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="b7c566a772"><code>b7c566a</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a> from actions/upload-artifact-v6-release</li>
<li><a href="e516bc8500"><code>e516bc8</code></a> docs: correct description of Node.js 24 support in README</li>
<li><a href="ddc45ed9bc"><code>ddc45ed</code></a> docs: update README to correct action name for Node.js 24 support</li>
<li><a href="615b319bd2"><code>615b319</code></a> chore: release v6.0.0 for Node.js 24 support</li>
<li><a href="017748b48f"><code>017748b</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/744">#744</a> from actions/fix-storage-blob</li>
<li><a href="38d4c7997f"><code>38d4c79</code></a> chore: rebuild dist</li>
<li><a href="7d27270e0c"><code>7d27270</code></a> chore: add missing license cache files for <code>@actions/core</code>, <code>@actions/io</code>, and mi...</li>
<li><a href="5f643d3c94"><code>5f643d3</code></a> chore: update license files for <code>@actions/artifact</code><a href="https://github.com/5"><code>@5</code></a>.0.1 dependencies</li>
<li><a href="1df1684032"><code>1df1684</code></a> chore: update package-lock.json with <code>@actions/artifact</code><a href="https://github.com/5"><code>@5</code></a>.0.1</li>
<li><a href="b5b1a91840"><code>b5b1a91</code></a> fix: update <code>@actions/artifact</code> to ^5.0.0 for Node.js 24 punycode fix</li>
<li>Additional commits viewable in <a href="330a01c490...b7c566a772">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 4.31.5 to 4.31.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v4.31.9</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.9 - 16 Dec 2025</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.9/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.31.8</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.8 - 11 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.8. <a href="https://redirect.github.com/github/codeql-action/pull/3354">#3354</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.8/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.31.7</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.7 - 05 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.7. <a href="https://redirect.github.com/github/codeql-action/pull/3343">#3343</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.31.6</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.6 - 01 Dec 2025</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.6/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.31.9 - 16 Dec 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.8 - 11 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.8. <a href="https://redirect.github.com/github/codeql-action/pull/3354">#3354</a></li>
</ul>
<h2>4.31.7 - 05 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.7. <a href="https://redirect.github.com/github/codeql-action/pull/3343">#3343</a></li>
</ul>
<h2>4.31.6 - 01 Dec 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.5 - 24 Nov 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.6. <a href="https://redirect.github.com/github/codeql-action/pull/3321">#3321</a></li>
</ul>
<h2>4.31.4 - 18 Nov 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.3 - 13 Nov 2025</h2>
<ul>
<li>CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see <a href="https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/">Upcoming deprecation of CodeQL Action v3</a>.</li>
<li>Update default CodeQL bundle version to 2.23.5. <a href="https://redirect.github.com/github/codeql-action/pull/3288">#3288</a></li>
</ul>
<h2>4.31.2 - 30 Oct 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.1 - 30 Oct 2025</h2>
<ul>
<li>The <code>add-snippets</code> input has been removed from the <code>analyze</code> action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.</li>
</ul>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or <code>upload-sarif</code> actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the <code>upload-sarif</code> action. For <code>analyze</code>, this may affect Advanced Setup for CodeQL users who specify a value other than <code>always</code> for the <code>upload</code> input. <a href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="5d4e8d1aca"><code>5d4e8d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3371">#3371</a> from github/update-v4.31.9-998798e34</li>
<li><a href="1dc115f17a"><code>1dc115f</code></a> Update changelog for v4.31.9</li>
<li><a href="998798e34d"><code>998798e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3352">#3352</a> from github/nickrolfe/jar-min-ff-cleanup</li>
<li><a href="5eb751966f"><code>5eb7519</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3358">#3358</a> from github/henrymercer/database-upload-telemetry</li>
<li><a href="d29eddb39b"><code>d29eddb</code></a> Extract version number to constant</li>
<li><a href="e9626872ef"><code>e962687</code></a> Merge branch 'main' into henrymercer/database-upload-telemetry</li>
<li><a href="19c7f96922"><code>19c7f96</code></a> Rename <code>isOverlayBase</code></li>
<li><a href="ae5de9a20d"><code>ae5de9a</code></a> Use <code>getErrorMessage</code> in log too</li>
<li><a href="0cb86337c5"><code>0cb8633</code></a> Prefer <code>performance.now()</code></li>
<li><a href="c07cc0d3a9"><code>c07cc0d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3351">#3351</a> from github/henrymercer/ghec-dr-determine-tools-vers...</li>
<li>Additional commits viewable in <a href="fdbfb4d275...5d4e8d1aca">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/stale` from 10.1.0 to 10.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p>
<blockquote>
<h2>v10.1.1</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Add Missing Input Reading for <code>only-issue-types</code> by <a href="https://github.com/Bibo-Joshi"><code>@Bibo-Joshi</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1298">actions/stale#1298</a></li>
</ul>
<h3>Improvement</h3>
<ul>
<li>Improves error handling when rate limiting is disabled on GHES. by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1300">actions/stale#1300</a></li>
</ul>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade eslint-config-prettier from 8.10.0 to 10.1.8 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1276">actions/stale#1276</a></li>
<li>Upgrade <code>@types/node</code> from 20.10.3 to 24.2.0 and document breaking changes in v10 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1280">actions/stale#1280</a></li>
<li>Upgrade actions/publish-action from 0.3.0 to 0.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1291">actions/stale#1291</a></li>
<li>Upgrade actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1306">actions/stale#1306</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1300">actions/stale#1300</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10...v10.1.1">https://github.com/actions/stale/compare/v10...v10.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="997185467f"><code>9971854</code></a> build(deps): bump actions/checkout from 4 to 6 (<a href="https://redirect.github.com/actions/stale/issues/1306">#1306</a>)</li>
<li><a href="5611b9defa"><code>5611b9d</code></a> build(deps): bump actions/publish-action from 0.3.0 to 0.4.0 (<a href="https://redirect.github.com/actions/stale/issues/1291">#1291</a>)</li>
<li><a href="fad0de84e5"><code>fad0de8</code></a> Improves error handling when rate limiting is disabled on GHES. (<a href="https://redirect.github.com/actions/stale/issues/1300">#1300</a>)</li>
<li><a href="39bea7de61"><code>39bea7d</code></a> Add Missing Input Reading for <code>only-issue-types</code> (<a href="https://redirect.github.com/actions/stale/issues/1298">#1298</a>)</li>
<li><a href="e46bbabb3e"><code>e46bbab</code></a> build(deps-dev): bump <code>@types/node</code> from 20.10.3 to 24.2.0 and document breakin...</li>
<li><a href="65d1d4804d"><code>65d1d48</code></a> build(deps-dev): bump eslint-config-prettier from 8.10.0 to 10.1.8 (<a href="https://redirect.github.com/actions/stale/issues/1276">#1276</a>)</li>
<li>See full diff in <a href="5f858e3efb...997185467f">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#28131.
PiperOrigin-RevId: 852371074
Change-Id: Ie6a2b6c7a37e315c9f5772de1d0cf83c843b2685
it has some pipeline logic to update the mintlify site, and we want this to stay current
Closes#27650.
PiperOrigin-RevId: 831405005
Change-Id: I46ecb428b88fd0861fa13fb3b9a7085540915aa0
Bumps the github-actions group with 4 updates: [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [actions/upload-artifact](https://github.com/actions/upload-artifact), [github/codeql-action](https://github.com/github/codeql-action) and [actions/stale](https://github.com/actions/stale).
Updates `bazelbuild/continuous-integration` from cc02676a9a261d74c8fa33963d440b65c67eec19 to 5904ada00b1ce65148531f5b8cdccf4102fd2508
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="5904ada00b"><code>5904ada</code></a> Improve CI resource and priority handling (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2397">#2397</a>)</li>
<li><a href="e7e6746041"><code>e7e6746</code></a> Set concurrency_method to eager for priority handling. (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2396">#2396</a>)</li>
<li><a href="a7d1578a77"><code>a7d1578</code></a> BCR presubmit: allow lower ci job priority via PR label (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2395">#2395</a>)</li>
<li><a href="1ccd7998fe"><code>1ccd799</code></a> Lower priority for a few pipelines (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2394">#2394</a>)</li>
<li><a href="1e31f4b1d9"><code>1e31f4b</code></a> Apply CI_RESOURCE_PERCENTAGE to also bcr presubmit (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2393">#2393</a>)</li>
<li><a href="18dbac3a79"><code>18dbac3</code></a> Added retry when fetching github labels (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2392">#2392</a>)</li>
<li><a href="4753e67cbd"><code>4753e67</code></a> Fix syncing ./bazel_registry.json (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2391">#2391</a>)</li>
<li><a href="a8a0a3e1bd"><code>a8a0a3e</code></a> Fix sync_bcr_content function to use rsync (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2390">#2390</a>)</li>
<li><a href="cbb12ea4b4"><code>cbb12ea</code></a> Unquote URL when mirroring (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2387">#2387</a>)</li>
<li><a href="ef50fc95ce"><code>ef50fc9</code></a> add a step to build linux_aarch64 java_tools (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2388">#2388</a>)</li>
<li>Additional commits viewable in <a href="cc02676a9a...5904ada00b">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node <code>v24.x</code>. This is not a breaking change per-se but we're treating it as such.</p>
<ul>
<li>Update README.md by <a href="https://github.com/GhadimiR"><code>@GhadimiR</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li>Readme: spell out the first use of GHES by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li>Update GHES guidance to include reference to Node 20 version by <a href="https://github.com/patrikpolyak"><code>@patrikpolyak</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v5.0.0</code> by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/GhadimiR"><code>@GhadimiR</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li><a href="https://github.com/nebuk89"><code>@nebuk89</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li><a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li><a href="https://github.com/patrikpolyak"><code>@patrikpolyak</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4...v5.0.0">https://github.com/actions/upload-artifact/compare/v4...v5.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="330a01c490"><code>330a01c</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/734">#734</a> from actions/danwkennedy/prepare-5.0.0</li>
<li><a href="03f2824452"><code>03f2824</code></a> Update <code>github.dep.yml</code></li>
<li><a href="905a1ecb59"><code>905a1ec</code></a> Prepare <code>v5.0.0</code></li>
<li><a href="2d9f9cdfa9"><code>2d9f9cd</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/725">#725</a> from patrikpolyak/patch-1</li>
<li><a href="9687587dec"><code>9687587</code></a> Merge branch 'main' into patch-1</li>
<li><a href="2848b2cda0"><code>2848b2c</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/727">#727</a> from danwkennedy/patch-1</li>
<li><a href="9b511775fd"><code>9b51177</code></a> Spell out the first use of GHES</li>
<li><a href="cd231ca1ed"><code>cd231ca</code></a> Update GHES guidance to include reference to Node 20 version</li>
<li><a href="de65e23aa2"><code>de65e23</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/712">#712</a> from actions/nebuk89-patch-1</li>
<li><a href="8747d8cd76"><code>8747d8c</code></a> Update README.md</li>
<li>Additional commits viewable in <a href="ea165f8d65...330a01c490">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.30.5 to 4.31.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v4.31.2</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.2 - 30 Oct 2025</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.2/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.31.1</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.1 - 30 Oct 2025</h2>
<ul>
<li>The <code>add-snippets</code> input has been removed from the <code>analyze</code> action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.</li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.1/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.31.0</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or <code>upload-sarif</code> actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the <code>upload-sarif</code> action. For <code>analyze</code>, this may affect Advanced Setup for CodeQL users who specify a value other than <code>always</code> for the <code>upload</code> input. <a href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.0/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.30.9</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>4.30.9 - 17 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.3. <a href="https://redirect.github.com/github/codeql-action/pull/3205">#3205</a></li>
<li>Experimental: A new <code>setup-codeql</code> action has been added which is similar to <code>init</code>, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3204">#3204</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v4.30.9/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v4.30.8</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.31.2 - 30 Oct 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.1 - 30 Oct 2025</h2>
<ul>
<li>The <code>add-snippets</code> input has been removed from the <code>analyze</code> action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.</li>
</ul>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or <code>upload-sarif</code> actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the <code>upload-sarif</code> action. For <code>analyze</code>, this may affect Advanced Setup for CodeQL users who specify a value other than <code>always</code> for the <code>upload</code> input. <a href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<h2>4.30.9 - 17 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.3. <a href="https://redirect.github.com/github/codeql-action/pull/3205">#3205</a></li>
<li>Experimental: A new <code>setup-codeql</code> action has been added which is similar to <code>init</code>, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3204">#3204</a></li>
</ul>
<h2>4.30.8 - 10 Oct 2025</h2>
<p>No user facing changes.</p>
<h2>4.30.7 - 06 Oct 2025</h2>
<ul>
<li>[v4+ only] The CodeQL Action now runs on Node.js v24. <a href="https://redirect.github.com/github/codeql-action/pull/3169">#3169</a></li>
</ul>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li>
</ul>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with <code>upload-sarif</code> which resulted in files without a <code>.sarif</code> extension not getting uploaded. <a href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the <code>codeql-action/init</code> step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the <code>codeql-action/init</code> step. <a href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a> and <a href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. <a href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing <code>tools: nightly</code> to the <code>init</code> action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="0499de31b9"><code>0499de3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3261">#3261</a> from github/henrymercer/setup-python</li>
<li><a href="3b96745d2b"><code>3b96745</code></a> Set up Python in mergeback workflow</li>
<li><a href="8a06050a8c"><code>8a06050</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3259">#3259</a> from github/update-v4.31.2-9576b5cbe</li>
<li><a href="752a642cb2"><code>752a642</code></a> Update changelog for v4.31.2</li>
<li><a href="9576b5cbe8"><code>9576b5c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3258">#3258</a> from github/mbg/enablement-errors/case-insensitive</li>
<li><a href="cc8843728c"><code>cc88437</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3257">#3257</a> from github/henrymercer/ubuntu-slim</li>
<li><a href="f0e9bf07f4"><code>f0e9bf0</code></a> Make <code>isEnablementError</code> case-insensitive</li>
<li><a href="2a3599c520"><code>2a3599c</code></a> Run lightweight workflows on <code>ubuntu-slim</code></li>
