Skip to content

Fix CI with standard macOS runners and update brace-expansion - #4320

Open
beer-sakthai wants to merge 17 commits into
github:mainfrom
beer-sakthai:main
Open

Fix CI with standard macOS runners and update brace-expansion#4320
beer-sakthai wants to merge 17 commits into
github:mainfrom
beer-sakthai:main

Conversation

@beer-sakthai

@beer-sakthai beer-sakthai commented Nov 11, 2026

Copy link
Copy Markdown

Risk assessment

For internal use only. Please select the risk level of this change:

  • Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
  • High risk: Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

Which use cases does this change impact?

Workflow types:

  • Advanced setup - Impacts users who have custom CodeQL workflows.
  • Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

  • Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
  • Code Quality - The changes impact analyses when analysis-kinds: code-quality.
  • Other first-party - The changes impact other first-party analyses.
  • Third-party analyses - The changes affect the upload-sarif action.

Environments:

  • Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
  • GHES - Impacts CodeQL workflows on GitHub Enterprise Server.
  • Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

  • Test repository - This change will be tested on a test repository before merging.
  • Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
  • End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).
  • Other - Please provide details.
  • None - I am not validating these changes.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

  • Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
  • Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.
  • Development/testing only - This change cannot cause any failures in production.
  • Other - Please provide details.

How will you know if something goes wrong after this change is released?

  • Telemetry - I rely on existing telemetry or have made changes to the telemetry.
    • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
    • Alerts - New or existing monitors will trip if something goes wrong with this change.
  • Other - Please provide details.

Are there any special considerations for merging or releasing this change?

  • No special considerations - This change can be merged at any time.
  • Special considerations - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Consider adding a changelog entry for this change.
  • Confirm the readme and docs have been updated if necessary.

beer-sakthai and others added 6 commits September 23, 2026 18:04
@beer-sakthai
Merge pull request #5 from beer-sakthai/claude/branch-commit-merge-ma…
9eeb533 
…in-n5m9pm

Sync main with upstream github/codeql-action
@claude
Use standard macOS runners instead of larger (xlarge) runners
c8f0270 
The `*-xlarge` macOS runners are GitHub larger runners that are not
available to this fork, so every job targeting them failed without
starting. Switch to the standard hosted equivalents (macos-latest,
macos-15, macos-14) in the PR-check sources and codeql.yml, and
regenerate the PR-check workflows with pr-checks/sync.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6REV1f9XMQdyBtTufzb8e
@claude
Only upload CodeQL self-analysis results from the upstream repository
26a58bc 
This fork has CodeQL default setup enabled, which rejects SARIF from
advanced configurations, so the `analyze-javascript (ubuntu-24.04)` and
`analyze-other` jobs failed at upload. Default setup already scans this
repository, so keep running the analyses but only upload when running
in github/codeql-action.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6REV1f9XMQdyBtTufzb8e
@beer-sakthai
Merge pull request #6 from beer-sakthai/claude/branch-commit-merge-ma…
84f4a46 
…in-n5m9pm

Fix fork CI: standard macOS runners and skip self-analysis uploads
@dependabot
Bump brace-expansion
d5bb663 
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 1.1.18 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@beer-sakthai
Merge pull request #7 from beer-sakthai/dependabot/npm_and_yarn/npm_a…
224dc51 
…nd_yarn-cb24140fdc

Bump brace-expansion from 1.1.18 to 1.1.21 in the npm_and_yarn group across 1 directory
@beer-sakthai
beer-sakthai requested a review from a team as a code owner November 11, 2026 21:37
Copilot AI auto review requested due to automatic review settings November 11, 2026 21:37
Copilot AI reviewed Nov 11, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The CodeQL workflow’s repository check still allows fork pull requests to attempt SARIF uploads with a fork-restricted token, so the guard needs to be corrected to include the pull request’s source repository.

1 open issue
What changed in this PR

Updates CI to use standard macOS GitHub-hosted runners, synchronizes generated workflows, refreshes transitive brace-expansion dependencies, and adjusts CodeQL SARIF upload conditions.

