René's URL Explorer Experiment


Title: Maintain action versions by workflow in `sync-back.ts` by mbg · Pull Request #4292 · github/codeql-action · GitHub

Open Graph Title: Maintain action versions by workflow in `sync-back.ts` by mbg · Pull Request #4292 · github/codeql-action

X Title: Maintain action versions by workflow in `sync-back.ts` by mbg · Pull Request #4292 · github/codeql-action

Description: On main, we currently have a workflow generated from pr-checks/checks that uses an older version of actions/download-artifact than other workflows in the repo. This likely happened because the PR which introduced the relevant workflow (unsupported-macos.yml) was worked on while a Dependabot PR which updated actions/download-artifact was merged. Consequently, the version of actions/download-artifact used on the PR branch fell behind. When this was subsequently merged, the versions of actions/download-artifact on main become inconsistent. This is generally not a problem and will be rectified by Dependabot next time it runs, with the exception of the sync-back.ts script that's run as part of the "Rebuild" workflow. It incorrectly assumes that all versions of actions in the repo are always consistent because it only expects to run on Dependabot PRs where all versions of a given action have been aligned. This is not the case if the inconsistency exists on main and Dependabot is not updating the relevant action. See e.g. #4289 which bumps a JS dependency, but ends up with workflow changes because of the inconsistency on main and the broken assumption in sync-back.ts. This PR modifies sync-back.ts so that versions are tracked by workflow and only the versions found for a given generated workflow file are written to the corresponding specification. For the version written to sync.ts, we arbitrarily pick one if there are multiple (similar to the previous behaviour, although it may not be the same arbitrary one) and emit a warning. Alternatives considered Ideally, we'd not end up with inconsistencies on main in the first place, but that would require us to validate that all used actions have the same version in e.g. a merge commit for main before actually merging it or otherwise compare the versions to those on main in the merge queue. Since it's not fundamentally a problem, rarely happens, and will automatically be resolved by Dependabot after a week or so, I think the solution implemented here is acceptable however. Risk assessment For internal use only. Please select the risk level of this change: Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only. Which use cases does this change impact? Environments: Testing/None - This change does not impact any CodeQL workflows in production. How did/will you validate this change? Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files). Other - Please provide details. Tested locally. If something goes wrong after this change is released, what are the mitigation and rollback strategies? Development/testing only - This change cannot cause any failures in production. Are there any special considerations for merging or releasing this change? No special considerations - This change can be merged at any time. Merge / deployment checklist Confirm this change is backwards compatible with existing workflows. Consider adding a changelog entry for this change. Confirm the readme and docs have been updated if necessary.

Open Graph Description: On main, we currently have a workflow generated from pr-checks/checks that uses an older version of actions/download-artifact than other workflows in the repo. This likely happened because the PR w...

X Description: On main, we currently have a workflow generated from pr-checks/checks that uses an older version of actions/download-artifact than other workflows in the repo. This likely happened because the PR w...

