Bump the minimum supported version of CodeQL to 2.15.5 #2655

aeisenberg · 2024-12-16T23:02:05Z

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Confirm the readme has been updated if necessary.
Confirm the changelog has been updated if necessary.

Copilot reviewed 7 out of 13 changed files in this pull request and generated no comments.

Files not reviewed (6)

package.json: Language not supported
pr-checks/sync.py: Evaluated as low risk
.github/workflows/debug-artifacts.yml: Evaluated as low risk
src/codeql.ts: Evaluated as low risk
.github/workflows/__go-tracing-autobuilder.yml: Evaluated as low risk
.github/workflows/__go-tracing-custom-build-steps.yml: Evaluated as low risk

Comments suppressed due to low confidence (1)

.github/workflows/__multi-language-autodetect.yml:91

The conditional logic here is incorrect. It should include macOS as well, otherwise it will exclude languages for macOS runners.

languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

aeisenberg · 2024-12-16T23:58:39Z

@mbg, there are three workflows that are failing now that I'm deprecating 2.14.6. It looks like you created these workflows and hard-coded 2.14.6. Is there another, non-deprecated version we can use? Is it the case that now that 2.14.6 is deprecated, we can remove the workaround?

mbg · 2024-12-17T00:12:40Z

I think intention with pinning that version was that we would fix/improve the tracer not long after, and so would no longer need the workaround then. However, that never happened, so the workaround is still needed to this day (AFAIK). That means we can either:

Bump the pinned version to the current version (or any other non-deprecated one)
Not pin it to a specific version, and then pin it to one once the tracer can deal with statically linked binaries

aeisenberg · 2024-12-17T00:21:28Z

OK. Thanks. I'll pin it to 2.20.0.

aeisenberg · 2024-12-17T02:09:51Z

Actually, if I pin to default and the workaround is implemented, then we will see a test failure more quickly and will be reminded to change or remove the tests. I changed to that.

zutshisunakshi · 2024-12-17T17:23:33Z

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -28,7 +28,7 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
-            version: stable-v2.14.6
+            version: default


Why does this not update as stable-v2.19.4 like files below ? Diff in files .github/workflows/__go-tracing-autobuilder.yml and beyond do not mention default as version. Not sure if this is just setup differently for different workflows.

maybe your comment here is linked to my Q -- but I am not sure I fully understand the reasoning though. Do we follow some guide/playbook for these upgrades?

Yes. These tests are for a particular workaround in the CLI and action for indirect tracing of go code. I'm actually not sure what this is. It's something that @mbg implemented. It's testing that if we're using a version of go that supports statically linked binaries, we can still build a database even though the CodeQL go tracer does not support statically linked binaries. If we ever do implement this in the go tracer, then these tests will start to fail.

I moved from a fixed version to default so that we won't need to update these tests again in the future.

We only need to test a single version since this is a mechanism that is in the action, and independent of the codeql version.

Look at the "Deprecating a CodeQL version" section of CONTRIBUTING.md for more information around how this deprecation works.

Versions for the other workflows are handled by the sync.py script.

zutshisunakshi · 2024-12-17T17:23:56Z

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -28,7 +28,7 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
-            version: stable-v2.14.6
+            version: default


same comment as above

zutshisunakshi · 2024-12-17T17:23:58Z

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -28,7 +28,7 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
-            version: stable-v2.14.6
+            version: default


same comment as above

zutshisunakshi · 2024-12-17T17:25:13Z

README.md


-CodeQL Action v2 will stop receiving updates when GHES 3.11 is deprecated.
+CodeQL Action v2 has stopped receiving updates now that GHES 3.11 is deprecated.


Does this need to be part of changelog update?

I jumped the gun on this change by just a little since v2 is not yet officially deprecated. This is something @angelapwen will be working on shortly. GHES 3.11 is getting deprecated on December 19.

I made the change since I thought it would be confusing to remove the line about GFHES 3.11 and keep the line about v2 unchanged.

The last update to the v2 branch should only go in the v2 branch, so I won't put it the changelog on the main branch.

angelapwen

Looks fine to me, but we want to make sure that we don't merge before Dec 19, right?

aeisenberg · 2024-12-17T23:15:25Z

I will make a release on December 19. It's probably fine to merge this PR before then.

angelapwen

:merge-it:

Copilot bot review requested due to automatic review settings December 16, 2024 23:02

aeisenberg requested a review from a team as a code owner December 16, 2024 23:02

Copilot AI reviewed Dec 16, 2024

View reviewed changes

Bump the minimum supported version of CodeQL to 2.15.5

5f0a4d3

aeisenberg force-pushed the aeisenberg/deprecate-2.14 branch from c441453 to 5f0a4d3 Compare December 16, 2024 23:40

Change codeql version used in test

beed6ff

aeisenberg force-pushed the aeisenberg/deprecate-2.14 branch from 14348c5 to beed6ff Compare December 17, 2024 02:08

zutshisunakshi reviewed Dec 17, 2024

View reviewed changes

aeisenberg enabled auto-merge December 17, 2024 23:03

angelapwen reviewed Dec 17, 2024

View reviewed changes

angelapwen approved these changes Dec 17, 2024

View reviewed changes

aeisenberg merged commit 562042d into main Dec 17, 2024
269 checks passed

aeisenberg deleted the aeisenberg/deprecate-2.14 branch December 17, 2024 23:18

angelapwen mentioned this pull request Dec 19, 2024

build(deps-dev): bump the npm group with 3 updates #2653

Merged

This was referenced Dec 20, 2024

Merge main into releases/v3 #2662

Merged

Merge releases/v3 into releases/v2 #2664

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the minimum supported version of CodeQL to 2.15.5 #2655

Bump the minimum supported version of CodeQL to 2.15.5 #2655

aeisenberg commented Dec 16, 2024

aeisenberg commented Dec 16, 2024

mbg commented Dec 17, 2024

aeisenberg commented Dec 17, 2024

aeisenberg commented Dec 17, 2024

zutshisunakshi Dec 17, 2024

zutshisunakshi Dec 17, 2024

aeisenberg Dec 17, 2024

aeisenberg Dec 17, 2024

zutshisunakshi Dec 17, 2024

zutshisunakshi Dec 17, 2024

zutshisunakshi Dec 17, 2024

aeisenberg Dec 17, 2024

angelapwen left a comment

aeisenberg commented Dec 17, 2024

angelapwen left a comment


		CodeQL Action v2 will stop receiving updates when GHES 3.11 is deprecated.
		CodeQL Action v2 has stopped receiving updates now that GHES 3.11 is deprecated.

Bump the minimum supported version of CodeQL to 2.15.5 #2655

Bump the minimum supported version of CodeQL to 2.15.5 #2655

Conversation

aeisenberg commented Dec 16, 2024

Merge / deployment checklist

Choose a reason for hiding this comment

aeisenberg commented Dec 16, 2024

mbg commented Dec 17, 2024

aeisenberg commented Dec 17, 2024

aeisenberg commented Dec 17, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

angelapwen left a comment

Choose a reason for hiding this comment

aeisenberg commented Dec 17, 2024

angelapwen left a comment

Choose a reason for hiding this comment