Merge main into releases/v4 #3479

github-actions · 2026-02-13T11:18:40Z

Merging 4bf6fa4 into releases/v4.

Conductor for this PR is @henrymercer.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v4 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
Merge the mergeback PR that will automatically be created once this PR is merged.
Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

Disable TypeScript `noUnusedLocals` and `noUnusedParameters` options, already covered by eslint

…main-45cbd0c6

Mergeback v4.32.2 refs/heads/releases/v4 into main

Bumps the npm-minor group with 2 updates: [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) and [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc). Updates `@eslint/compat` from 2.0.1 to 2.0.2 - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/compat-v2.0.2/packages/compat) Updates `eslint-plugin-jsdoc` from 62.4.1 to 62.5.0 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](gajus/eslint-plugin-jsdoc@v62.4.1...v62.5.0) --- updated-dependencies: - dependency-name: "@eslint/compat" dependency-version: 2.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 62.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.286.0 to 1.288.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@90be115...09a7688) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.288.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Test connections to private registries in `start-proxy`

…r-5707d09364 Bump the npm-minor group with 2 updates

…thub/workflows/actions-minor-299c02fd34 Bump ruby/setup-ruby from 1.286.0 to 1.288.0 in /.github/workflows in the actions-minor group across 1 directory

Retry API authentication errors since these can be transient

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Avoid requesting features in CCR

…t-entry Add changelog entry for #3466

Copilot

Pull request overview

Release-branch sync PR (main → releases/v4) that bumps the action version to 4.32.3 and brings in recent changes, including new start-proxy private-registry connectivity checks and feature-flag/HTTP client behavior updates.

Changes:

Bump version to 4.32.3 and add a 4.32.3 changelog section.
Add optional private-registry reachability checks to start-proxy (gated behind a new feature flag).
Adjust feature flags behavior for CCR and tweak API client retry behavior; update dependencies and generated build artifacts.

Reviewed changes

Copilot reviewed 25 out of 28 changed files in this pull request and generated 29 comments.

Show a summary per file

File	Description
tsconfig.json	Disables TS unused locals/params checks (relying on ESLint).
src/start-proxy/types.ts	Introduces typed registry/credential/address models and helpers.
src/start-proxy/reachability.ts	Implements registry reachability checks via HTTPS HEAD requests through proxy.
src/start-proxy/reachability.test.ts	Unit tests for reachability checks and logging behavior.
src/start-proxy.ts	Refactors credential parsing/validation and exports new types.
src/start-proxy.test.ts	Adds/updates tests for credential validation and stringification.
src/start-proxy-action.ts	Initializes feature flags, returns proxy info, optionally runs reachability checks.
src/feature-flags.ts	Adds `StartProxyConnectionChecks` flag; uses defaults for GHES/CCR without remote calls.
src/feature-flags.test.ts	Updates tests for default-value behavior on GHES and CCR.
src/api-client.ts	Adjusts retry configuration to allow retries for some auth-related statuses.
src/api-client.test.ts	Updates API client test expectations for retry config.
pr-checks/checks/rubocop-multi-language.yml	Bumps `ruby/setup-ruby` pin to v1.288.0.
package.json	Bumps version to 4.32.3; adds `https-proxy-agent`; updates dev deps.
package-lock.json	Lockfile update corresponding to dependency/version changes.
CHANGELOG.md	Adds `4.32.3 - 13 Feb 2026` entry.
.github/workflows/__rubocop-multi-language.yml	Generated workflow update for `ruby/setup-ruby` pin.
lib/upload-sarif-action.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/upload-sarif-action-post.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/upload-lib.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/start-proxy-action-post.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/setup-codeql-action.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/resolve-environment-action.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/init-action.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/init-action-post.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/autobuild-action.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/analyze-action.js	Generated JS output update for version/deps/feature flag/retry changes.
lib/analyze-action-post.js	Generated JS output update for version/deps/feature flag/retry changes.

Copilot · 2026-02-13T11:32:05Z

CHANGELOG.md


+## 4.32.3 - 13 Feb 2026
+
+- Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)


The 4.32.3 changelog entry appears incomplete for this release merge: this PR also includes user-visible behavior changes like retrying transient authentication-related API errors (#3475) and skipping feature-flag API requests in Copilot Code Review/CCR (#3476). Please add entries for these (or explicitly note if they are intentionally excluded as not user-facing) so the release notes accurately reflect changes since 4.32.2.

Suggested change

- Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

- Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

- Improved reliability of API authentication by retrying certain transient authentication-related errors instead of immediately failing the workflow. [#3475](https://github.com/github/codeql-action/pull/3475)

- Improved performance and robustness of Copilot Code Review (CCR) by skipping feature-flag API requests when they are not required. [#3476](https://github.com/github/codeql-action/pull/3476)

lib/start-proxy-action.js

Copilot · 2026-02-13T11:32:12Z

lib/start-proxy-action.js

This use of variable 'CacheFilename' always evaluates to false.

