commit fe36be434d62b9c938717380c4f76643a27e585a
author dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Tue Jul 09 09:06:00 2024 -0700
committer Copybara-Service <copybara-worker@google.com> Tue Jul 09 09:11:21 2024 -0700
tree 24c5fc09ff98757df69021b47582d84be36934b8
parent 076bbbbca84807a6fddf86c9d3930a36f12668a6

Bump the github-actions group with 4 updates

Bumps the github-actions group with 4 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration), [actions/checkout](https://github.com/actions/checkout) and [github/codeql-action](https://github.com/github/codeql-action).

Updates `step-security/harden-runner` from 2.8.0 to 2.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p>
<blockquote>
<h2>v2.8.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Bug fix: Update isGitHubHosted implementation by <a href="https://github.com/varunsh-coder"><code>@​varunsh-coder</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/425">step-security/harden-runner#425</a>
The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2...v2.8.1">https://github.com/step-security/harden-runner/compare/v2...v2.8.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/step-security/harden-runner/commit/17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6"><code>17d0e2b</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/425">#425</a> from step-security/rc-9</li>
<li><a href="https://github.com/step-security/harden-runner/commit/bb112d061bf5af75c824cf30dd69cb76b316bd3a"><code>bb112d0</code></a> Update isGitHubHosted implementation</li>
<li><a href="https://github.com/step-security/harden-runner/commit/f4f3f445f343c08c93d7771433e8dee4267e05b9"><code>f4f3f44</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/407">#407</a> from step-security/dependabot/github_actions/actions/...</li>
<li><a href="https://github.com/step-security/harden-runner/commit/7a946b57df8fca5054684f5beffd1910f681dffd"><code>7a946b5</code></a> Bump actions/dependency-review-action from 3.1.3 to 4.3.2</li>
<li><a href="https://github.com/step-security/harden-runner/commit/75a01c2f00ea1ad58b152418d054937c3583861d"><code>75a01c2</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/417">#417</a> from step-security/dependabot/github_actions/step-sec...</li>
<li><a href="https://github.com/step-security/harden-runner/commit/53413f1a91b85facf419e9a302ceb22702348ce9"><code>53413f1</code></a> Bump step-security/harden-runner from 2.7.1 to 2.8.0</li>
<li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/f086349bfa2bd1361f7909c78558e816508cdc10...17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6">compare view</a></li>
</ul>
</details>
<br />