<li><a href="514ff4d116"><code>514ff4d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3256">#3256</a> from github/henrymercer/resolve-bad-merge</li>
<li><a href="aab1c2f931"><code>aab1c2f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3253">#3253</a> from github/mergeback/v4.31.1-to-main-5fe9434c</li>
<li>Additional commits viewable in <a href="3599b3baa1...0499de31b9">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/stale` from 10.0.0 to 10.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p>
<blockquote>
<h2>v10.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add <code>only-issue-types</code> option to filter issues by type by <a href="https://github.com/Bibo-Joshi"><code>@Bibo-Joshi</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1255">actions/stale#1255</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Bibo-Joshi"><code>@Bibo-Joshi</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1255">actions/stale#1255</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10...v10.1.0">https://github.com/actions/stale/compare/v10...v10.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/stale/blob/main/CHANGELOG.md">actions/stale's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1>[10.1.0]</h1>
<h2>What's Changed</h2>
<ul>
<li>Add only-issue-types option to filter issues by type by <a href="https://github.com/Bibo-Joshi"><code>@Bibo-Joshi</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1255">actions/stale#1255</a></li>
</ul>
<h1>[10.0.0]</h1>
<h2>What's Changed</h2>
<h2>Breaking Changes</h2>
<ul>
<li>Upgrade to node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1279">actions/stale#1279</a>
Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></li>
</ul>
<h2>Enhancement</h2>
<ul>
<li>Introducing sort-by option by <a href="https://github.com/suyashgaonkar"><code>@suyashgaonkar</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1254">actions/stale#1254</a></li>
</ul>
<h2>Dependency Upgrades</h2>
<ul>
<li>Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/stale/pull/1186">actions/stale#1186</a></li>
<li>Upgrade undici from 5.28.4 to 5.28.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/stale/pull/1201">actions/stale#1201</a></li>
<li>Upgrade <code>@action/cache</code> from 4.0.0 to 4.0.2 by <a href="https://github.com/aparnajyothi-y"><code>@aparnajyothi-y</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1226">actions/stale#1226</a></li>
<li>Upgrade <code>@action/cache</code> from 4.0.2 to 4.0.3 by <a href="https://github.com/suyashgaonkar"><code>@suyashgaonkar</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1233">actions/stale#1233</a></li>
<li>Upgrade undici from 5.28.5 to 5.29.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/stale/pull/1251">actions/stale#1251</a></li>
<li>Upgrade form-data to bring in fix for critical vulnerability by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1277">actions/stale#1277</a></li>
</ul>
<h2>Documentation changes</h2>
<ul>
<li>Changelog update for recent releases by <a href="https://github.com/suyashgaonkar"><code>@suyashgaonkar</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1224">actions/stale#1224</a></li>
<li>Permissions update in Readme by <a href="https://github.com/ghadimir"><code>@ghadimir</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1248">actions/stale#1248</a></li>
</ul>
<h1>[9.1.0]</h1>
<h2>What's Changed</h2>
<ul>
<li>Documentation update by <a href="https://github.com/Marukome0743"><code>@Marukome0743</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1116">actions/stale#1116</a></li>
<li>Add workflow file for publishing releases to immutable action package by <a href="https://github.com/Jcambass"><code>@Jcambass</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1179">actions/stale#1179</a></li>
<li>Update undici from 5.28.2 to 5.28.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1150">actions/stale#1150</a></li>
<li>Update actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1091">actions/stale#1091</a></li>
<li>Update actions/publish-action from 0.2.2 to 0.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1147">actions/stale#1147</a></li>
<li>Update ts-jest from 29.1.1 to 29.2.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1175">actions/stale#1175</a></li>
<li>Update <code>@actions/core</code> from 1.10.1 to 1.11.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1191">actions/stale#1191</a></li>
<li>Update <code>@types/jest</code> from 29.5.11 to 29.5.14 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1193">actions/stale#1193</a></li>
<li>Update <code>@actions/cache</code> from 3.2.2 to 4.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1194">actions/stale#1194</a></li>
</ul>
<h1>[9.0.0]</h1>
<h2>Breaking Changes</h2>
<ol>
<li>Action is now stateful: If the action ends because of <a href="https://github.com/actions/stale#operations-per-run">operations-per-run</a> then the next run will start from the first unprocessed issue skipping the issues processed during the previous run(s). The state is reset when all the issues are processed. This should be considered for scheduling workflow runs.</li>
<li>Version 9 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="5f858e3efb"><code>5f858e3</code></a> Add <code>only-issue-types</code> option to filter issues by type (<a href="https://redirect.github.com/actions/stale/issues/1255">#1255</a>)</li>
<li>See full diff in <a href="3a9db7e6a4...5f858e3efb">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#27487.
PiperOrigin-RevId: 828355632
Change-Id: I76c3d956634a74838209e006834782daac6f5241
Bumps the github-actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.12.2 to 2.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.13.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Improved job markdown summary</li>
<li>Https monitoring for all domains (included with the enterprise tier)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.13.0">https://github.com/step-security/harden-runner/compare/v2...v2.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="ec9f2d5744"><code>ec9f2d5</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/565">#565</a> from step-security/rc-24</li>
<li><a href="04bcbc31cf"><code>04bcbc3</code></a> update agent</li>
<li><a href="7c7a56fcaa"><code>7c7a56f</code></a> feat: get job summary from API</li>
<li>See full diff in <a href="6c439dc8bd...ec9f2d5744">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from 9d35a0e821730ab9ccaa496ce6004584f28a4aa2 to 3057a5e4fe524779f8b294496786204b0dd8b842
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="3057a5e4fe"><code>3057a5e</code></a> Update BCR presubmit's user agent to match bcr_validation.py</li>
<li><a href="7c1dec3e25"><code>7c1dec3</code></a> Upgrade bazel docker image to 22.04 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2351">#2351</a>)</li>
<li><a href="337638d2fc"><code>337638d</code></a> Update java_tools-binaries.yml (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2347">#2347</a>)</li>
<li><a href="470f89c17c"><code>470f89c</code></a> Add rbe configs for bazel 7 and 8 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2346">#2346</a>)</li>
<li><a href="847db96d25"><code>847db96</code></a> Sanitize retry log file names & swallow errors. (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2345">#2345</a>)</li>
<li>See full diff in <a href="9d35a0e821...3057a5e4fe">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.29.2 to 3.29.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v3.29.5</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.29.5 - 29 Jul 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.2. <a href="https://redirect.github.com/github/codeql-action/pull/2986">#2986</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.29.5/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.29.4</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.29.4 - 23 Jul 2025</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.29.4/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.29.3</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.29.3 - 21 Jul 2025</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.29.3/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.29.5 - 29 Jul 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.2. <a href="https://redirect.github.com/github/codeql-action/pull/2986">#2986</a></li>
</ul>
<h2>3.29.4 - 23 Jul 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.3 - 21 Jul 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.2 - 30 Jun 2025</h2>
<ul>
<li>Experimental: When the <code>quality-queries</code> input for the <code>init</code> action is provided with an argument, separate <code>.quality.sarif</code> files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/2935">#2935</a></li>
</ul>
<h2>3.29.1 - 27 Jun 2025</h2>
<ul>
<li>Fix bug in PR analysis where user-provided <code>include</code> query filter fails to exclude non-included queries. <a href="https://redirect.github.com/github/codeql-action/pull/2938">#2938</a></li>
<li>Update default CodeQL bundle version to 2.22.1. <a href="https://redirect.github.com/github/codeql-action/pull/2950">#2950</a></li>
</ul>
<h2>3.29.0 - 11 Jun 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.0. <a href="https://redirect.github.com/github/codeql-action/pull/2925">#2925</a></li>
<li>Bump minimum CodeQL bundle version to 2.16.6. <a href="https://redirect.github.com/github/codeql-action/pull/2912">#2912</a></li>
</ul>
<h2>3.28.21 - 28 July 2025</h2>
<p>No user facing changes.</p>
<h2>3.28.20 - 21 July 2025</h2>
<ul>
<li>Remove support for combining SARIF files from a single upload for GHES 3.18, see <a href="https://github.blog/changelog/2024-05-06-code-scanning-will-stop-combining-runs-from-a-single-upload/">the changelog post</a>. <a href="https://redirect.github.com/github/codeql-action/pull/2959">#2959</a></li>
</ul>
<h2>3.28.19 - 03 Jun 2025</h2>
<ul>
<li>The CodeQL Action no longer includes its own copy of the extractor for the <code>actions</code> language, which is currently in public preview.
The <code>actions</code> extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the <code>actions</code> language <em>and</em> you have pinned
your <code>tools:</code> property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable
<code>actions</code> analysis.</li>
<li>Update default CodeQL bundle version to 2.21.4. <a href="https://redirect.github.com/github/codeql-action/pull/2910">#2910</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="51f77329af"><code>51f7732</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2997">#2997</a> from github/update-v3.29.5-80a09d7b0</li>
<li><a href="8e90243ddb"><code>8e90243</code></a> Update changelog for v3.29.5</li>
<li><a href="80a09d7b0b"><code>80a09d7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2996">#2996</a> from github/dependabot/npm_and_yarn/npm-240ab9fad0</li>
<li><a href="8388115dc8"><code>8388115</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2994">#2994</a> from github/mergeback/changelog/v3.28.21</li>
<li><a href="401ecaf503"><code>401ecaf</code></a> Merge branch 'main' into mergeback/changelog/v3.28.21</li>
<li><a href="ab5c0c5fa5"><code>ab5c0c5</code></a> Merge branch 'main' into dependabot/npm_and_yarn/npm-240ab9fad0</li>
<li><a href="cd264d4dcd"><code>cd264d4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2986">#2986</a> from github/update-bundle/codeql-bundle-v2.22.2</li>
<li><a href="4599055b1e"><code>4599055</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.22.2</li>
<li><a href="fd7ad511e6"><code>fd7ad51</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2971">#2971</a> from github/update-supported-enterprise-server-versions</li>
<li><a href="ac0c9bfe1e"><code>ac0c9bf</code></a> Merge branch 'main' into update-supported-enterprise-server-versions</li>
<li>Additional commits viewable in <a href="181d5eefc2...51f77329af">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#26675.
PiperOrigin-RevId: 797215405
Change-Id: Ib0c35f76149cb62bb37e2a836bd72a21e1fb0331
Bumps the github-actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.12.0 to 2.12.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.12.2</h2>
<h2>What's Changed</h2>
<p>Added HTTPS Monitoring for additional destinations - *.githubusercontent.com
Bug fixes:</p>
<ul>
<li>Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode</li>
<li>Increased policy map size for block mode</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.12.2">https://github.com/step-security/harden-runner/compare/v2...v2.12.2</a></p>
<h2>v2.12.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.</li>
<li>Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.12.1">https://github.com/step-security/harden-runner/compare/v2...v2.12.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="6c439dc8bd"><code>6c439dc</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/562">#562</a> from step-security/rc-22</li>
<li><a href="bf5688696d"><code>bf56886</code></a> update agent</li>
<li><a href="5436dac7b5"><code>5436dac</code></a> update agent</li>
<li><a href="88d305a353"><code>88d305a</code></a> update agent</li>
<li><a href="b976878278"><code>b976878</code></a> update agent</li>
<li><a href="875cc92db2"><code>875cc92</code></a> Update agent</li>
<li><a href="002fdce3c6"><code>002fdce</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/544">#544</a> from step-security/rc-21</li>
<li><a href="2489e3fcb3"><code>2489e3f</code></a> Merge branch 'main' into rc-21</li>
<li><a href="75dd441a81"><code>75dd441</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/555">#555</a> from step-security/dependabot/github_actions/step-sec...</li>
<li><a href="4381ace9c4"><code>4381ace</code></a> Bump step-security/publish-unit-test-result-action from 2.19.0 to 2.20.0</li>
<li>Additional commits viewable in <a href="0634a2670c...6c439dc8bd">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from cb43b3ae68098c22fdb31fb3beb7c4cd48a54cad to 9d35a0e821730ab9ccaa496ce6004584f28a4aa2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="9d35a0e821"><code>9d35a0e</code></a> Add .txt extension to retry logs (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2343">#2343</a>)</li>
<li><a href="c30273d8c4"><code>c30273d</code></a> Don't use colons in retry log filenames (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2344">#2344</a>)</li>
<li><a href="612b3c0fa8"><code>612b3c0</code></a> Reapply and fix "Log jobs that have been retried" (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2332">#2332</a>) (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2335">#2335</a>) (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2339">#2339</a>)</li>
<li><a href="fc7d9e0c98"><code>fc7d9e0</code></a> Increase ARM64 pool sizes (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2331">#2331</a>)</li>
<li><a href="4da09fabf3"><code>4da09fa</code></a> Revert "Log jobs that have been retried" (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2332">#2332</a>)</li>
<li><a href="e7695c6d7f"><code>e7695c6</code></a> Suspected cache poisoning</li>
<li><a href="dad7b87d31"><code>dad7b87</code></a> Log jobs that have been retried (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2330">#2330</a>)</li>
<li><a href="daa224a6cc"><code>daa224a</code></a> Log information about Python binary on MacOS (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2329">#2329</a>)</li>
<li><a href="7242410ec5"><code>7242410</code></a> Fix code order in create_instances.py (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2328">#2328</a>)</li>
<li><a href="836468f9fa"><code>836468f</code></a> Create GCE images on Ubuntu 22.04 machines (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2327">#2327</a>)</li>
<li>Additional commits viewable in <a href="cb43b3ae68...9d35a0e821">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.28.18 to 3.29.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v3.29.2</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.29.2 - 30 Jun 2025</h2>
<ul>
<li>Experimental: When the <code>quality-queries</code> input for the <code>init</code> action is provided with an argument, separate <code>.quality.sarif</code> files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/2935">#2935</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.29.2/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.29.1</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.29.1 - 27 Jun 2025</h2>
<ul>
<li>Fix bug in PR analysis where user-provided <code>include</code> query filter fails to exclude non-included queries. <a href="https://redirect.github.com/github/codeql-action/pull/2938">#2938</a></li>
<li>Update default CodeQL bundle version to 2.22.1. <a href="https://redirect.github.com/github/codeql-action/pull/2950">#2950</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.29.1/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.29.0</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.29.0 - 11 Jun 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.0. <a href="https://redirect.github.com/github/codeql-action/pull/2925">#2925</a></li>
<li>Bump minimum CodeQL bundle version to 2.16.6. <a href="https://redirect.github.com/github/codeql-action/pull/2912">#2912</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.29.0/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.28.19</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.28.19 - 03 Jun 2025</h2>
<ul>
<li>The CodeQL Action no longer includes its own copy of the extractor for the <code>actions</code> language, which is currently in public preview.