Copilot · 2026-02-13T11:32:12Z

lib/start-proxy-action.js

This use of variable 'CompressionMethod' always evaluates to false.

Copilot · 2026-02-13T11:32:13Z

lib/start-proxy-action.js

This use of variable 'ArchiveToolType' always evaluates to false.

Copilot · 2026-02-13T11:32:13Z

lib/start-proxy-action.js

This use of variable 'KnownLanguage' always evaluates to false.

lib/start-proxy-action.js

github-actions bot and others added 30 commits February 5, 2026 17:09

Update changelog and version after v4.32.2

5a82333

Disable noUnusedLocals and noUnusedParameters

46c411a

Make FFs available in start-proxy action

d2901f5

Merge pull request #3464 from github/mbg/disable-ts-unused-checks

9b3a0d2

Disable TypeScript `noUnusedLocals` and `noUnusedParameters` options, already covered by eslint

Merge remote-tracking branch 'origin/main' into mergeback/v4.32.2-to-…

481be99

…main-45cbd0c6

Rebuild

4b8e16f

Merge pull request #3462 from github/mergeback/v4.32.2-to-main-45cbd0c6

b13d724

Mergeback v4.32.2 refs/heads/releases/v4 into main

Merge branch 'main' into mbg/start-proxy/test-connections

310177a

Move Credential type

93302bc

Break up Credential type into two interfaces

70eae15

Add explicit dependency on https-proxy-agent

b030333

Add ProxyInfo type and return from startProxy

c4717c9

Add StartProxyConnectionChecks feature

c7eff3f

Test connections to registries, if FF is enabled

01ee641

Remove superflous log message

9f2f6d0

Add missing else

700fc11

Type that registries must have either an url or a host

4d44b57

Add a 5s timeout to requests

5135700

Remove superfluous error handling details

c4b0f60

Remove unnecessary test assertions

27b3b65

Fix outdated comment

0387f55

Rename types

4d0bec1

Require validated Credential for credentialToStr

bd36637

Add test for missing type

e114998

Remove unused logger in NetworkReachabilityBackend

555ee17

Add timeout event handler

2b5b614

Rebuild

be578c7

Rebuild

d736445

mbg and others added 12 commits February 11, 2026 18:02

Skip checks for non-URLs for now

efb92e2

Merge pull request #3466 from github/mbg/start-proxy/test-connections

ff33514

Test connections to private registries in `start-proxy`

Merge pull request #3467 from github/dependabot/npm_and_yarn/npm-mino…

4edc7d2

…r-5707d09364 Bump the npm-minor group with 2 updates

Merge pull request #3472 from github/dependabot/github_actions/dot-gi…

8ad4b6e

…thub/workflows/actions-minor-299c02fd34 Bump ruby/setup-ruby from 1.286.0 to 1.288.0 in /.github/workflows in the actions-minor group across 1 directory

Retry API authentication errors since these can be transient

43b46a1

Avoid requesting features in CCR

876cecb

Merge pull request #3475 from github/henrymercer/retry-auth-errors

2d6b98c

Retry API authentication errors since these can be transient

Apply suggestion from @Copilot

05bca54

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add changelog entry for #3466

be75dd9

Merge pull request #3476 from github/henrymercer/retry-auth-errors

9658e23

Avoid requesting features in CCR

Merge pull request #3478 from github/mbg/changelog/add-connection-tes…

4bf6fa4

…t-entry Add changelog entry for #3466

Update changelog for v4.32.3

1814c9f

github-actions bot assigned henrymercer Feb 13, 2026

henrymercer marked this pull request as ready for review February 13, 2026 11:24

henrymercer requested a review from a team as a code owner February 13, 2026 11:24

Copilot AI review requested due to automatic review settings February 13, 2026 11:24

github-actions bot added the size/L May be hard to review label Feb 13, 2026

henrymercer approved these changes Feb 13, 2026

View reviewed changes

henrymercer enabled auto-merge February 13, 2026 11:24

Copilot started reviewing on behalf of henrymercer February 13, 2026 11:24 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

henrymercer merged commit 9e907b5 into releases/v4 Feb 13, 2026
249 checks passed

henrymercer deleted the update-v4.32.3-4bf6fa4e2 branch February 13, 2026 11:50

github-actions bot mentioned this pull request Feb 13, 2026

Merge releases/v4 into releases/v3 #3481

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge main into releases/v4 #3479

Merge main into releases/v4 #3479

github-actions bot commented Feb 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		## 4.32.3 - 13 Feb 2026

		- Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

Merge main into releases/v4 #3479

Merge main into releases/v4 #3479

Conversation

github-actions bot commented Feb 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants