Bump the github-actions group with 4 updates

dependabot[bot] · copybara-github · commit 56fc17bfa31a · 2025-12-04T10:36:21.000-08:00
Bumps the github-actions group with 4 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [actions/checkout](https://github.com/actions/checkout) and [github/codeql-action](https://github.com/github/codeql-action). Updates `step-security/harden-runner` from 2.13.1 to 2.13.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.13.2</h2> <h2>What's Changed</h2> <ul> <li>Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.</li> <li>Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.13.1...v2.13.2">https://github.com/step-security/harden-runner/compare/v2.13.1...v2.13.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/95d9a5deda9de15063e7595e9719c11c38c90ae2"><code>95d9a5d</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/606">#606</a> from step-security/rc-28</li> <li><a href="https://github.com/step-security/harden-runner/commit/87e429d3fb470bcc827f338e5cce1155ff99c6eb"><code>87e429d</code></a> Update limitations.md</li> <li><a href="https://github.com/step-security/harden-runner/commit/ef891c3a30c3c15c2287ce04b33ec28b6d90a447"><code>ef891c3</code></a> feat: add support for custom vm image</li> <li><a href="https://github.com/step-security/harden-runner/commit/1fa8c8a8b1b523829fe596bfc665d2bc4c0ef835"><code>1fa8c8a</code></a> update agent</li> <li><a href="https://github.com/step-security/harden-runner/commit/92c522aaa6f53af082553dedc1596c80b71aba33"><code>92c522a</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/593">#593</a> from step-security/ak-readme-updates</li> <li><a href="https://github.com/step-security/harden-runner/commit/4719ad5578c61961f4f70f833580278dea5544de"><code>4719ad5</code></a> README updates</li> <li><a href="https://github.com/step-security/harden-runner/commit/4fde639ab437b75bf4ecb52bbddb23ab0ac00259"><code>4fde639</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/591">#591</a> from eromosele-stepsecurity/Upd</li> <li><a href="https://github.com/step-security/harden-runner/commit/f682f2f2d06275b6ab30c2a973c1de2fa120e134"><code>f682f2f</code></a> Update README.md</li> <li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a...95d9a5deda9de15063e7595e9719c11c38c90ae2">compare view</a></li> </ul> </details> <br /> Updates `bazelbuild/continuous-integration` from 5904ada00b1ce65148531f5b8cdccf4102fd2508 to e3c3c35f22c5df604bf4aedef03ad39a36b2285a <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p> <blockquote> <h1>Bazel Release Playbook</h1> <p>This is the guide to conducting a Bazel release. This is especially relevant for release managers, but will be of interest to anyone who is curious about the release process.</p> <h2>Preface</h2> <blockquote> <p>For future reference and release managers - the release manager playbook should be treated like an IKEA manual. That means: Do not try to be smart, optimize / skip / reorder steps, otherwise chaos will ensue. Just follow it and the end result will be.. well, a usable piece of furniture, or a Bazel release (depending on the manual).</p> <p>Like aviation and workplace safety regulations, the playbook is written in the tears and blood of broken Bazelisks, pipelines, releases and Git branches. Assume that every step is exactly there for a reason, even if it might not be obvious. If you follow them to the letter, they are not error prone. Errors have only happened in the past, when a release manager thought it's ok to follow them by spirit instead. ;)</p> <p>-- <a href="https://github.com/philwo"><code>@​philwo</code></a></p> </blockquote> <h2>One-time setup</h2> <p>These steps only have to be performed once, ever.</p> <ul> <li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li> <li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a> group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to the group.</li> <li>Set up github ssh key if you haven't already. <ul> <li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li> </ul> </li> <li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li> <li>Log in to the Gerrit UI to create an account: <a href="[] </ul> <h2>Preparing a new release</h2> <ol> <li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named &quot;X.Y.Z release blockers&quot; (case-sensitive), where we keep track of issues that must be resolved before the release goes out. <ul> <li>Set the (tentative) release date.</li> <li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li> <li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li> </ul> </li> <li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&amp;labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&amp;template=release.md&amp;title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li> <li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch. <ul> <li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li> <li>For patch releases (<code>X.Y.Z</code> where <code>Z&gt;0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li> <li>For minor releases (<code>X.Y.0</code> where <code>Y&gt;0</code>), the base commit should typically be <code>X.(Y-1).&lt;current max Z&gt;</code>.</li> <li>For major releases (<code>X.0.0</code>), the base commit is some &quot;healthy&quot; commit on the main branch. <ul> <li>This means that there's an extra step involved in preparing the release -- &quot;cutting&quot; the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li> <li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li> </ul> </li> </ul> </li> </ol>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/e3c3c35f22c5df604bf4aedef03ad39a36b2285a"><code>e3c3c35</code></a> Add platform definitions for Ubuntu 22.04 and 24.04 for Arm64 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2410">#2410</a>)</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/df8cbac9105257507cb33930b8d057d0310e2e45"><code>df8cbac</code></a> Replace --remote_default_platform_properties with --remote_default_exec_prope...