The <code>actions</code> extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the <code>actions</code> language <em>and</em> you have pinned
your <code>tools:</code> property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable
<code>actions</code> analysis.</li>
<li>Update default CodeQL bundle version to 2.21.4. <a href="https://redirect.github.com/github/codeql-action/pull/2910">#2910</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.28.19/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.29.2 - 30 Jun 2025</h2>
<ul>
<li>Experimental: When the <code>quality-queries</code> input for the <code>init</code> action is provided with an argument, separate <code>.quality.sarif</code> files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/2935">#2935</a></li>
</ul>
<h2>3.29.1 - 27 Jun 2025</h2>
<ul>
<li>Fix bug in PR analysis where user-provided <code>include</code> query filter fails to exclude non-included queries. <a href="https://redirect.github.com/github/codeql-action/pull/2938">#2938</a></li>
<li>Update default CodeQL bundle version to 2.22.1. <a href="https://redirect.github.com/github/codeql-action/pull/2950">#2950</a></li>
</ul>
<h2>3.29.0 - 11 Jun 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.0. <a href="https://redirect.github.com/github/codeql-action/pull/2925">#2925</a></li>
<li>Bump minimum CodeQL bundle version to 2.16.6. <a href="https://redirect.github.com/github/codeql-action/pull/2912">#2912</a></li>
</ul>
<h2>3.28.19 - 03 Jun 2025</h2>
<ul>
<li>The CodeQL Action no longer includes its own copy of the extractor for the <code>actions</code> language, which is currently in public preview.
The <code>actions</code> extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the <code>actions</code> language <em>and</em> you have pinned
your <code>tools:</code> property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable
<code>actions</code> analysis.</li>
<li>Update default CodeQL bundle version to 2.21.4. <a href="https://redirect.github.com/github/codeql-action/pull/2910">#2910</a></li>
</ul>
<h2>3.28.18 - 16 May 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.3. <a href="https://redirect.github.com/github/codeql-action/pull/2893">#2893</a></li>
<li>Skip validating SARIF produced by CodeQL for improved performance. <a href="https://redirect.github.com/github/codeql-action/pull/2894">#2894</a></li>
<li>The number of threads and amount of RAM used by CodeQL can now be set via the <code>CODEQL_THREADS</code> and <code>CODEQL_RAM</code> runner environment variables. If set, these environment variables override the <code>threads</code> and <code>ram</code> inputs respectively. <a href="https://redirect.github.com/github/codeql-action/pull/2891">#2891</a></li>
</ul>
<h2>3.28.17 - 02 May 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.2. <a href="https://redirect.github.com/github/codeql-action/pull/2872">#2872</a></li>
</ul>
<h2>3.28.16 - 23 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.1. <a href="https://redirect.github.com/github/codeql-action/pull/2863">#2863</a></li>
</ul>
<h2>3.28.15 - 07 Apr 2025</h2>
<ul>
<li>Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. <a href="https://redirect.github.com/github/codeql-action/pull/2842">#2842</a></li>
</ul>
<h2>3.28.14 - 07 Apr 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="181d5eefc2"><code>181d5ee</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2957">#2957</a> from github/update-v3.29.2-4c57370d0</li>
<li><a href="c77386a9db"><code>c77386a</code></a> Fix changelog PR number</li>
<li><a href="8d43d4ecec"><code>8d43d4e</code></a> Update changelog for v3.29.2</li>
<li><a href="4c57370d03"><code>4c57370</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2935">#2935</a> from github/mbg/interpret-cq-results</li>
<li><a href="2830b750e5"><code>2830b75</code></a> Add changelog entry</li>
<li><a href="aa72ddaead"><code>aa72dda</code></a> Merge branch 'main' into mbg/interpret-cq-results</li>
<li><a href="65d1e45f0b"><code>65d1e45</code></a> Rename <code>SARIF_UPLOAD_ENDPOINT</code> members</li>
<li><a href="362ebf85da"><code>362ebf8</code></a> Check both SARIF files in <code>quality-queries.yml</code> test</li>
<li><a href="10a3e4b17d"><code>10a3e4b</code></a> Fix formatting</li>
<li><a href="8593ea65e2"><code>8593ea6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2954">#2954</a> from github/mergeback/v3.29.1-to-main-39edc492</li>
<li>Additional commits viewable in <a href="ff0a06e83c...181d5eefc2">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#26445.
PiperOrigin-RevId: 778408380
Change-Id: I3a03c066f2ce6a99b29978575fe63d82680e0df4
Bumps the github-actions group with 3 updates: [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `bazelbuild/continuous-integration` from 1d07a9c9fb2f66a39e5430a70828ef6912e8b804 to cb43b3ae68098c22fdb31fb3beb7c4cd48a54cad
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="cb43b3ae68"><code>cb43b3a</code></a> Update setup-docker.sh (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2319">#2319</a>)</li>
<li><a href="6f13af55cc"><code>6f13af5</code></a> Disable Clion & IntelliJ from Downstream CI (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2318">#2318</a>)</li>
<li><a href="f64117b967"><code>f64117b</code></a> Build ARM64 images for Ubuntu 22.04 & 24.04, too (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2317">#2317</a>)</li>
<li><a href="885989060b"><code>8859890</code></a> Fix all curl commands (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2315">#2315</a>)</li>
<li><a href="c45f8c1f1a"><code>c45f8c1</code></a> bcr_presubmit: Use Rocky Linux instead of CentOS (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2314">#2314</a>)</li>
<li><a href="c15c7b56e6"><code>c15c7b5</code></a> Prevent curl command from using config file or proxy (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2313">#2313</a>)</li>
<li><a href="d02475c2d1"><code>d02475c</code></a> BCR PR reviewer: Verify the PR isn't updated before approval/merge (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2312">#2312</a>)</li>
<li><a href="c055431b97"><code>c055431</code></a> Update bazel-postsubmit.yml: remove deleted package (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2311">#2311</a>)</li>
<li><a href="2c0ab6ed03"><code>2c0ab6e</code></a> Fix logging when no Bazel version is set (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2310">#2310</a>)</li>
<li><a href="1377068fda"><code>1377068</code></a> Update slack.bazel.build link (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2309">#2309</a>)</li>
<li>Additional commits viewable in <a href="1d07a9c9fb...cb43b3ae68">compare view</a></li>
</ul>
</details>
<br />
Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p>
<blockquote>
<h2>v2.4.2</h2>
<h2>What's Changed</h2>
<p>This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard <a href="https://github.com/ossf/scorecard/releases/tag/v5.2.0">v5.2.0</a> and <a href="https://github.com/ossf/scorecard/releases/tag/v5.2.1">v5.2.1</a> release notes.</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2">https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="05b42c6244"><code>05b42c6</code></a> 🌱 bump docker to ghcr v2.4.2 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1548">#1548</a>)</li>
<li><a href="b225da6b2b"><code>b225da6</code></a> Bump github.com/ossf/scorecard/v5 from v5.2.0 to v5.2.1 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1550">#1550</a>)</li>
<li><a href="9399f6f424"><code>9399f6f</code></a> 🌱 Bump the docker-images group across 1 directory with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1">#1</a>...</li>
<li><a href="e1daa8c5c7"><code>e1daa8c</code></a> 🌱 Bump the github-actions group across 1 directory with 5 updates (#...</li>
<li><a href="9fe6511b9b"><code>9fe6511</code></a> 🌱 Bump golang.org/x/net from 0.39.0 to 0.40.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1542">#1542</a>)</li>
<li><a href="25b9cd9cd1"><code>25b9cd9</code></a> 🌱 Bump github.com/ossf/scorecard/v5 from v5.1.1 to v5.2.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1547">#1547</a>)</li>
<li><a href="18cc9b8130"><code>18cc9b8</code></a> 🌱 Bump golang.org/x/net from 0.38.0 to 0.39.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1536">#1536</a>)</li>
<li><a href="db7814227b"><code>db78142</code></a> 🌱 Bump the github-actions group with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1538">#1538</a>)</li>
<li><a href="de386ed459"><code>de386ed</code></a> 🌱 Bump golang from 1.24.1 to 1.24.2 in the docker-images group (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1534">#1534</a>)</li>
<li><a href="5b7cedba4e"><code>5b7cedb</code></a> 🌱 Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1537">#1537</a>)</li>
<li>Additional commits viewable in <a href="f49aabe0b5...05b42c6244">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.28.17 to 3.28.18
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v3.28.18</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.28.18 - 16 May 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.3. <a href="https://redirect.github.com/github/codeql-action/pull/2893">#2893</a></li>
<li>Skip validating SARIF produced by CodeQL for improved performance. <a href="https://redirect.github.com/github/codeql-action/pull/2894">#2894</a></li>
<li>The number of threads and amount of RAM used by CodeQL can now be set via the <code>CODEQL_THREADS</code> and <code>CODEQL_RAM</code> runner environment variables. If set, these environment variables override the <code>threads</code> and <code>ram</code> inputs respectively. <a href="https://redirect.github.com/github/codeql-action/pull/2891">#2891</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.28.18/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>The CodeQL Action no longer includes its own copy of the extractor for the <code>actions</code> language, which is currently in public preview.
The <code>actions</code> extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the <code>actions</code> language <em>and</em> you have pinned
your <code>tools:</code> property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable
<code>actions</code> analysis.</li>
</ul>
<h2>3.28.18 - 16 May 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.3. <a href="https://redirect.github.com/github/codeql-action/pull/2893">#2893</a></li>
<li>Skip validating SARIF produced by CodeQL for improved performance. <a href="https://redirect.github.com/github/codeql-action/pull/2894">#2894</a></li>
<li>The number of threads and amount of RAM used by CodeQL can now be set via the <code>CODEQL_THREADS</code> and <code>CODEQL_RAM</code> runner environment variables. If set, these environment variables override the <code>threads</code> and <code>ram</code> inputs respectively. <a href="https://redirect.github.com/github/codeql-action/pull/2891">#2891</a></li>
</ul>
<h2>3.28.17 - 02 May 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.2. <a href="https://redirect.github.com/github/codeql-action/pull/2872">#2872</a></li>
</ul>
<h2>3.28.16 - 23 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.1. <a href="https://redirect.github.com/github/codeql-action/pull/2863">#2863</a></li>
</ul>
<h2>3.28.15 - 07 Apr 2025</h2>
<ul>
<li>Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. <a href="https://redirect.github.com/github/codeql-action/pull/2842">#2842</a></li>
</ul>
<h2>3.28.14 - 07 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.0. <a href="https://redirect.github.com/github/codeql-action/pull/2838">#2838</a></li>
</ul>
<h2>3.28.13 - 24 Mar 2025</h2>
<p>No user facing changes.</p>
<h2>3.28.12 - 19 Mar 2025</h2>
<ul>
<li>Dependency caching should now cache more dependencies for Java <code>build-mode: none</code> extractions. This should speed up workflows and avoid inconsistent alerts in some cases.</li>
<li>Update default CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/2810">#2810</a></li>
</ul>
<h2>3.28.11 - 07 Mar 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.20.6. <a href="https://redirect.github.com/github/codeql-action/pull/2793">#2793</a></li>
</ul>
<h2>3.28.10 - 21 Feb 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.20.5. <a href="https://redirect.github.com/github/codeql-action/pull/2772">#2772</a></li>
<li>Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. <a href="https://redirect.github.com/github/codeql-action/pull/2768">#2768</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="ff0a06e83c"><code>ff0a06e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2896">#2896</a> from github/update-v3.28.18-b86edfc27</li>
<li><a href="a41e0844be"><code>a41e084</code></a> Update changelog for v3.28.18</li>
<li><a href="b86edfc27a"><code>b86edfc</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2893">#2893</a> from github/update-bundle/codeql-bundle-v2.21.3</li>
<li><a href="e93b90025f"><code>e93b900</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.21.3</li>
<li><a href="510dfa3460"><code>510dfa3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2894">#2894</a> from github/henrymercer/skip-validating-codeql-sarif</li>
<li><a href="492d783245"><code>492d783</code></a> Merge branch 'main' into henrymercer/skip-validating-codeql-sarif</li>
<li><a href="83bdf3b7f9"><code>83bdf3b</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2859">#2859</a> from github/update-supported-enterprise-server-versions</li>
<li><a href="cffc916774"><code>cffc916</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2891">#2891</a> from austinpray-mixpanel/patch-1</li>
<li><a href="4420887272"><code>4420887</code></a> Add deprecation warning for CodeQL 2.16.5 and earlier</li>
<li><a href="4e178c5841"><code>4e178c5</code></a> Update supported versions table in README</li>
<li>Additional commits viewable in <a href="60168efe1c...ff0a06e83c">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#26199.