Opengraph URL: https://github.com/github/codeql-action/pull/4292

X: @github

direct link

Domain: github.com

react-profiling0
react-import-mapreact,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf
route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:873d2e69-91f1-037c-fc23-ed5152d1d5b8
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-id9516:219BB2:52169B:6E936F:6AED539B
html-safe-noncef4b691fe92fcaafbdbd59cdf37da5bff9b33aa26cdfdddbd3121bf06c62e6c85
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5NTE2OjIxOUJCMjo1MjE2OUI6NkU5MzZGOjZBRUQ1MzlCIiwidmlzaXRvcl9pZCI6IjgzMTQ4NjE5NjU5MTc2Mzk1NzkiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmac8c597bc26bf9e97c042000cd32e61c177ceb0e585949bc8449002e2164307f86
hovercard-subject-tagpull_request:5137299829
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql-action/pull/4292/files
twitter:imagehttps://avatars.githubusercontent.com/u/278086?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/278086?s=400&v=4
og:image:altOn main, we currently have a workflow generated from pr-checks/checks that uses an older version of actions/download-artifact than other workflows in the repo. This likely happened because the PR w...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None56fb42677ae87ed3e64410323d67980aa65d0485568a7858f874e7edfc6d1c11
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql-action git https://github.com/github/codeql-action.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id259445878
octolytics-dimension-repository_nwogithub/codeql-action
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id259445878
octolytics-dimension-repository_network_root_nwogithub/codeql-action
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release9c9a37e2423ed382cf39f70b5aa4b4858b40a3b0
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql-action/pull/4292/files#start-of-content
https://github.com/
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql-action%2Fpull%2F4292%2Ffiles
GitHubRepository hosting, code review, and collaborationhttps://github.com/platform
CopilotAI coding agent for tasks, projects, and automated workhttps://github.com/features/copilot
ActionsCI/CD and automationhttps://github.com/features/actions
Code QualityQuality analysis, fixes, and enforcementhttps://github.com/features/code-quality
CodespacesCloud development environmentshttps://github.com/features/codespaces
Code SecurityVulnerability detection and remediationhttps://github.com/security/advanced-security/code-security
Secret ProtectionSecret scanning and leak preventionhttps://github.com/security/advanced-security/secret-protection
All Featureshttps://github.com/features
Documentationhttps://docs.github.com/en
Traininghttps://learn.github.com/skills
Certificationshttps://learn.github.com/credentials
Build with Copilothttps://github.com/features/ai
Customize Copilothttps://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-copilot-overview
Integrationshttps://github.com/marketplace
Trending reposhttps://github.com/trending
GitHub Sponsorshttps://github.com/open-source/sponsors
Developer articleshttps://github.com/resources/articles
ChangelogYour source for the latest features, improvements, and fixes across GitHub products, all in one place.https://github.blog/changelog/
Enterpriseshttps://github.com/enterprise
Teamhttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
See all industrieshttps://github.com/solutions/industry
Why GitHubhttps://github.com/why-github
Customer Storieshttps://github.com/customer-stories
Business insightshttps://github.com/solutions/executive-insights
Trust Centerhttps://github.com/trust-center
GitHub Advanced SecurityEnterprise-grade code securityhttps://github.com/security/advanced-security
Copilot for businessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Documentationhttps://docs.github.com/en
Resource centerhttps://github.com/resources
Bloghttps://github.blog/
Events & webinarshttps://github.com/resources/events
Community Forumhttps://github.com/orgs/community/discussions
Customer Storieshttps://github.com/customer-stories
Integrationshttps://github.com/marketplace
Customer supporthttps://help.github.com/
Traininghttps://learn.github.com/skills
GitHub Statushttps://www.githubstatus.com/
Abouthttps://github.com/about
Partnershttps://github.com/partners
Changeloghttps://github.blog/changelog/
GitHub UniverseThe event for developers, by developers — talks, workshops, and what’s next for GitHub.https://githubuniverse.com/
Pricinghttps://github.com/pricing
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql-action%2Fpull%2F4292%2Ffiles
Sign uphttps://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql-action
Reloadhttps://github.com/github/codeql-action/pull/4292/files
Reloadhttps://github.com/github/codeql-action/pull/4292/files