Changes:

  • Replaced macOS xlarge runner labels with standard macos-14, macos-15, and macos-latest labels.
  • Updated the Xcode 16 selection condition for the macOS 15 runner.
  • Refreshed brace-expansion entries and integrity metadata in the lockfile.
  • Added a canonical-repository guard around CodeQL SARIF uploads.
File Description
pr-checks/​checks/​swift-custom-build.yml Uses the standard macOS runner for Swift custom-build checks.
pr-checks/​checks/​swift-autobuild.yml Uses the standard macOS runner for Swift autobuild checks.
pr-checks/​checks/​per-language-bundle-validation.yml Uses the standard macOS runner for Swift bundle validation.
pr-checks/​checks/​multi-language-autodetect.yml Updates macOS runner labels and the Xcode 16 selection condition.
pr-checks/​checks/​all-platform-bundle.yml Uses the standard macOS runner for all-platform bundle checks.
package-lock.json Refreshes transitive brace-expansion package versions and integrity metadata.
.github/​workflows/​codeql.yml Updates the macOS analysis matrix and CodeQL SARIF upload condition.
.github/​workflows/​__swift-custom-build.yml Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__swift-autobuild.yml Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__per-language-bundle-validation.yml Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__multi-language-autodetect.yml Synchronizes the generated workflow with the runner and Xcode selection updates.
.github/​workflows/​__all-platform-bundle.yml Synchronizes the generated workflow with the standard macOS runner change.

Review effort: Lite (auto)

Comment thread .github/workflows/codeql.yml Resolved
beer-sakthai
beer-sakthai commented Nov 11, 2026
View reviewed changes

@beer-sakthai beer-sakthai left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. Before release, please ensure the stated risk level matches the production code paths affected, appropriate validation has been completed, and rollback/monitoring coverage is in place. Also confirm backwards compatibility and whether a changelog or documentation update is required.

@beer-sakthai
Enhance security policy with detailed guidelines
4afab37 
Expanded the security policy to include detailed reporting methods, security scope, response processes, and guidelines for responsible disclosure.
@beer-sakthai
beer-sakthai requested an auto review from Copilot November 12, 2026 08:23
@beer-sakthai

beer-sakthai commented Nov 12, 2026

Copy link
Copy Markdown
Author

🟡 Changes recommended

The CodeQL workflow’s repository check still allows fork pull requests to attempt SARIF uploads with a fork-restricted token, so the guard needs to be corrected to include the pull request’s source repository.

1 open issue

What changed in this PR
Updates CI to use standard macOS GitHub-hosted runners, synchronizes generated workflows, refreshes transitive brace-expansion dependencies, and adjusts CodeQL SARIF upload conditions.

Changes:

  • Replaced macOS xlarge runner labels with standard macos-14, macos-15, and macos-latest labels.
  • Updated the Xcode 16 selection condition for the macOS 15 runner.
  • Refreshed brace-expansion entries and integrity metadata in the lockfile.
  • Added a canonical-repository guard around CodeQL SARIF uploads.

File Description
pr-checks/​checks/​swift-custom-build.yml Uses the standard macOS runner for Swift custom-build checks.
pr-checks/​checks/​swift-autobuild.yml Uses the standard macOS runner for Swift autobuild checks.
pr-checks/​checks/​per-language-bundle-validation.yml Uses the standard macOS runner for Swift bundle validation.
pr-checks/​checks/​multi-language-autodetect.yml Updates macOS runner labels and the Xcode 16 selection condition.
pr-checks/​checks/​all-platform-bundle.yml Uses the standard macOS runner for all-platform bundle checks.
package-lock.json Refreshes transitive brace-expansion package versions and integrity metadata.
.github/​workflows/​codeql.yml Updates the macOS analysis matrix and CodeQL SARIF upload condition.
.github/​workflows/​__swift-custom-build.yml Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__swift-autobuild.yml Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__per-language-bundle-validation.yml Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__multi-language-autodetect.yml Synchronizes the generated workflow with the runner and Xcode selection updates.
.github/​workflows/​__all-platform-bundle.yml Synchronizes the generated workflow with the standard macOS runner change.
Review effort: Lite (auto)

@beer-sakthai
beer-sakthai marked this pull request as draft November 12, 2026 08:25
Copilot AI reviewed Nov 12, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The change contains active critical malformed-YAML issues in the CodeQL workflow, along with additional duplicate-key problems that can invalidate or silently drop intended macOS checks and leave the published security contact unusable.