PiperOrigin-RevId: 770018212
Change-Id: Ia4792bf2b78983255cd2542527f423b3969c0b15
Bumps the github-actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.11.0 to 2.12.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.12.0</h2>
<h2>What's Changed</h2>
<ol>
<li>
<p>A new option, <code>disable-sudo-and-containers</code>, is now available to replace the <code>disable-sudo policy</code>, addressing Docker-based privilege escalation (<a href="https://github.com/step-security/harden-runner/security/advisories/GHSA-mxr3-8whj-j74r">CVE-2025-32955</a>). More details can be found in this <a href="https://www.stepsecurity.io/blog/evolving-harden-runners-disable-sudo-policy-for-improved-runner-security">blog post</a>.</p>
</li>
<li>
<p>New detections have been added based on insights from the tj-actions and reviewdog actions incidents.</p>
</li>
</ol>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.12.0">https://github.com/step-security/harden-runner/compare/v2...v2.12.0</a></p>
<h2>v2.11.1</h2>
<h2>What's Changed</h2>
<ul>
<li>cache: add support for GitHub Actions cache v2 by <a href="https://github.com/h0x0er"><code>@h0x0er</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/529">step-security/harden-runner#529</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.11.1">https://github.com/step-security/harden-runner/compare/v2...v2.11.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="0634a2670c"><code>0634a26</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/541">#541</a> from step-security/rc-20</li>
<li><a href="2e3c511341"><code>2e3c511</code></a> Update action.yml</li>
<li><a href="40873e6a41"><code>40873e6</code></a> Update README.md</li>
<li><a href="484c2799ec"><code>484c279</code></a> Update README.md</li>
<li><a href="4c8582f455"><code>4c8582f</code></a> Update agent versions</li>
<li><a href="e8d595cd66"><code>e8d595c</code></a> fix disable_sudo_and_containers bug</li>
<li><a href="5d277fc873"><code>5d277fc</code></a> fix journalctl related bug</li>
<li><a href="ff2ab228bd"><code>ff2ab22</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/536">#536</a> from rohan-stepsecurity/feat/flag/disable-sudo-and-co...</li>
<li><a href="b81d650d0e"><code>b81d650</code></a> fix: run sudo command only when both disable-sudo and disable-sudo-and-docker...</li>
<li><a href="769df4ef5d"><code>769df4e</code></a> Update agent</li>
<li>Additional commits viewable in <a href="4d991eb9b9...0634a2670c">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from 355e4f58d2c190548c1eb55f038f200c14899906 to acd96d05626ad622344fe4056d745df8e612a02d
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="acd96d0562"><code>acd96d0</code></a> Move GCE arm64 machines into new arm64_v2 queue (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2276">#2276</a>)</li>
<li><a href="6f90241df8"><code>6f90241</code></a> Fix arg handling in create_instances.py (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2275">#2275</a>)</li>
<li><a href="4f843599f8"><code>4f84359</code></a> Add support for Linux ARM64 workers (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2273">#2273</a>)</li>
<li><a href="1e428c6f0a"><code>1e428c6</code></a> Remove deleted Android tests (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2271">#2271</a>)</li>
<li><a href="94b6b0a4ac"><code>94b6b0a</code></a> Fix loop (selected_instances was always empty) (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2264">#2264</a>)</li>
<li><a href="27ab6e5af4"><code>27ab6e5</code></a> Fix create_instances (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2263">#2263</a>)</li>
<li><a href="d28c9224c9"><code>d28c922</code></a> create_instances: eventually fail on errors (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2262">#2262</a>)</li>
<li><a href="0bbd859fad"><code>0bbd859</code></a> Fix containerd setup (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2261">#2261</a>)</li>
<li><a href="cf0969306d"><code>cf09693</code></a> Fix Docker warning (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2258">#2258</a>)</li>
<li><a href="0edbf642f6"><code>0edbf64</code></a> Enable containerd image store for Docker (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2257">#2257</a>)</li>
<li>Additional commits viewable in <a href="355e4f58d2...acd96d0562">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.28.13 to 3.28.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v3.28.16</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.28.16 - 23 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.1. <a href="https://redirect.github.com/github/codeql-action/pull/2863">#2863</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.28.16/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.28.15</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.28.15 - 07 Apr 2025</h2>
<ul>
<li>Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. <a href="https://redirect.github.com/github/codeql-action/pull/2842">#2842</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.28.15/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.28.14</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>3.28.14 - 07 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.0. <a href="https://redirect.github.com/github/codeql-action/pull/2838">#2838</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.28.14/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.28.16 - 23 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.1. <a href="https://redirect.github.com/github/codeql-action/pull/2863">#2863</a></li>
</ul>
<h2>3.28.15 - 07 Apr 2025</h2>
<ul>
<li>Fix bug where the action would fail if it tried to produce a debug artifact with more than 65535 files. <a href="https://redirect.github.com/github/codeql-action/pull/2842">#2842</a></li>
</ul>
<h2>3.28.14 - 07 Apr 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.21.0. <a href="https://redirect.github.com/github/codeql-action/pull/2838">#2838</a></li>
</ul>
<h2>3.28.13 - 24 Mar 2025</h2>
<p>No user facing changes.</p>
<h2>3.28.12 - 19 Mar 2025</h2>
<ul>
<li>Dependency caching should now cache more dependencies for Java <code>build-mode: none</code> extractions. This should speed up workflows and avoid inconsistent alerts in some cases.</li>
<li>Update default CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/2810">#2810</a></li>
</ul>
<h2>3.28.11 - 07 Mar 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.20.6. <a href="https://redirect.github.com/github/codeql-action/pull/2793">#2793</a></li>
</ul>
<h2>3.28.10 - 21 Feb 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.20.5. <a href="https://redirect.github.com/github/codeql-action/pull/2772">#2772</a></li>
<li>Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. <a href="https://redirect.github.com/github/codeql-action/pull/2768">#2768</a></li>
</ul>
<h2>3.28.9 - 07 Feb 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.20.4. <a href="https://redirect.github.com/github/codeql-action/pull/2753">#2753</a></li>
</ul>
<h2>3.28.8 - 29 Jan 2025</h2>
<ul>
<li>Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. <a href="https://redirect.github.com/github/codeql-action/pull/2744">#2744</a></li>
</ul>
<h2>3.28.7 - 29 Jan 2025</h2>
<p>No user facing changes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="28deaeda66"><code>28deaed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2865">#2865</a> from github/update-v3.28.16-2a8cbadc0</li>
<li><a href="03c5d71c11"><code>03c5d71</code></a> Update changelog for v3.28.16</li>
<li><a href="2a8cbadc02"><code>2a8cbad</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2863">#2863</a> from github/update-bundle/codeql-bundle-v2.21.1</li>
<li><a href="f76eaf51a6"><code>f76eaf5</code></a> Add changelog note</li>
<li><a href="e63b3f5166"><code>e63b3f5</code></a> Update default bundle to codeql-bundle-v2.21.1</li>
<li><a href="4c3e536282"><code>4c3e536</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2853">#2853</a> from github/dependabot/npm_and_yarn/npm-7d84c66b66</li>
<li><a href="56dd02f26d"><code>56dd02f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2852">#2852</a> from github/dependabot/github_actions/actions-457587...</li>
<li><a href="192406dd84"><code>192406d</code></a> Merge branch 'main' into dependabot/github_actions/actions-4575878e06</li>
<li><a href="c7dbb2084e"><code>c7dbb20</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2857">#2857</a> from github/nickfyson/address-vulns</li>
<li><a href="9a45cd8c50"><code>9a45cd8</code></a> move use of input variables into env vars</li>
<li>Additional commits viewable in <a href="1b549b9259...28deaeda66">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#25981.
PiperOrigin-RevId: 758558284
Change-Id: I239a7d3a8645ffb57dab44b3c9404fdb522e5b15
Bumps the github-actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.10.1 to 2.10.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.10.2</h2>
<h2>What's Changed</h2>
<ol>
<li>
<p>Fixes low-severity command injection weaknesses
The advisory is here: <a href="https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc">https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc</a></p>
</li>
<li>
<p>Bug fix to improve detection of whether Harden-Runner is running in a container</p>
</li>
</ol>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.10.2">https://github.com/step-security/harden-runner/compare/v2...v2.10.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="0080882f6c"><code>0080882</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/476">#476</a> from step-security/rc-16</li>
<li><a href="4a3a88bbf8"><code>4a3a88b</code></a> Update dist</li>
<li><a href="556aae632a"><code>556aae6</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/480">#480</a> from h0x0er/jatin/cleanup</li>
<li><a href="6c39b84661"><code>6c39b84</code></a> chore: clean the code</li>
<li><a href="40401cf618"><code>40401cf</code></a> Update for isdocker</li>
<li><a href="806ab1cccb"><code>806ab1c</code></a> Update check for isdocker</li>
<li><a href="28468118cd"><code>2846811</code></a> update dist</li>
<li><a href="df8a07c171"><code>df8a07c</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/475">#475</a> from h0x0er/fix-execSync</li>
<li><a href="30636fb583"><code>30636fb</code></a> bug fixes</li>
<li>See full diff in <a href="91182cccc0...0080882f6c">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from 8db2c232a6f86d56ec655e7b0d87de3787a25ef1 to ca51d31b830088915518c6bb29fd268bd4f776f2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="ca51d31b83"><code>ca51d31</code></a> Use agent 0.2.4 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2129">#2129</a>)</li>
<li><a href="4628984d9b"><code>4628984</code></a> Release agent 0.2.4 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2128">#2128</a>)</li>
<li><a href="7a6c30e8ac"><code>7a6c30e</code></a> agent: upgrade to ubuntu-latest for presubmit. (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2127">#2127</a>)</li>
<li><a href="9b9dc42fa8"><code>9b9dc42</code></a> Revert "Upgrade agent to 0.2.3 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2124">#2124</a>)" (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2125">#2125</a>)</li>
<li><a href="6556ef19cb"><code>6556ef1</code></a> agent: Fix tests and argument order for upload (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2126">#2126</a>)</li>
<li><a href="a086a7a324"><code>a086a7a</code></a> Upgrade agent to 0.2.3 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2124">#2124</a>)</li>
<li><a href="9fafab6ba8"><code>9fafab6</code></a> Release agent-0.2.3 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2121">#2121</a>)</li>
<li><a href="3c0e9822c4"><code>3c0e982</code></a> Bumped the max number of jobs to 128. (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2120">#2120</a>)</li>
<li><a href="34820ae90a"><code>34820ae</code></a> Make bcr_compatibility less prone to bazel version change (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2119">#2119</a>)</li>
<li><a href="496c0a9d38"><code>496c0a9</code></a> Increase the number of macos_arm64 machines (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2118">#2118</a>)</li>
<li>Additional commits viewable in <a href="8db2c232a6...ca51d31b83">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.27.0 to 3.27.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v3.27.5</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.27.5 - 19 Nov 2024</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.27.5/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.27.4</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.27.4 - 14 Nov 2024</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.27.4/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.27.3</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.27.3 - 12 Nov 2024</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.27.3/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.27.2</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.27.2 - 12 Nov 2024</h2>
<ul>
<li>Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". <a href="https://redirect.github.com/github/codeql-action/pull/2590">#2590</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.27.5 - 19 Nov 2024</h2>
<p>No user facing changes.</p>
<h2>3.27.4 - 14 Nov 2024</h2>
<p>No user facing changes.</p>
<h2>3.27.3 - 12 Nov 2024</h2>
<p>No user facing changes.</p>
<h2>3.27.2 - 12 Nov 2024</h2>
<ul>
<li>Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". <a href="https://redirect.github.com/github/codeql-action/pull/2590">#2590</a></li>
</ul>
<h2>3.27.1 - 08 Nov 2024</h2>
<ul>
<li>The CodeQL Action now downloads bundles compressed using Zstandard on GitHub Enterprise Server when using Linux or macOS runners. This speeds up the installation of the CodeQL tools. This feature is already available to GitHub.com users. <a href="https://redirect.github.com/github/codeql-action/pull/2573">#2573</a></li>
<li>Update default CodeQL bundle version to 2.19.3. <a href="https://redirect.github.com/github/codeql-action/pull/2576">#2576</a></li>
</ul>
<h2>3.27.0 - 22 Oct 2024</h2>
<ul>
<li>Bump the minimum CodeQL bundle version to 2.14.6. <a href="https://redirect.github.com/github/codeql-action/pull/2549">#2549</a></li>
<li>Fix an issue where the <code>upload-sarif</code> Action would fail with "upload-sarif post-action step failed: Input required and not supplied: token" when called in a composite Action that had a different set of inputs to the ones expected by the <code>upload-sarif</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/2557">#2557</a></li>
<li>Update default CodeQL bundle version to 2.19.2. <a href="https://redirect.github.com/github/codeql-action/pull/2552">#2552</a></li>
</ul>
<h2>3.26.13 - 14 Oct 2024</h2>
<p>No user facing changes.</p>
<h2>3.26.12 - 07 Oct 2024</h2>
<ul>
<li>
<p><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2520">#2520</a></p>
<ul>
<li>
<p>If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</p>
</li>
<li>
<p>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.26.11</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.26.11</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</p>
</li>
</ul>
</li>
</ul>
<h2>3.26.11 - 03 Oct 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="f09c1c0a94"><code>f09c1c0</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2616">#2616</a> from github/update-v3.27.5-a6c8729a5</li>
<li><a href="67b73eaba5"><code>67b73ea</code></a> Update changelog for v3.27.5</li>
<li><a href="a6c8729a5d"><code>a6c8729</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2614">#2614</a> from github/marcogario/per-platform-proxy</li>
<li><a href="8f3b48727f"><code>8f3b487</code></a> Start-proxy: Fetch OS specific binary</li>
<li><a href="cba5fb58d4"><code>cba5fb5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2613">#2613</a> from github/dependabot/npm_and_yarn/npm_and_yarn-018...</li>
<li><a href="e782c3a145"><code>e782c3a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2612">#2612</a> from github/angelapwen/report-linux-runner-release</li>
<li><a href="db6788195b"><code>db67881</code></a> Update checked-in dependencies</li>
<li><a href="ecde4d232d"><code>ecde4d2</code></a> Bump cross-spawn from 7.0.3 to 7.0.6 in the npm_and_yarn group</li>
<li><a href="e3c67a01d3"><code>e3c67a0</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2610">#2610</a> from github/dependabot/npm_and_yarn/npm-d2ca52e617</li>
<li><a href="f9ada54538"><code>f9ada54</code></a> Telemetry: report OS release for GitHub-hosted Linux runners</li>
<li>Additional commits viewable in <a href="662472033e...f09c1c0a94">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#24532.