</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/7ed9ca5e0d85bea324a2a0904464f2b17c05fbb5"><code>7ed9ca5</code></a> Update Android build tools to 36.1.0 and remove old versions (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2408">#2408</a>)</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/35ef52dd240c7badc783cedd70c3f93288c78129"><code>35ef52d</code></a> Bump golang.org/x/crypto from 0.42.0 to 0.45.0 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2407">#2407</a>)</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/9660729bded1f80134f128c38f023ece6185a68d"><code>9660729</code></a> Update windows security update commands</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/41abea5eeca954c3fbac34c62e4a064574f4e79b"><code>41abea5</code></a> Improve debugging</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/8f2ce913697a38ad6b759d9736251d599e8ae264"><code>8f2ce91</code></a> Implement security updates installation (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2405">#2405</a>)</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/c3b6d8802a72b525c3cd19ad4f556d0314568839"><code>c3b6d88</code></a> Support handling BCR comment <code>@bazel-io abandon</code> (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2402">#2402</a>)</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/75f7d0c111553ec880f9b30493a9c0697ceaa16a"><code>75f7d0c</code></a> Update slack invite link (November) (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2401">#2401</a>)</li> <li><a href="https://github.com/bazelbuild/continuous-integration/commit/16a9766183342ae2a9bfe32496c24b6e48e127ce"><code>16a9766</code></a> Enabling rules_python in Downstream (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/2400">#2400</a>)</li> <li>Additional commits viewable in <a href="https://github.com/bazelbuild/continuous-integration/compare/5904ada00b1ce65148531f5b8cdccf4102fd2508...e3c3c35f22c5df604bf4aedef03ad39a36b2285a">compare view</a></li> </ul> </details> <br /> Updates `actions/checkout` from 5.0.0 to 6.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>v6-beta by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li> <li>update readme/changelog for v6 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p> <h2>v6-beta</h2> <h2>What's Changed</h2> <p>Updated persist-credentials to store the credentials under <code>$RUNNER_TEMP</code> instead of directly in the local git config.</p> <p>This requires a minimum Actions Runner version of <a href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a> to access the persisted credentials for <a href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker container action</a> scenarios.</p> <h2>v5.0.1</h2> <h2>What's Changed</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>V6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>V5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>V5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>V4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>V4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li> <li>Dependency updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li> </ul> <h2>v4.1.7</h2> <ul> <li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li> <li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li> <li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li> </ul> <h2>v4.1.6</h2> <ul> <li>Check platform to set archive extension appropriately by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li> </ul> <h2>v4.1.5</h2> <ul> <li>Update NPM dependencies by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li> <li>Bump github/codeql-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li> <li>Bump actions/setup-node from 1 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li> <li>Bump actions/upload-artifact from 2 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a> update readme/changelog for v6 (<a href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li> <li><a href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a> v6-beta (<a href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li> <li><a href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a> Persist creds to a separate file (<a href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a> Update README to include Node.js 24 support details and requirements (<a href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...1af3b93b6815bc44a9784bd300feb67ff0d1eeb3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 4.31.2 to 4.31.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.31.5</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.5 - 24 Nov 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.6. <a href="https://redirect.github.com/github/codeql-action/pull/3321">#3321</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.5/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v4.31.4</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.4 - 18 Nov 2025</h2> <p>No user facing changes.</p> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.4/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v4.31.3</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.3 - 13 Nov 2025</h2> <ul> <li>CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see <a href="https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/">Upcoming deprecation of CodeQL Action v3</a>.</li> <li>Update default CodeQL bundle version to 2.23.5. <a href="https://redirect.github.com/github/codeql-action/pull/3288">#3288</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.3/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.31.5 - 24 Nov 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.6. <a href="https://redirect.github.com/github/codeql-action/pull/3321">#3321</a></li> </ul> <h2>4.31.4 - 18 Nov 2025</h2> <p>No user facing changes.</p> <h2>4.31.3 - 13 Nov 2025</h2> <ul> <li>CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see <a href="https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/">Upcoming deprecation of CodeQL Action v3</a>.</li> <li>Update default CodeQL bundle version to 2.23.5. <a href="https://redirect.github.com/github/codeql-action/pull/3288">#3288</a></li> </ul> <h2>4.31.2 - 30 Oct 2025</h2> <p>No user facing changes.</p> <h2>4.31.1 - 30 Oct 2025</h2> <ul> <li>The <code>add-snippets</code> input has been removed from the <code>analyze</code> action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.