Reloadhttps://github.com/github/codeql-action/pull/4292/files
githubhttps://github.com/github
codeql-actionhttps://github.com/github/codeql-action
Codehttps://github.com/github/codeql-action
Issues165 (165)https://github.com/github/codeql-action/issues
Pull requests41 (41)https://github.com/github/codeql-action/pulls
Actionshttps://github.com/github/codeql-action/actions
Security and quality2 (2)https://github.com/github/codeql-action/security
Insightshttps://github.com/github/codeql-action/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql-action%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql-action%2Fissues%2Fnew%2Fchoose
mbghttps://github.com/mbg
mainhttps://github.com/github/codeql-action/tree/main
mbg/ci/fix-sync-backhttps://github.com/github/codeql-action/tree/mbg/ci/fix-sync-back
Conversation 5 https://github.com/github/codeql-action/pull/4292
Commits 4 https://github.com/github/codeql-action/pull/4292/commits
Checks 231 https://github.com/github/codeql-action/pull/4292/checks
Files changed https://github.com/github/codeql-action/pull/4292/files
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
Maintain action versions by workflow in sync-back.ts https://github.com/github/codeql-action/pull/4292/files#top
Show all changes 4 commits https://github.com/github/codeql-action/pull/4292/files
7b8e4ce Maintain action versions by workflow in `sync-back.ts` mbg Nov 3, 2026 https://github.com/github/codeql-action/pull/4292/commits/7b8e4ced676e48d3aa22f5078cc0edf965141a98
cc88e02 Update version of `actions/download-artifact` in `unsupported-macos` … mbg Nov 3, 2026 https://github.com/github/codeql-action/pull/4292/commits/cc88e02cc116c1c087ebbc8135aea250f71adcce
de3ece6 Merge branch 'main' into mbg/ci/fix-sync-back mbg Nov 3, 2026 https://github.com/github/codeql-action/pull/4292/commits/de3ece651edf4dda62049ae893e1153568e05056
8a05ce6 Update JSDoc for `scanGeneratedWorkflows` mbg Nov 3, 2026 https://github.com/github/codeql-action/pull/4292/commits/8a05ce60679eef931b932a17d3c2b59d93b2d90d
Clear filters https://github.com/github/codeql-action/pull/4292/files
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
__unsupported-macos.yml https://github.com/github/codeql-action/pull/4292/files#diff-f558e6760708af9d026ecb0f5dccc3d02974b7afa365644856aa4f8daa3e94d0
unsupported-macos.yml https://github.com/github/codeql-action/pull/4292/files#diff-68acea3cbb9cb26ab1fb88125efd97a83e31eb3bb3bd0f29864b7cf944112e35
sync-back.test.ts https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
sync-back.ts https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
.github/workflows/__unsupported-macos.ymlhttps://github.com/github/codeql-action/pull/4292/files#diff-f558e6760708af9d026ecb0f5dccc3d02974b7afa365644856aa4f8daa3e94d0
View file https://github.com/github/codeql-action/blob/8a05ce60679eef931b932a17d3c2b59d93b2d90d/.github/workflows/__unsupported-macos.yml
Open in desktop https://desktop.github.com
how customized files appear on GitHubhttps://docs.github.com/github/administering-a-repository/customizing-how-changed-files-appear-on-github
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
pr-checks/checks/unsupported-macos.ymlhttps://github.com/github/codeql-action/pull/4292/files#diff-68acea3cbb9cb26ab1fb88125efd97a83e31eb3bb3bd0f29864b7cf944112e35
View file https://github.com/github/codeql-action/blob/8a05ce60679eef931b932a17d3c2b59d93b2d90d/pr-checks/checks/unsupported-macos.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/4292/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/4292/files#diff-68acea3cbb9cb26ab1fb88125efd97a83e31eb3bb3bd0f29864b7cf944112e35
https://github.com/github/codeql-action/pull/4292/files#diff-68acea3cbb9cb26ab1fb88125efd97a83e31eb3bb3bd0f29864b7cf944112e35
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
pr-checks/sync-back.test.tshttps://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
View file https://github.com/github/codeql-action/blob/8a05ce60679eef931b932a17d3c2b59d93b2d90d/pr-checks/sync-back.test.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/4292/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/pull/4292/files#diff-970548d7ad12423a0583f1576ee0c00bc0ed7238fb019466c67a059d88a6461c
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
pr-checks/sync-back.tshttps://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
View file https://github.com/github/codeql-action/blob/8a05ce60679eef931b932a17d3c2b59d93b2d90d/pr-checks/sync-back.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/4292/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
https://github.com/github/codeql-action/pull/4292/files#diff-ca9726837bce636f58e1522493ac7684d0a76f280cce6498621ce715a187ebf5
Please reload this pagehttps://github.com/github/codeql-action/pull/4292/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.