PiperOrigin-RevId: 717998122
Change-Id: I6984011ac1808a13d5ed3eb942c0a26e6fb52f11
This workflow should no longer be used at least temporarily because of a security vulnerability issue. See []
PiperOrigin-RevId: 700742658
Change-Id: Ic94a7456f854c40930549f13822d4c31896c07ba
This should be safe since the cherry-pick bot doesn't run any code from the PR.
PiperOrigin-RevId: 696941692
Change-Id: Ic37a8b3295ed845e6c0f58dcaa2367a7cd86a8b7
Bumps the github-actions group with 3 updates: [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `bazelbuild/continuous-integration` from 312ab25f6994b2fac89dc6910b3ebd6cb93cfa74 to 8db2c232a6f86d56ec655e7b0d87de3787a25ef1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="8db2c232a6"><code>8db2c23</code></a> Update gcloud.py for current Python versions (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2099">#2099</a>)</li>
<li><a href="24e2af9518"><code>24e2af9</code></a> Remove physical_clusters from config. (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2098">#2098</a>)</li>
<li><a href="c8ae713a39"><code>c8ae713</code></a> Update trusted instance count for Linux & Windows (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2097">#2097</a>)</li>
<li><a href="12e033f091"><code>12e033f</code></a> Revert "Upgrade Linux & Windows CI fleet (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2090">#2090</a>)" (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2096">#2096</a>)</li>
<li><a href="cea5db3233"><code>cea5db3</code></a> Fix module selection check (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2095">#2095</a>)</li>
<li><a href="ede572e8b2"><code>ede572e</code></a> bcr_compatibility: Support selecting top modules from BCR (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2094">#2094</a>)</li>
<li><a href="ab3f2a64b8"><code>ab3f2a6</code></a> Avoid generate duplicated tasks (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2093">#2093</a>)</li>
<li><a href="3dcd4a358a"><code>3dcd4a3</code></a> Exclude maintainer with "do_not_notify" in generate_report.py (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2092">#2092</a>)</li>
<li><a href="1375273b14"><code>1375273</code></a> BCR bazel compatibility test: Add generate_report.py (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2091">#2091</a>)</li>
<li><a href="9b869724f7"><code>9b86972</code></a> Upgrade Linux & Windows CI fleet (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2090">#2090</a>)</li>
<li>Additional commits viewable in <a href="312ab25f69...8db2c232a6">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 4.4.0 to 4.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v4.4.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Undo indirect dependency updates from <a href="https://redirect.github.com/actions/upload-artifact/issues/627">#627</a> by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/632">actions/upload-artifact#632</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.4.2...v4.4.3">https://github.com/actions/upload-artifact/compare/v4.4.2...v4.4.3</a></p>
<h2>v4.4.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/artifact</code> to 2.1.11 by <a href="https://github.com/robherley"><code>@robherley</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/627">actions/upload-artifact#627</a>
<ul>
<li>Includes fix for relative symlinks not resolving properly</li>
</ul>
</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.4.1...v4.4.2">https://github.com/actions/upload-artifact/compare/v4.4.1...v4.4.2</a></p>
<h2>v4.4.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Add a section about hidden files by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/607">actions/upload-artifact#607</a></li>
<li>Add workflow file for publishing releases to immutable action package by <a href="https://github.com/Jcambass"><code>@Jcambass</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/621">actions/upload-artifact#621</a></li>
<li>Update <code>@actions/artifact</code> to latest version, includes symlink and timeout fixes by <a href="https://github.com/robherley"><code>@robherley</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/625">actions/upload-artifact#625</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Jcambass"><code>@Jcambass</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/621">actions/upload-artifact#621</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.4.0...v4.4.1">https://github.com/actions/upload-artifact/compare/v4.4.0...v4.4.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="b4b15b8c7c"><code>b4b15b8</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/632">#632</a> from actions/joshmgross/undo-dependency-changes</li>
<li><a href="92b01ebffa"><code>92b01eb</code></a> Undo indirect dependency updates from <a href="https://redirect.github.com/actions/upload-artifact/issues/627">#627</a></li>
<li><a href="84480863f2"><code>8448086</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/627">#627</a> from actions/robherley/v4.4.2</li>
<li><a href="b1d4642b69"><code>b1d4642</code></a> add explicit relative and absolute symlinks to workflow</li>
<li><a href="d50e66084c"><code>d50e660</code></a> bump version</li>
<li><a href="aabe6f8050"><code>aabe6f8</code></a> build with <code>@actions/artifact</code> v2.1.11</li>
<li><a href="604373da63"><code>604373d</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/625">#625</a> from actions/robherley/artifact-2.1.10</li>
<li><a href="0150148bdf"><code>0150148</code></a> paste right core version</li>
<li><a href="a009b25faa"><code>a009b25</code></a> update licenses</li>
<li><a href="9f6f6f402e"><code>9f6f6f4</code></a> update <code>@actions/core</code> and <code>@actions/artifact</code> to latest versions</li>
<li>Additional commits viewable in <a href="50769540e7...b4b15b8c7c">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.26.10 to 3.27.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p>
<blockquote>
<h2>v3.27.0</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.27.0 - 22 Oct 2024</h2>
<ul>
<li>Bump the minimum CodeQL bundle version to 2.14.6. <a href="https://redirect.github.com/github/codeql-action/pull/2549">#2549</a></li>
<li>Fix an issue where the <code>upload-sarif</code> Action would fail with "upload-sarif post-action step failed: Input required and not supplied: token" when called in a composite Action that had a different set of inputs to the ones expected by the <code>upload-sarif</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/2557">#2557</a></li>
<li>Update default CodeQL bundle version to 2.19.2. <a href="https://redirect.github.com/github/codeql-action/pull/2552">#2552</a></li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.27.0/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.26.13</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.26.13 - 14 Oct 2024</h2>
<p>No user facing changes.</p>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.26.13/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.26.12</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>3.26.12 - 07 Oct 2024</h2>
<ul>
<li>
<p><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2520">#2520</a></p>
<ul>
<li>
<p>If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</p>
</li>
<li>
<p>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.26.11</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.26.11</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</p>
</li>
</ul>
</li>
</ul>
<p>See the full <a href="https://github.com/github/codeql-action/blob/v3.26.12/CHANGELOG.md">CHANGELOG.md</a> for more information.</p>
<h2>v3.26.11</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.27.0 - 22 Oct 2024</h2>
<ul>
<li>Bump the minimum CodeQL bundle version to 2.14.6. <a href="https://redirect.github.com/github/codeql-action/pull/2549">#2549</a></li>
<li>Fix an issue where the <code>upload-sarif</code> Action would fail with "upload-sarif post-action step failed: Input required and not supplied: token" when called in a composite Action that had a different set of inputs to the ones expected by the <code>upload-sarif</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/2557">#2557</a></li>
<li>Update default CodeQL bundle version to 2.19.2. <a href="https://redirect.github.com/github/codeql-action/pull/2552">#2552</a></li>
</ul>
<h2>3.26.13 - 14 Oct 2024</h2>
<p>No user facing changes.</p>
<h2>3.26.12 - 07 Oct 2024</h2>
<ul>
<li>
<p><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2520">#2520</a></p>
<ul>
<li>
<p>If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</p>
</li>
<li>
<p>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.26.11</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.26.11</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</p>
</li>
</ul>
</li>
</ul>
<h2>3.26.11 - 03 Oct 2024</h2>
<ul>
<li>
<p><em>Upcoming breaking change</em>: Add support for using <code>actions/download-artifact@v4</code> to programmatically consume CodeQL Action debug artifacts.</p>
<p>Starting November 30, 2024, GitHub.com customers will <a href="https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/">no longer be able to use <code>actions/download-artifact@v3</code></a>. Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the <code>CODEQL_ACTION_ARTIFACT_V4_UPGRADE</code> environment variable to <code>true</code> and bump <code>actions/download-artifact@v3</code> to <code>actions/download-artifact@v4</code> in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped to <code>actions/download-artifact@v3</code> to <code>actions/download-artifact@v4</code> will begin failing then.</p>
<p>This change is currently unavailable for GitHub Enterprise Server customers, as <code>actions/upload-artifact@v4</code> and <code>actions/download-artifact@v4</code> are not yet compatible with GHES.</p>
</li>
<li>
<p>Update default CodeQL bundle version to 2.19.1. <a href="https://redirect.github.com/github/codeql-action/pull/2519">#2519</a></p>
</li>
</ul>
<h2>3.26.10 - 30 Sep 2024</h2>
<ul>
<li>We are rolling out a feature in September/October 2024 that sets up CodeQL using a bundle compressed with <a href="http://facebook.github.io/zstd/">Zstandard</a>. Our aim is to improve the performance of setting up CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/2502">#2502</a></li>
</ul>
<h2>3.26.9 - 24 Sep 2024</h2>
<p>No user facing changes.</p>
<h2>3.26.8 - 19 Sep 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.19.0. <a href="https://redirect.github.com/github/codeql-action/pull/2483">#2483</a></li>
</ul>
<h2>3.26.7 - 13 Sep 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="662472033e"><code>6624720</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2561">#2561</a> from github/update-v3.27.0-b35b023d9</li>
<li><a href="ce7c2b560d"><code>ce7c2b5</code></a> Update changelog for v3.27.0</li>
<li><a href="b35b023d9b"><code>b35b023</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2552">#2552</a> from github/update-bundle/codeql-bundle-v2.19.2</li>
<li><a href="dafc762411"><code>dafc762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2560">#2560</a> from github/aeisenberg/fix-required-checks</li>
<li><a href="0d1eb88b60"><code>0d1eb88</code></a> Remove ESLint from required checks</li>
<li><a href="0a30541440"><code>0a30541</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2558">#2558</a> from github/dependabot/npm_and_yarn/npm-6515e6e328</li>
<li><a href="2a6a6ad1c8"><code>2a6a6ad</code></a> Update checked-in dependencies</li>
<li><a href="26c18c2c1f"><code>26c18c2</code></a> Bump the npm group with 3 updates</li>
<li><a href="7080a68cbc"><code>7080a68</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.19.2</li>
<li><a href="63eb7bbf1f"><code>63eb7bb</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2551">#2551</a> from github/cklin/diff-informed-queries-feature</li>
<li>Additional commits viewable in <a href="e2b3eafc8d...662472033e">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#24169.