</li> </ul> <h2>4.31.0 - 24 Oct 2025</h2> <ul> <li>Bump minimum CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li> <li>When SARIF files are uploaded by the <code>analyze</code> or <code>upload-sarif</code> actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the <code>upload-sarif</code> action. For <code>analyze</code>, this may affect Advanced Setup for CodeQL users who specify a value other than <code>always</code> for the <code>upload</code> input. <a href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li> </ul> <h2>4.30.9 - 17 Oct 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.3. <a href="https://redirect.github.com/github/codeql-action/pull/3205">#3205</a></li> <li>Experimental: A new <code>setup-codeql</code> action has been added which is similar to <code>init</code>, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3204">#3204</a></li> </ul> <h2>4.30.8 - 10 Oct 2025</h2> <p>No user facing changes.</p> <h2>4.30.7 - 06 Oct 2025</h2> <ul> <li>[v4+ only] The CodeQL Action now runs on Node.js v24. <a href="https://redirect.github.com/github/codeql-action/pull/3169">#3169</a></li> </ul> <h2>3.30.6 - 02 Oct 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.2. <a href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/fdbfb4d2750291e159f0156def62b853c2798ca2"><code>fdbfb4d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3322">#3322</a> from github/update-v4.31.5-ec2ee575c</li> <li><a href="https://github.com/github/codeql-action/commit/81f6d649ae64626b3035526b0389bfa8802b6df3"><code>81f6d64</code></a> Update changelog for v4.31.5</li> <li><a href="https://github.com/github/codeql-action/commit/ec2ee575c053869d197f516146096427e08da443"><code>ec2ee57</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3321">#3321</a> from github/update-bundle/codeql-bundle-v2.23.6</li> <li><a href="https://github.com/github/codeql-action/commit/ecc87875ee10fd563cebc295e45bea8312e2ce49"><code>ecc8787</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/1d2a238d7d52b563f78fb3bf1deebc2b18d98eb1"><code>1d2a238</code></a> Update default bundle to codeql-bundle-v2.23.6</li> <li><a href="https://github.com/github/codeql-action/commit/ce729e4d353d580e6cacd6a8cf2921b72e5e310a"><code>ce729e4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3315">#3315</a> from github/henrymercer/dead-code-elimination</li> <li><a href="https://github.com/github/codeql-action/commit/ac359aad20e59fd46ecd05e63c6d4b99cad25272"><code>ac359aa</code></a> Add return type</li> <li><a href="https://github.com/github/codeql-action/commit/112cd075bdb9b3b9ec911ae7c5980f2fa5f2cca1"><code>112cd07</code></a> Merge branch 'main' into henrymercer/dead-code-elimination</li> <li><a href="https://github.com/github/codeql-action/commit/0b4317954f4f86bf5df18ed38d9987fb1d2ec4ad"><code>0b43179</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3306">#3306</a> from github/dependabot/npm_and_yarn/types/sinon-21.0.0</li> <li><a href="https://github.com/github/codeql-action/commit/e818008b54314bea8e06c423f952d06c0d1f1b7f"><code>e818008</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3305">#3305</a> from github/dependabot/npm_and_yarn/eslint/compat-2.0.0</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/0499de31b99561a6d14a36a5f662c2a54f91beee...fdbfb4d2750291e159f0156def62b853c2798ca2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Closes #27825. PiperOrigin-RevId: 840305367 Change-Id: I827ad07f2454a762a67422542f7c3c51440d5898
diff --git a/.github/workflows/cherry-picker.yml b/.github/workflows/cherry-picker.yml
@@ -19,19 +19,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2
         with:
           egress-policy: audit
       - if: github.event.pull_request
         name: Run cherrypicker on closed PR
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@5904ada00b1ce65148531f5b8cdccf4102fd2508
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@e3c3c35f22c5df604bf4aedef03ad39a36b2285a
         with:
           triggered-on: closed
           pr-number: ${{ github.event.number }}
           is-prod: True
       - if: github.event.issue
         name: Run cherrypicker on closed issue
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@5904ada00b1ce65148531f5b8cdccf4102fd2508
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@e3c3c35f22c5df604bf4aedef03ad39a36b2285a
         with:
           triggered-on: closed
           pr-number: ${{ github.event.issue.number }}
@@ -41,12 +41,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2
         with:
           egress-policy: audit
       - if: startsWith(github.event.issue.body, 'Forked from')
         name: Run cherrypicker on comment
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@5904ada00b1ce65148531f5b8cdccf4102fd2508
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@e3c3c35f22c5df604bf4aedef03ad39a36b2285a
         with:
           triggered-on: commented
           pr-number: ${{ github.event.issue.body }}
@@ -55,7 +55,7 @@ jobs:
           is-prod: True
       - if: startsWith(github.event.issue.body, '### Commit IDs')
         name: Run cherrypicker on demand
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@5904ada00b1ce65148531f5b8cdccf4102fd2508
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@e3c3c35f22c5df604bf4aedef03ad39a36b2285a
         with:
           triggered-on: ondemand
           milestone-title: ${{ github.event.milestone.title }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/release-helper.yml b/.github/workflows/release-helper.yml
@@ -13,11 +13,11 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Run helper
-        uses: bazelbuild/continuous-integration/actions/release-helper@5904ada00b1ce65148531f5b8cdccf4102fd2508 # master
+        uses: bazelbuild/continuous-integration/actions/release-helper@e3c3c35f22c5df604bf4aedef03ad39a36b2285a # master
         with:
           token: ${{ secrets.BAZEL_IO_TOKEN }}
diff --git a/.github/workflows/remove-labels.yml b/.github/workflows/remove-labels.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
@@ -72,6 +72,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
       with:
         egress-policy: audit
 