9 open issues
1 resolved since last review

Review effort: Lite (auto)

Comment thread .github/workflows/codeql.yml Resolved
Comment thread .github/workflows/codeql.yml Resolved
Comment thread SECURITY.md Resolved
Comment thread pr-checks/checks/all-platform-bundle.yml Resolved
Comment thread pr-checks/checks/multi-language-autodetect.yml Resolved
Comment thread pr-checks/checks/per-language-bundle-validation.yml Resolved
Comment thread pr-checks/checks/swift-autobuild.yml Resolved
Comment thread pr-checks/checks/swift-custom-build.yml Resolved
Comment thread pr-checks/checks/swift-custom-build.yml Resolved
beer-sakthai
beer-sakthai commented Nov 12, 2026
View reviewed changes

@beer-sakthai beer-sakthai left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good overall. No blocking issues from my review. CI checks should confirm everything.

@beer-sakthai
Update OS matrix in CodeQL workflow
0d3f9cf 
Removed unsupported OS versions from the matrix.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@beer-sakthai
beer-sakthai marked this pull request as ready for review November 12, 2026 08:30
dependabot Bot and others added 8 commits November 12, 2026 10:23
@dependabot
Bump the npm-minor group across 1 directory with 8 updates
10cfcbb 
Bumps the npm-minor group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) | `0.5.1` | `0.7.0` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.1` | `1.16.2` |
| [node-forge](https://github.com/digitalbazaar/forge) | `1.4.1` | `1.4.3` |
| [semver](https://github.com/npm/node-semver) | `7.8.5` | `7.8.6` |
| [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon) | `22.0.1` | `22.0.2` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `65.4.0` | `65.4.3` |
| [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.72.0` | `8.72.1` |



Updates `@actions/glob` from 0.5.1 to 0.7.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob)

Updates `follow-redirects` from 1.16.1 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.1...v1.16.2)

Updates `node-forge` from 1.4.1 to 1.4.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.4.1...v1.4.3)

Updates `semver` from 7.8.5 to 7.8.6
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.5...v7.8.6)

Updates `@types/sinon` from 22.0.1 to 22.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon)

Updates `eslint-plugin-jsdoc` from 65.4.0 to 65.4.3
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v65.4.0...v65.4.3)

Updates `globals` from 17.13.0 to 17.14.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.13.0...v17.14.0)

Updates `typescript-eslint` from 8.72.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@actions/glob"
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: node-forge
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: semver
  dependency-version: 7.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: "@types/sinon"
  dependency-version: 22.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 65.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: globals
  dependency-version: 17.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump ava from 6.4.1 to 8.3.0
b78df19 
Bumps [ava](https://github.com/avajs/ava) from 6.4.1 to 8.3.0.
- [Release notes](https://github.com/avajs/ava/releases)
- [Commits](avajs/ava@v6.4.1...v8.3.0)

---
updated-dependencies:
- dependency-name: ava
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump @actions/http-client from 3.0.2 to 4.0.1
a8a8f94 
Bumps [@actions/http-client](https://github.com/actions/toolkit/tree/HEAD/packages/http-client) from 3.0.2 to 4.0.1.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/http-client/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/http-client)

---
updated-dependencies:
- dependency-name: "@actions/http-client"
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@beer-sakthai
Merge pull request #8 from beer-sakthai/dependabot/npm_and_yarn/npm-m…
0535b0e 
…inor-77e50b00c1

Bump the npm-minor group across 1 directory with 8 updates
@beer-sakthai
Merge branch 'main' into dependabot/npm_and_yarn/ava-8.3.0
1af68df
@beer-sakthai
Merge pull request #9 from beer-sakthai/dependabot/npm_and_yarn/ava-8…
bad77bc 
….3.0

Bump ava from 6.4.1 to 8.3.0
@beer-sakthai
Merge branch 'main' into dependabot/npm_and_yarn/actions/http-client-…
752bc5f 
…4.0.1
@beer-sakthai
Merge pull request #10 from beer-sakthai/dependabot/npm_and_yarn/acti…
524612e 
…ons/http-client-4.0.1

Bump @actions/http-client from 3.0.2 to 4.0.1

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@beer-sakthai @claude