PiperOrigin-RevId: 693785632
Change-Id: Id5f774d37de474068a64ba30360199cffe9188cd
Bumps the github-actions group with 3 updates: [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `bazelbuild/continuous-integration` from 47d1cea8c6888d505a288065e067a03032d7aaac to 40accd1e24b7d296e87b573002ed0903828c0cf0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="40accd1e24"><code>40accd1</code></a> Remove emergency banner (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2030">#2030</a>)</li>
<li><a href="8b5d8e93b3"><code>8b5d8e9</code></a> Allow network-related env variables to be removed (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2029">#2029</a>)</li>
<li><a href="3e3d3c147c"><code>3e3d3c1</code></a> Disable rules_jsonnet in downstream pipeline (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2027">#2027</a>)</li>
<li><a href="e478ee5a6b"><code>e478ee5</code></a> Retry on macos_arm64 on exit code 255 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2026">#2026</a>)</li>
<li><a href="26b4ba8064"><code>26b4ba8</code></a> Fix uploading artifact with buildkite-agent on Linux arm64 machine (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2024">#2024</a>)</li>
<li><a href="e1b8edbe5e"><code>e1b8edb</code></a> Always set <code>publish_binary</code> to empty for generated rbe platforms (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2023">#2023</a>)</li>
<li><a href="9588f08fbb"><code>9588f08</code></a> Publish linux arm64 binary for Bazel built at commits (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2022">#2022</a>)</li>
<li>See full diff in <a href="47d1cea8c6...40accd1e24">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 4.3.6 to 4.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<h2>Notice: Breaking Changes ⚠️</h2>
<p>We will no longer include hidden files and folders by default in the <code>upload-artifact</code> action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, <code>include-hidden-files</code>, to continue to do so.</p>
<p>See <a href="https://github.blog/changelog/2024-08-19-notice-of-upcoming-deprecations-and-breaking-changes-in-github-actions-runners/">"Notice of upcoming deprecations and breaking changes in GitHub Actions runners"</a> changelog and <a href="https://redirect.github.com/actions/upload-artifact/issues/602">this issue</a> for more details.</p>
<h2>What's Changed</h2>
<ul>
<li>Exclude hidden files by default by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/598">actions/upload-artifact#598</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.3.6...v4.4.0">https://github.com/actions/upload-artifact/compare/v4.3.6...v4.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="50769540e7"><code>5076954</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/598">#598</a> from actions/joshmgross/exclude-hidden-files</li>
<li><a href="d52396ac5d"><code>d52396a</code></a> Add a warning about enabling <code>include-hidden-files</code></li>
<li><a href="710f362075"><code>710f362</code></a> Remove "merged" from <code>include-hidden-files</code> input description</li>
<li><a href="3b315f26f6"><code>3b315f2</code></a> <code>npm run release</code> again 🙂</li>
<li><a href="3be2180eb7"><code>3be2180</code></a> Remove another trailing comma</li>
<li><a href="453e8d0a40"><code>453e8d0</code></a> Update glob license</li>
<li><a href="0a398c1480"><code>0a398c1</code></a> <code>npm run release</code></li>
<li><a href="a0c40cf602"><code>a0c40cf</code></a> Update to latest <code>@actions/glob</code> and fix tests</li>
<li><a href="acb59e4776"><code>acb59e4</code></a> <code>lint</code></li>
<li><a href="cb6558bb10"><code>cb6558b</code></a> Exclude hidden files by default</li>
<li>See full diff in <a href="834a144ee9...50769540e7">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.26.1 to 3.26.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.26.6 - 29 Aug 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.18.3. <a href="https://redirect.github.com/github/codeql-action/pull/2449">#2449</a></li>
</ul>
<h2>3.26.5 - 23 Aug 2024</h2>
<ul>
<li>Fix an issue where the <code>csrutil</code> system call used for telemetry would fail on MacOS ARM machines with System Integrity Protection disabled. <a href="https://redirect.github.com/github/codeql-action/pull/2441">#2441</a></li>
</ul>
<h2>3.26.4 - 21 Aug 2024</h2>
<ul>
<li><em>Deprecation:</em> The <code>add-snippets</code> input on the <code>analyze</code> Action is deprecated and will be removed in the first release in August 2025. <a href="https://redirect.github.com/github/codeql-action/pull/2436">#2436</a></li>
<li>Fix an issue where the disk usage system call used for telemetry would fail on MacOS ARM machines with System Integrity Protection disabled, and then surface a warning. The system call is now disabled for these machines. <a href="https://redirect.github.com/github/codeql-action/pull/2434">#2434</a></li>
</ul>
<h2>3.26.3 - 19 Aug 2024</h2>
<ul>
<li>Fix an issue where the CodeQL Action could not write diagnostic messages on Windows. This issue did not impact analysis quality. <a href="https://redirect.github.com/github/codeql-action/pull/2430">#2430</a></li>
</ul>
<h2>3.26.2 - 14 Aug 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.18.2. <a href="https://redirect.github.com/github/codeql-action/pull/2417">#2417</a></li>
</ul>
<h2>3.26.1 - 13 Aug 2024</h2>
<p>No user facing changes.</p>
<h2>3.26.0 - 06 Aug 2024</h2>
<ul>
<li><em>Deprecation:</em> Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you. <a href="https://redirect.github.com/github/codeql-action/pull/2403">#2403</a></li>
<li>Bump the minimum CodeQL bundle version to 2.13.5. <a href="https://redirect.github.com/github/codeql-action/pull/2408">#2408</a></li>
</ul>
<h2>3.25.15 - 26 Jul 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.18.1. <a href="https://redirect.github.com/github/codeql-action/pull/2385">#2385</a></li>
</ul>
<h2>3.25.14 - 25 Jul 2024</h2>
<ul>
<li>Experimental: add a new <code>start-proxy</code> action which starts the same HTTP proxy as used by <a href="https://github.com/github/dependabot-action"><code>github/dependabot-action</code></a>. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/2376">#2376</a></li>
</ul>
<h2>3.25.13 - 19 Jul 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="4dd16135b6"><code>4dd1613</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2452">#2452</a> from github/update-v3.26.6-7233ec5e6</li>
<li><a href="dd9dd2d538"><code>dd9dd2d</code></a> Update changelog for v3.26.6</li>
<li><a href="7233ec5e6b"><code>7233ec5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2449">#2449</a> from github/update-bundle/codeql-bundle-v2.18.3</li>
<li><a href="a32c44dba1"><code>a32c44d</code></a> Add changelog note</li>
<li><a href="2966897c67"><code>2966897</code></a> Update default bundle to codeql-bundle-v2.18.3</li>
<li><a href="b8efe4dc6a"><code>b8efe4d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2435">#2435</a> from github/update-supported-enterprise-server-versions</li>
<li><a href="ab408a875b"><code>ab408a8</code></a> Merge branch 'main' into update-supported-enterprise-server-versions</li>
<li><a href="864b979bc3"><code>864b979</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2443">#2443</a> from github/dbartol/config-file-telemetry</li>
<li><a href="d36c7aaf6a"><code>d36c7aa</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2448">#2448</a> from github/dependabot/npm_and_yarn/npm-09b7c43f6b</li>
<li><a href="b3bf514df4"><code>b3bf514</code></a> Update checked-in dependencies</li>
<li>Additional commits viewable in <a href="29d86d22a3...4dd16135b6">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#23485.
PiperOrigin-RevId: 673274405
Change-Id: I691d81a6d63f2d4a431473272c9917dddd4bb120
Bumps the github-actions group with 4 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.9.0 to 2.9.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.9.1</h2>
<h2>What's Changed</h2>
<p>Release v2.9.1 by <a href="https://github.com/h0x0er"><code>@h0x0er</code></a> and <a href="https://github.com/varunsh-coder"><code>@varunsh-coder</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/issues/440">#440</a>
This release includes two changes:</p>
<ol>
<li>Updated markdown displayed in the job summary by the Harden-Runner Action.</li>
<li>Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.</li>
</ol>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.9.1">https://github.com/step-security/harden-runner/compare/v2...v2.9.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="5c7944e73c"><code>5c7944e</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/440">#440</a> from step-security/rc-11</li>
<li><a href="c79be451ee"><code>c79be45</code></a> Merge branch 'main' into rc-11</li>
<li><a href="deb3383c4d"><code>deb3383</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/446">#446</a> from h0x0er/log-step</li>
<li><a href="23c8215e78"><code>23c8215</code></a> update dist</li>
<li><a href="727d06a16d"><code>727d06a</code></a> logging step</li>
<li><a href="f0db2aa8a5"><code>f0db2aa</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/441">#441</a> from step-security/dependabot/github_actions/github/c...</li>
<li><a href="1938ffc008"><code>1938ffc</code></a> Merge branch 'main' into dependabot/github_actions/github/codeql-action-3.25.13</li>
<li><a href="8e7dd2c82b"><code>8e7dd2c</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/442">#442</a> from step-security/dependabot/github_actions/step-sec...</li>
<li><a href="f2823ee7dd"><code>f2823ee</code></a> Bump step-security/publish-unit-test-result-action from 1 to 2</li>
<li><a href="5f95e051ab"><code>5f95e05</code></a> Bump github/codeql-action from 2.13.4 to 3.25.13</li>
<li>Additional commits viewable in <a href="0d381219dd...5c7944e73c">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from 53aaadea332e5840d41a1173e78680b3ca7081a0 to 47d1cea8c6888d505a288065e067a03032d7aaac
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="47d1cea8c6"><code>47d1cea</code></a> [reapply] Automatically retry on macOS for some failures (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2019">#2019</a>)</li>
<li><a href="333047c779"><code>333047c</code></a> Update slack link</li>
<li><a href="c948ad6df0"><code>c948ad6</code></a> Fix get_test_tags (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2018">#2018</a>)</li>
<li><a href="68193b3171"><code>68193b3</code></a> Add support for adding back tests (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2017">#2017</a>)</li>
<li><a href="4bfd1ad62c"><code>4bfd1ad</code></a> Revert "Automatically retry on macOS for some failures (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2012">#2012</a>)" (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2016">#2016</a>)</li>
<li><a href="f68c03a807"><code>f68c03a</code></a> Recognize trusted iMac CI workers (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2015">#2015</a>)</li>
<li><a href="0414dba3f1"><code>0414dba</code></a> Dashboard: support for buildkite sharding. (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2014">#2014</a>)</li>
<li>See full diff in <a href="53aaadea33...47d1cea8c6">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 4.3.4 to 4.3.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v4.3.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert to <code>@actions/artifact</code> 2.1.8 by <a href="https://github.com/robherley"><code>@robherley</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/594">actions/upload-artifact#594</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4...v4.3.6">https://github.com/actions/upload-artifact/compare/v4...v4.3.6</a></p>
<h2>v4.3.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/artifact</code> to v2.1.9 by <a href="https://github.com/robherley"><code>@robherley</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/588">actions/upload-artifact#588</a>
<ul>
<li>Fixed artifact upload chunk timeout logic <a href="https://redirect.github.com/actions/toolkit/pull/1774">#1774</a></li>
<li>Use lazy stream to prevent issues with open file limits <a href="https://redirect.github.com/actions/toolkit/pull/1771">#1771</a></li>
</ul>
</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.3.4...v4.3.5">https://github.com/actions/upload-artifact/compare/v4.3.4...v4.3.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="834a144ee9"><code>834a144</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/594">#594</a> from actions/robherley/4.3.6</li>
<li><a href="134dcf33c0"><code>134dcf3</code></a> v4.3.6</li>
<li><a href="73a0b9c954"><code>73a0b9c</code></a> revert back to <code>@actions/artifact</code> 2.1.8</li>
<li><a href="89ef406dd8"><code>89ef406</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/588">#588</a> from actions/robherley/4.3.5</li>
<li><a href="23d796df36"><code>23d796d</code></a> license updates</li>
<li><a href="e445c64bc2"><code>e445c64</code></a> bump <code>@actions/artifact</code> to v2.1.9</li>
<li>See full diff in <a href="0b2256b8c0...834a144ee9">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.25.15 to 3.26.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Update default CodeQL bundle version to 2.18.2. <a href="https://redirect.github.com/github/codeql-action/pull/2417">#2417</a></li>
</ul>
<h2>3.26.0 - 06 Aug 2024</h2>
<ul>
<li><em>Deprecation:</em> Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you. <a href="https://redirect.github.com/github/codeql-action/pull/2403">#2403</a></li>
<li>Bump the minimum CodeQL bundle version to 2.13.5. <a href="https://redirect.github.com/github/codeql-action/pull/2408">#2408</a></li>
</ul>
<h2>3.25.15 - 26 Jul 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.18.1. <a href="https://redirect.github.com/github/codeql-action/pull/2385">#2385</a></li>
</ul>
<h2>3.25.14 - 25 Jul 2024</h2>
<ul>
<li>Experimental: add a new <code>start-proxy</code> action which starts the same HTTP proxy as used by <a href="https://github.com/github/dependabot-action"><code>github/dependabot-action</code></a>. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/2376">#2376</a></li>
</ul>
<h2>3.25.13 - 19 Jul 2024</h2>
<ul>
<li>Add <code>codeql-version</code> to outputs. <a href="https://redirect.github.com/github/codeql-action/pull/2368">#2368</a></li>
<li>Add a deprecation warning for customers using CodeQL version 2.13.4 and earlier. These versions of CodeQL were discontinued on 9 July 2024 alongside GitHub Enterprise Server 3.9, and will be unsupported by CodeQL Action versions 3.26.0 and later and versions 2.26.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2375">#2375</a>
<ul>
<li>If you are using one of these versions, please update to CodeQL CLI version 2.13.5 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</li>
<li>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.12.6 and 2.13.4, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.25.13</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.25.13</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</li>
</ul>
</li>
</ul>
<h2>3.25.12 - 12 Jul 2024</h2>
<ul>
<li>Improve the reliability and performance of analyzing code when analyzing a compiled language with the <code>autobuild</code> <a href="https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes">build mode</a> on GitHub Enterprise Server. This feature is already available to GitHub.com users. <a href="https://redirect.github.com/github/codeql-action/pull/2353">#2353</a></li>
<li>Update default CodeQL bundle version to 2.18.0. <a href="https://redirect.github.com/github/codeql-action/pull/2364">#2364</a></li>
</ul>
<h2>3.25.11 - 28 Jun 2024</h2>
<ul>
<li>Avoid failing the workflow run if there is an error while uploading debug artifacts. <a href="https://redirect.github.com/github/codeql-action/pull/2349">#2349</a></li>
<li>Update default CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/2352">#2352</a></li>
</ul>
<h2>3.25.10 - 13 Jun 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.5. <a href="https://redirect.github.com/github/codeql-action/pull/2327">#2327</a></li>
</ul>
<h2>3.25.9 - 12 Jun 2024</h2>
<ul>
<li>Avoid failing database creation if the database folder already exists and contains some unexpected files. Requires CodeQL 2.18.0 or higher. <a href="https://redirect.github.com/github/codeql-action/pull/2330">#2330</a></li>
<li>The init Action will attempt to clean up the database cluster directory before creating a new database and at the end of the job. This will help to avoid issues where the database cluster directory is left in an inconsistent state. <a href="https://redirect.github.com/github/codeql-action/pull/2332">#2332</a></li>
</ul>
<h2>3.25.8 - 04 Jun 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="29d86d22a3"><code>29d86d2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2422">#2422</a> from github/update-v3.26.1-0d5982aa3</li>
<li><a href="5b15b9edeb"><code>5b15b9e</code></a> Revert "Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2417">#2417</a> from github/update-bundle/codeql-bundle-v2.1...</li>
<li><a href="18ac79e766"><code>18ac79e</code></a> Update changelog for v3.26.1</li>
<li><a href="0d5982aa33"><code>0d5982a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2416">#2416</a> from github/henrymercer/ghes-3.14-compat-info</li>
<li><a href="da9ecb0f40"><code>da9ecb0</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2421">#2421</a> from github/henrymercer/log-job-run-uuid</li>
<li><a href="c4c3c4421f"><code>c4c3c44</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2417">#2417</a> from github/update-bundle/codeql-bundle-v2.18.2</li>
<li><a href="41833c77c6"><code>41833c7</code></a> Log job run UUID</li>
<li><a href="d620faa0b4"><code>d620faa</code></a> Bump the npm group with 4 updates (<a href="https://redirect.github.com/github/codeql-action/issues/2419">#2419</a>)</li>
<li><a href="25ad3c8e40"><code>25ad3c8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2418">#2418</a> from github/henrymercer/extraction-time-telemetry</li>
<li><a href="44ecae4896"><code>44ecae4</code></a> Fix matrixing of "submit SARIF after failure" check</li>
<li>Additional commits viewable in <a href="afb54ba388...29d86d22a3">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#23298.
PiperOrigin-RevId: 665743366
Change-Id: I104f9185b81b4906b3318c00ed2ff5098630fb64
This template will help to ensure that all incompatible changes are tracked and communicated to users in a consistent manner.
PiperOrigin-RevId: 653135646
Change-Id: I047cacf4f30df8a4bda8836d19868640dec050e0
Bumps the github-actions group with 4 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.7.1 to 2.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.8.0</h2>
<h2>What's Changed</h2>
<p>Release v2.8.0 by <a href="https://github.com/h0x0er"><code>@h0x0er</code></a> and <a href="https://github.com/varunsh-coder"><code>@varunsh-coder</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/416">step-security/harden-runner#416</a>
This release includes:</p>
<ul>
<li>File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.</li>
<li>Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.</li>
</ul>
<p>These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.8.0">https://github.com/step-security/harden-runner/compare/v2...v2.8.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="f086349bfa"><code>f086349</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/416">#416</a> from step-security/rc-8</li>
<li><a href="b9c325d8ce"><code>b9c325d</code></a> Update image</li>
<li><a href="808a771f66"><code>808a771</code></a> Add info about file and process events</li>
<li><a href="71714298b4"><code>7171429</code></a> Update agent</li>
<li><a href="9ff9d14760"><code>9ff9d14</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/406">#406</a> from step-security/dependabot/github_actions/step-sec...</li>
<li><a href="ac5fa0194e"><code>ac5fa01</code></a> Bump step-security/harden-runner from 2.7.0 to 2.7.1</li>
<li>See full diff in <a href="a4aa98b93c...f086349bfa">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from 41a5b5c2f1a075e7fbab8f6b82e839906139ccc6 to fcd3cdd216acf5b78449ae6c05da1c789f5ef76c
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="fcd3cdd216"><code>fcd3cdd</code></a> Gerrit build: Bump Fedora version to 40 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1959">#1959</a>)</li>
<li><a href="195ca8dd39"><code>195ca8d</code></a> Bump requests from 2.31.0 to 2.32.2 in /actions/update-lockfile (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1958">#1958</a>)</li>
<li><a href="968f5d3d21"><code>968f5d3</code></a> Update lockfiles when PR is merged to a release branch (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1950">#1950</a>)</li>
<li><a href="ada8084556"><code>ada8084</code></a> Shard summary: Show root cause of build failures (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1953">#1953</a>)</li>
<li><a href="9fe262a5dc"><code>9fe262a</code></a> Test shard summary: Include FAILED_TO_BULD targets (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1952">#1952</a>)</li>
<li><a href="061ce4e133"><code>061ce4e</code></a> Add docker image for fedora 40 linux distribution (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1947">#1947</a>)</li>
<li><a href="d92a692d83"><code>d92a692</code></a> Bump requests from 2.31.0 to 2.32.0 in /buildkite/docker/ubuntu1604 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1954">#1954</a>)</li>
<li><a href="57255fdc09"><code>57255fd</code></a> Improve display of available Xcode versions (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1951">#1951</a>)</li>
<li><a href="102c2a75b6"><code>102c2a7</code></a> Update README.md</li>
<li><a href="b9928ed7bb"><code>b9928ed</code></a> update slack invite link again</li>
<li>See full diff in <a href="41a5b5c2f1...fcd3cdd216">compare view</a></li>
</ul>
</details>
<br />
Updates `ossf/scorecard-action` from 2.3.1 to 2.3.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p>
<blockquote>
<h2>v2.3.3</h2>
<blockquote>
<p>[!NOTE]<br />
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag</p>
</blockquote>
<h2>What's Changed</h2>
<ul>
<li>🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1366">ossf/scorecard-action#1366</a></li>
<li>🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1374">ossf/scorecard-action#1374</a></li>
<li>🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1377">ossf/scorecard-action#1377</a></li>
</ul>
<p>For a full changelist of what these include, see the <a href="https://github.com/ossf/scorecard/releases/tag/v5.0.0-rc1">v5.0.0-rc1</a> and <a href="https://github.com/ossf/scorecard/releases/tag/v5.0.0-rc2">v5.0.0-rc2</a> release notes.</p>
<h3>Documentation</h3>
<ul>
<li>📖 Move token discussion out of main README. by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1279">ossf/scorecard-action#1279</a></li>
<li>📖 link to <code>ossf/scorecard</code> workflow instead of maintaining an example by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1352">ossf/scorecard-action#1352</a></li>
<li>📖 update api links to new scorecard.dev site by <a href="https://github.com/spencerschrock"><code>@spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1376">ossf/scorecard-action#1376</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.3.1...v2.3.3">https://github.com/ossf/scorecard-action/compare/v2.3.1...v2.3.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="dc50aa9510"><code>dc50aa9</code></a> 🌱 Bump docker tag for v2.3.3 release (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1368">#1368</a>)</li>
<li><a href="8ff5700173"><code>8ff5700</code></a> 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0....</li>
<li><a href="8ba5e73d11"><code>8ba5e73</code></a> update api links to new scorecard.dev site (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1376">#1376</a>)</li>
<li><a href="92ddde3eaf"><code>92ddde3</code></a> Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1374">#1374</a>)</li>
<li><a href="6c55905542"><code>6c55905</code></a> 🌱 Bump golang.org/x/net from 0.24.0 to 0.25.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1373">#1373</a>)</li>
<li><a href="09bb953b6a"><code>09bb953</code></a> 🌱 Bump distroless/base in the docker-images group (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1372">#1372</a>)</li>
<li><a href="1511e1305b"><code>1511e13</code></a> 🌱 Bump the github-actions group across 1 directory with 6 updates (#...</li>
<li><a href="df66cd8fd8"><code>df66cd8</code></a> 🌱 Bump the docker-images group with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1370">#1370</a>)</li>
<li><a href="fad9a3cc53"><code>fad9a3c</code></a> 🌱 Bump distroless/base in the docker-images group (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1364">#1364</a>)</li>
<li><a href="1e01a309c1"><code>1e01a30</code></a> 🌱 Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1365">#1365</a>)</li>
<li>Additional commits viewable in <a href="0864cf1902...dc50aa9510">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.25.3 to 3.25.7
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.25.7 - 31 May 2024</h2>
<ul>
<li>We are rolling out a feature in May/June 2024 that will reduce the Actions cache usage of the Action by keeping only the newest TRAP cache for each language. <a href="https://redirect.github.com/github/codeql-action/pull/2306">#2306</a></li>
</ul>
<h2>3.25.6 - 20 May 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.3. <a href="https://redirect.github.com/github/codeql-action/pull/2295">#2295</a></li>
</ul>
<h2>3.25.5 - 13 May 2024</h2>
<ul>
<li>Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the <a href="https://github.com/github/codeql-action/blob/main/README.md">https://github.com/github/codeql-action/blob/main/README.md</a>. <a href="https://redirect.github.com/github/codeql-action/pull/2273">#2273</a></li>
<li>Avoid printing out a warning for a missing <code>on.push</code> trigger when the CodeQL Action is triggered via a <code>workflow_call</code> event. <a href="https://redirect.github.com/github/codeql-action/pull/2274">#2274</a></li>
<li>The <code>tools: latest</code> input to the <code>init</code> Action has been renamed to <code>tools: linked</code>. This option specifies that the Action should use the tools shipped at the same time as the Action. The old name will continue to work for backwards compatibility, but we recommend that new workflows use the new name. <a href="https://redirect.github.com/github/codeql-action/pull/2281">#2281</a></li>
</ul>
<h2>3.25.4 - 08 May 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.2. <a href="https://redirect.github.com/github/codeql-action/pull/2270">#2270</a></li>
</ul>
<h2>3.25.3 - 25 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.1. <a href="https://redirect.github.com/github/codeql-action/pull/2247">#2247</a></li>
<li>Workflows running on <code>macos-latest</code> using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as <code>macos-12</code>. ARM machines with SIP disabled, including the newest <code>macos-latest</code> image, are unsupported for CLI versions before 2.15.1. <a href="https://redirect.github.com/github/codeql-action/pull/2261">#2261</a></li>
</ul>
<h2>3.25.2 - 22 Apr 2024</h2>
<p>No user facing changes.</p>
<h2>3.25.1 - 17 Apr 2024</h2>
<ul>
<li>We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the <code>autobuild</code> <a href="https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes">build mode</a>. <a href="https://redirect.github.com/github/codeql-action/pull/2235">#2235</a></li>
<li>Fix a bug where the <code>init</code> Action would fail if <code>--overwrite</code> was specified in <code>CODEQL_ACTION_EXTRA_OPTIONS</code>. <a href="https://redirect.github.com/github/codeql-action/pull/2245">#2245</a></li>
</ul>
<h2>3.25.0 - 15 Apr 2024</h2>
<ul>
<li>
<p>The deprecated feature for extracting dependencies for a Python analysis has been removed. <a href="https://redirect.github.com/github/codeql-action/pull/2224">#2224</a></p>
<p>As a result, the following inputs and environment variables are now ignored:</p>
<ul>
<li>The <code>setup-python-dependencies</code> input to the <code>init</code> Action</li>
<li>The <code>CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION</code> environment variable</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="f079b84933"><code>f079b84</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2317">#2317</a> from github/update-v3.25.7-a095bf2a1</li>
<li><a href="e1a42688db"><code>e1a4268</code></a> Update changelog for v3.25.7</li>
<li><a href="a095bf2a16"><code>a095bf2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2313">#2313</a> from github/revert-2312-update-bundle/codeql-bundle-...</li>
<li><a href="bbd4e19f51"><code>bbd4e19</code></a> Revert "Update default bundle to 2.17.4"</li>
<li><a href="9ab5d16a3d"><code>9ab5d16</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2312">#2312</a> from github/update-bundle/codeql-bundle-v2.17.4</li>
<li><a href="028346e1ff"><code>028346e</code></a> Add changelog note</li>
<li><a href="5fe08473f8"><code>5fe0847</code></a> Update default bundle to codeql-bundle-v2.17.4</li>
<li><a href="9550da953d"><code>9550da9</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2311">#2311</a> from github/henrymercer/pack-missing-auth-config-error</li>
<li><a href="6548a4d65c"><code>6548a4d</code></a> Add configuration error for missing auth to package registry</li>
<li><a href="7927df07e2"><code>7927df0</code></a> Bump micromatch from 4.0.5 to 4.0.7 in the npm group (<a href="https://redirect.github.com/github/codeql-action/issues/2310">#2310</a>)</li>
<li>Additional commits viewable in <a href="d39d31e687...f079b84933">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#22605.
PiperOrigin-RevId: 640172972
Change-Id: Ia9efb1ea38e992dceaa75d8ba9263ab59c0042df
Bumps the github-actions group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.7.0` | `2.7.1` |
| [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) | `35fc1da116a96631f83b45217ceb84e6ccee0106` | `41a5b5c2f1a075e7fbab8f6b82e839906139ccc6` |
| [redhat-plumbers-in-action/advanced-issue-labeler](https://github.com/redhat-plumbers-in-action/advanced-issue-labeler) | `3.0.0` | `3.2.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.1` | `4.3.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.24.10` | `3.25.3` |
Updates `step-security/harden-runner` from 2.7.0 to 2.7.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.7.1</h2>
<h2>What's Changed</h2>
<p>Release v2.7.1 by <a href="https://github.com/varunsh-coder"><code>@varunsh-coder</code></a>, <a href="https://github.com/h0x0er"><code>@h0x0er</code></a>, <a href="https://github.com/ashishkurmi"><code>@ashishkurmi</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/397">step-security/harden-runner#397</a>
This release:</p>
<ul>
<li>Improves the capability to <a href="https://www.stepsecurity.io/blog/monitor-outbound-https-requests-from-github-actions-runners">inspect outbound HTTPS traffic</a> on GitHub-hosted and self-hosted VM runners</li>
<li>Updates README to add link to <a href="https://www.youtube.com/watch?v=Yz72qAOrN9s">case study video</a> on how Harden-Runner detected a supply chain attack on a Google open-source project</li>
<li>Addresses minor bugs</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.7.0...v2.7.1">https://github.com/step-security/harden-runner/compare/v2.7.0...v2.7.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="a4aa98b93c"><code>a4aa98b</code></a> Release v2.7.1 (<a href="https://redirect.github.com/step-security/harden-runner/issues/397">#397</a>)</li>
<li><a href="6c3b1c91e8"><code>6c3b1c9</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/379">#379</a> from step-security/dependabot/github_actions/step-sec...</li>
<li><a href="3498091f2b"><code>3498091</code></a> Bump step-security/harden-runner from 2.6.1 to 2.7.0</li>
<li><a href="63a88e2cd7"><code>63a88e2</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/378">#378</a> from step-security/update-readme3</li>
<li><a href="07e5965e5b"><code>07e5965</code></a> Update README</li>
<li>See full diff in <a href="63c24ba6bd...a4aa98b93c">compare view</a></li>
</ul>
</details>
<br />
Updates `bazelbuild/continuous-integration` from 35fc1da116a96631f83b45217ceb84e6ccee0106 to 41a5b5c2f1a075e7fbab8f6b82e839906139ccc6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="41a5b5c2f1"><code>41a5b5c</code></a> BCR presubmit: check task list is not empty (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1930">#1930</a>)</li>
<li><a href="b4c16485ce"><code>b4c1648</code></a> Use a custom config for bazel in downstream (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1945">#1945</a>)</li>
<li><a href="62f5f73b18"><code>62f5f73</code></a> Create a junction for MSYS2 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1944">#1944</a>)</li>
<li><a href="9f04f3ef19"><code>9f04f3e</code></a> Bump idna from 2.8 to 3.7 in /buildkite/docker/ubuntu1604 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1943">#1943</a>)</li>
<li><a href="7e5367d622"><code>7e5367d</code></a> Enable rules_node in Downstream CI (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1939">#1939</a>)</li>
<li>See full diff in <a href="35fc1da116...41a5b5c2f1">compare view</a></li>
</ul>
</details>
<br />
Updates `redhat-plumbers-in-action/advanced-issue-labeler` from 3.0.0 to 3.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/redhat-plumbers-in-action/advanced-issue-labeler/releases">redhat-plumbers-in-action/advanced-issue-labeler's releases</a>.</em></p>
<blockquote>
<h2>v3.2.0</h2>
<h1>What's Changed</h1>
<h2>New</h2>
<ul>
<li>Add support for labeling based on checkboxes ☑️ (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/342">#342</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Maintenance</h2>
<ul>
<li>Enable GitHub API request throttling 🚄 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/341">#341</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
<li>Refactor and extend test suite 💪🧪 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/280">#280</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Documentation</h2>
<ul>
<li>Document new checkboxes feature 📖 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/343">#343</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
<li>Update list of top projects 🥇 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/340">#340</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Automation and CI changes</h2>
<ul>
<li>Add integration tests 🌟 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/339">#339</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>fix(deps): update dependency <code>@octokit/plugin-throttling</code> to v9.2.1 (main) (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/300">#300</a>) <a href="https://github.com/renovatebot"><code>@renovatebot</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/redhat-plumbers-in-action/advanced-issue-labeler/compare/v3.1.0...v3.2.0">https://github.com/redhat-plumbers-in-action/advanced-issue-labeler/compare/v3.1.0...v3.2.0</a></p>
<h2>v3.1.0</h2>
<h1>What's Changed</h1>
<h2>New</h2>
<ul>
<li>Provide some useful outputs; <code>labels</code>, <code>policy</code> 📤 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/336">#336</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Maintenance</h2>
<ul>
<li>build: update dependencies & migrate to ESM & remove ESlint 😯 (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/334">#334</a>) <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Documentation</h2>
<ul>
<li>Update GitHub markdown notices to supported version (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/338">#338</a>) 💄 <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Automation and CI changes</h2>
<ul>
<li>ci: test only Node 20 & pass token to codecov (<a href="https://redirect.github.com/redhat-plumbers-in-action/advanced-issue-labeler/issues/337">#337</a>) ⛑️ <a href="https://github.com/jamacku"><code>@jamacku</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="d498805e5c"><code>d498805</code></a> doc: document new checkboxes feature</li>
<li><a href="824aa5fc2d"><code>824aa5f</code></a> feat: add support for checkboxes in issue form</li>
<li><a href="3cba48bb98"><code>3cba48b</code></a> doc: remove trailing whitespace</li>
<li><a href="718272b8ff"><code>718272b</code></a> test: update block-list testing</li>
<li><a href="5d343eade0"><code>5d343ea</code></a> fix(deps): update dependency <code>@octokit/plugin-throttling</code> to v9.2.1</li>
<li><a href="c2023ebb4c"><code>c2023eb</code></a> feat: enable GitHub API request throttling</li>
<li><a href="92e9f9ea39"><code>92e9f9e</code></a> doc: update list of top projects</li>
<li><a href="875ecbafde"><code>875ecba</code></a> test: add integration tests</li>
<li><a href="3df0d0f8ee"><code>3df0d0f</code></a> refactor(test): add labeler.ts tests</li>
<li><a href="e09680ee5c"><code>e09680e</code></a> refactor(test): add issue-form.ts tests</li>
<li>Additional commits viewable in <a href="9e55064634...d498805e5c">compare view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 4.3.1 to 4.3.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v4.3.3</h2>
<h2>What's Changed</h2>
<ul>
<li>updating <code>@actions/artifact</code> dependency to v2.1.6 by <a href="https://github.com/eggyhead"><code>@eggyhead</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/565">actions/upload-artifact#565</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.3.2...v4.3.3">https://github.com/actions/upload-artifact/compare/v4.3.2...v4.3.3</a></p>
<h2>v4.3.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Update release-new-action-version.yml by <a href="https://github.com/konradpabjan"><code>@konradpabjan</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/516">actions/upload-artifact#516</a></li>
<li>Minor fix to the migration readme by <a href="https://github.com/andrewakim"><code>@andrewakim</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/523">actions/upload-artifact#523</a></li>
<li>Update readme with v3/v2/v1 deprecation notice by <a href="https://github.com/robherley"><code>@robherley</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/561">actions/upload-artifact#561</a></li>
<li>updating <code>@actions/artifact</code> dependency to v2.1.5 and <code>@actions/core</code> to v1.0.1 by <a href="https://github.com/eggyhead"><code>@eggyhead</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/562">actions/upload-artifact#562</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/andrewakim"><code>@andrewakim</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/523">actions/upload-artifact#523</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2">https://github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="65462800fd"><code>6546280</code></a> updating package version</li>
<li><a href="c004fb4bf6"><code>c004fb4</code></a> Merge branch 'main' into eggyhead/use-artifact-v2.1.6</li>
<li><a href="90aba496fc"><code>90aba49</code></a> updating toolkit artifact dependency to 2.1.6</li>
<li><a href="b06cde36fc"><code>b06cde3</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/563">#563</a> from actions/eggyhead/release-4.3.2</li>
<li><a href="1746f4ab65"><code>1746f4a</code></a> Revert "updating to release 4.3.2"</li>
<li><a href="31685d04a0"><code>31685d0</code></a> updating to release 4.3.2</li>
<li><a href="18bf333cd2"><code>18bf333</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/562">#562</a> from actions/eggyhead/update-artifact-v215</li>
<li><a href="dac413befa"><code>dac413b</code></a> update package lock version</li>
<li><a href="bb3b4a3cdb"><code>bb3b4a3</code></a> updating package version</li>
<li><a href="3e3da837d2"><code>3e3da83</code></a> updating artifact and core dependencies</li>
<li>Additional commits viewable in <a href="5d5d22a312...65462800fd">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.24.10 to 3.25.3
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.25.3 - 25 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.1. <a href="https://redirect.github.com/github/codeql-action/pull/2247">#2247</a></li>
<li>Workflows running on <code>macos-latest</code> using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as <code>macos-12</code>. ARM machines with SIP disabled, including the newest <code>macos-latest</code> image, are unsupported for CLI versions before 2.15.1. <a href="https://redirect.github.com/github/codeql-action/pull/2261">#2261</a></li>
</ul>
<h2>3.25.2 - 22 Apr 2024</h2>
<p>No user facing changes.</p>
<h2>3.25.1 - 17 Apr 2024</h2>
<ul>
<li>We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the <code>autobuild</code> <a href="https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes">build mode</a>. <a href="https://redirect.github.com/github/codeql-action/pull/2235">#2235</a></li>
<li>Fix a bug where the <code>init</code> Action would fail if <code>--overwrite</code> was specified in <code>CODEQL_ACTION_EXTRA_OPTIONS</code>. <a href="https://redirect.github.com/github/codeql-action/pull/2245">#2245</a></li>
</ul>
<h2>3.25.0 - 15 Apr 2024</h2>
<ul>
<li>
<p>The deprecated feature for extracting dependencies for a Python analysis has been removed. <a href="https://redirect.github.com/github/codeql-action/pull/2224">#2224</a></p>
<p>As a result, the following inputs and environment variables are now ignored:</p>
<ul>
<li>The <code>setup-python-dependencies</code> input to the <code>init</code> Action</li>
<li>The <code>CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION</code> environment variable</li>
</ul>
<p>We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.</p>
</li>
<li>
<p>Automatically overwrite an existing database if found on the filesystem. <a href="https://redirect.github.com/github/codeql-action/pull/2229">#2229</a></p>
</li>
<li>
<p>Bump the minimum CodeQL bundle version to 2.12.6. <a href="https://redirect.github.com/github/codeql-action/pull/2232">#2232</a></p>
</li>
<li>
<p>A more relevant log message and a diagnostic are now emitted when the <code>file</code> program is not installed on a Linux runner, but is required for Go tracing to succeed. <a href="https://redirect.github.com/github/codeql-action/pull/2234">#2234</a></p>
</li>
</ul>
<h2>3.24.10 - 05 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.0. <a href="https://redirect.github.com/github/codeql-action/pull/2219">#2219</a></li>
<li>Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2220">#2220</a>
<ul>
<li>If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</li>
<li>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.24.10</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.24.10</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</li>
</ul>
</li>
</ul>
<h2>3.24.9 - 22 Mar 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.16.5. <a href="https://redirect.github.com/github/codeql-action/pull/2203">#2203</a></li>
</ul>
<h2>3.24.8 - 18 Mar 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="d39d31e687"><code>d39d31e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2262">#2262</a> from github/update-v3.25.3-ac2f82a1f</li>
<li><a href="a7278252c7"><code>a727825</code></a> Move changenote to most recent section</li>
<li><a href="1efa8597b1"><code>1efa859</code></a> Update changelog for v3.25.3</li>
<li><a href="ac2f82a1ff"><code>ac2f82a</code></a> Log warning if SIP is disabled and CLI version is < 2.15.1 (<a href="https://redirect.github.com/github/codeql-action/issues/2261">#2261</a>)</li>
<li><a href="0ad7791640"><code>0ad7791</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2247">#2247</a> from github/update-bundle/codeql-bundle-v2.17.1</li>
<li><a href="79d9ee7f07"><code>79d9ee7</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.17.1</li>
<li><a href="dbf2b1706b"><code>dbf2b17</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2255">#2255</a> from github/mergeback/v3.25.2-to-main-8f596b4a</li>
<li><a href="ff6a3c42a5"><code>ff6a3c4</code></a> Update checked-in dependencies</li>
<li><a href="619dc0c4b8"><code>619dc0c</code></a> Update changelog and version after v3.25.2</li>
<li><a href="8f596b4ae3"><code>8f596b4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2254">#2254</a> from github/update-v3.25.2-4909c1ffb</li>
<li>Additional commits viewable in <a href="4355270be1...d39d31e687">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#22205.
PiperOrigin-RevId: 638179503
Change-Id: If8b4d64d50d5073ceff6f58090952c44094e61a5
Updates the requirements on [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) and [github/codeql-action](https://github.com/github/codeql-action) to permit the latest version.
Updates `bazelbuild/continuous-integration` to 35fc1da116a96631f83b45217ceb84e6ccee0106
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="35fc1da116">compare view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.24.6 to 3.24.10
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Automatically overwrite an existing database if found on the filesystem. <a href="https://redirect.github.com/github/codeql-action/pull/2229">#2229</a></li>
</ul>
<h2>3.24.10 - 05 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.0. <a href="https://redirect.github.com/github/codeql-action/pull/2219">#2219</a></li>
<li>Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. <a href="https://redirect.github.com/github/codeql-action/pull/2220">#2220</a>
<ul>
<li>If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.</li>
<li>Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace <code>github/codeql-action/*@v3</code> by <code>github/codeql-action/*@v3.24.10</code> and <code>github/codeql-action/*@v2</code> by <code>github/codeql-action/*@v2.24.10</code> in your code scanning workflow to ensure you continue using this version of the CodeQL Action.</li>
</ul>
</li>
</ul>
<h2>3.24.9 - 22 Mar 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.16.5. <a href="https://redirect.github.com/github/codeql-action/pull/2203">#2203</a></li>
</ul>
<h2>3.24.8 - 18 Mar 2024</h2>
<ul>
<li>Improve the ease of debugging extraction issues by increasing the verbosity of the extractor logs when running in debug mode. <a href="https://redirect.github.com/github/codeql-action/pull/2195">#2195</a></li>
</ul>
<h2>3.24.7 - 12 Mar 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.16.4. <a href="https://redirect.github.com/github/codeql-action/pull/2185">#2185</a></li>
</ul>
<h2>3.24.6 - 29 Feb 2024</h2>
<p>No user facing changes.</p>
<h2>3.24.5 - 23 Feb 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.16.3. <a href="https://redirect.github.com/github/codeql-action/pull/2156">#2156</a></li>
</ul>
<h2>3.24.4 - 21 Feb 2024</h2>
<ul>
<li>Fix an issue where an existing, but empty, <code>/sys/fs/cgroup/cpuset.cpus</code> file always resulted in a single-threaded run. <a href="https://redirect.github.com/github/codeql-action/pull/2151">#2151</a></li>
</ul>
<h2>3.24.3 - 15 Feb 2024</h2>
<ul>
<li>Fix an issue where the CodeQL Action would fail to load a configuration specified by the <code>config</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/2147">#2147</a></li>
</ul>
<h2>3.24.2 - 15 Feb 2024</h2>
<ul>
<li>Enable improved multi-threaded performance on larger runners for GitHub Enterprise Server users. This feature is already available to GitHub.com users. <a href="https://redirect.github.com/github/codeql-action/pull/2141">#2141</a></li>
</ul>
<h2>3.24.1 - 13 Feb 2024</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="4355270be1"><code>4355270</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2226">#2226</a> from github/update-v3.24.10-7df281f2f</li>
<li><a href="3f041c51a5"><code>3f041c5</code></a> Update changelog for v3.24.10</li>
<li><a href="7df281f2fe"><code>7df281f</code></a> Gracefully continue if <code>createStatusReportBase</code> throws (<a href="https://redirect.github.com/github/codeql-action/issues/2225">#2225</a>)</li>
<li><a href="f421cda8e7"><code>f421cda</code></a> Run integration test PR checks nightly (<a href="https://redirect.github.com/github/codeql-action/issues/2222">#2222</a>)</li>
<li><a href="5f535debfe"><code>5f535de</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2221">#2221</a> from github/nickfyson/upload-logging</li>
<li><a href="278465cdfb"><code>278465c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2219">#2219</a> from github/update-bundle/codeql-bundle-v2.17.0</li>
<li><a href="65e69c8a4b"><code>65e69c8</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.17.0</li>
<li><a href="c037115ddf"><code>c037115</code></a> clarify logging in response to pr review comments</li>
<li><a href="d3c32a84cb"><code>d3c32a8</code></a> fix test to respect updated logging behaviour</li>
<li><a href="26540626a5"><code>2654062</code></a> Merge branch 'main' into nickfyson/upload-logging</li>
<li>Additional commits viewable in <a href="8a470fddaf...4355270be1">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
Closes#21934.
PiperOrigin-RevId: 625612034
Change-Id: I2624ee9aab9f2a11de16fbb4a78f548470bc7003
deepalak56
pcloudy
Googler
dependabot[bot]
Ben Knutson
Alex Eagle
Googler