Updates `bazelbuild/continuous-integration` from fcd3cdd216acf5b78449ae6c05da1c789f5ef76c to ee5ea988681e086afabfe6677eef2dc1292f6b9d
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p>
<blockquote>
<h1>Bazel Release Playbook</h1>
<p>This is the guide to conducting a Bazel release. This is especially relevant for
release managers, but will be of interest to anyone who is curious about the
release process.</p>
<h2>Preface</h2>
<blockquote>
<p>For future reference and release managers - the release manager playbook should
be treated like an IKEA manual. That means: Do not try to be smart, optimize /
skip / reorder steps, otherwise chaos will ensue. Just follow it and the end
result will be.. well, a usable piece of furniture, or a Bazel release
(depending on the manual).</p>
<p>Like aviation and workplace safety regulations, the playbook is written in the
tears and blood of broken Bazelisks, pipelines, releases and Git branches.
Assume that every step is exactly there for a reason, even if it might not be
obvious. If you follow them to the letter, they are not error prone. Errors
have only happened in the past, when a release manager thought it's ok to
follow them by spirit instead. ;)</p>
<p>-- <a href="https://github.com/philwo"><code>@​philwo</code></a></p>
</blockquote>
<h2>One-time setup</h2>
<p>These steps only have to be performed once, ever.</p>
<ul>
<li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li>
<li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a>
group on BuildKite.  If that link does not work for you, ask one of the Buildkite org admins to add you to
the group.</li>
<li>Set up github ssh key if you haven't already.
<ul>
<li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li>
</ul>
</li>
<li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li>
<li>Log in to the Gerrit UI to create an account: <a href="[]
</ul>
<h2>Preparing a new release</h2>
<ol>
<li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named &quot;X.Y.Z release blockers&quot; (case-sensitive), where we keep track of issues that must be resolved before the release goes out.
<ul>
<li>Set the (tentative) release date.</li>
<li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li>
<li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li>
</ul>
</li>
<li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&amp;labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&amp;template=release.md&amp;title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li>
<li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch.
<ul>
<li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li>
<li>For patch releases (<code>X.Y.Z</code> where <code>Z&gt;0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li>
<li>For minor releases (<code>X.Y.0</code> where <code>Y&gt;0</code>), the base commit should typically be <code>X.(Y-1).&lt;current max Z&gt;</code>.</li>
<li>For major releases (<code>X.0.0</code>), the base commit is some &quot;healthy&quot; commit on the main branch.
<ul>
<li>This means that there's an extra step involved in preparing the release -- &quot;cutting&quot; the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li>
<li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li>
</ul>
</li>
</ul>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/ee5ea988681e086afabfe6677eef2dc1292f6b9d"><code>ee5ea98</code></a> Fix shard summary links on Windows (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1978">#1978</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/886a6f600ae9e812d26233443fb81b4c043bb82b"><code>886a6f6</code></a> Bump ws from 7.5.9 to 7.5.10 in /dashboard/client (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1977">#1977</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/ac0ad68494afbd7090acf89e543e2f58fca5560e"><code>ac0ad68</code></a> Bump urllib3 from 1.26.18 to 1.26.19 in /buildkite/docker/ubuntu1604 (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1976">#1976</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/f10e8f4dc2fe8d25e56ebee6d2d9da51b43f58e7"><code>f10e8f4</code></a> Bump braces from 3.0.2 to 3.0.3 in /dashboard/client (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1975">#1975</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/7ad844021d8ff6cb3ba37f828acfbb76db0fbce0"><code>7ad8440</code></a> Strip archive query strings in bcr_presubmit.py (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1974">#1974</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/516d4d5eb70859dcbdd22275f23b1c1049268f79"><code>516d4d5</code></a> Disable bes on macservice (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1973">#1973</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/7baf7db0d7f78c61be432f4551ab7ab3cdac43cb"><code>7baf7db</code></a> Fix remote cache flags (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1972">#1972</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/3e1ccdc29f1a33a6e67bacc3d6b7999b28b0fd3f"><code>3e1ccdc</code></a> Use GCS for caching builds running on MacService (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1971">#1971</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/076a6b8cb464fb5d9dabf6f6d32c2627b38e2f1c"><code>076a6b8</code></a> Update some steps in the release process (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1969">#1969</a>)</li>
<li><a href="https://github.com/bazelbuild/continuous-integration/commit/68dea4fe63a2ad44caaa8f3c44df19094b3dd395"><code>68dea4f</code></a> Install a previous version of MSVC build tools (<a href="https://redirect.github.com/bazelbuild/continuous-integration/issues/1968">#1968</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/bazelbuild/continuous-integration/compare/fcd3cdd216acf5b78449ae6c05da1c789f5ef76c...ee5ea988681e086afabfe6677eef2dc1292f6b9d">compare view</a></li>
</ul>
</details>
<br />

Updates `actions/checkout` from 3 to 4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v4.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update default runtime to node20 by <a href="https://github.com/takost"><code>@​takost</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1436">actions/checkout#1436</a></li>
<li>Support fetching without the --progress option by <a href="https://github.com/simonbaird"><code>@​simonbaird</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1067">actions/checkout#1067</a></li>
<li>Release 4.0.0 by <a href="https://github.com/takost"><code>@​takost</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1447">actions/checkout#1447</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/takost"><code>@​takost</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1436">actions/checkout#1436</a></li>
<li><a href="https://github.com/simonbaird"><code>@​simonbaird</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1067">actions/checkout#1067</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3...v4.0.0">https://github.com/actions/checkout/compare/v3...v4.0.0</a></p>
<h2>v3.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Mark test scripts with Bash'isms to be run via Bash by <a href="https://github.com/dscho"><code>@​dscho</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1377">actions/checkout#1377</a></li>
<li>Add option to fetch tags even if fetch-depth &gt; 0 by <a href="https://github.com/RobertWieczoreck"><code>@​RobertWieczoreck</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/579">actions/checkout#579</a></li>
<li>Release 3.6.0 by <a href="https://github.com/luketomlinson"><code>@​luketomlinson</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1437">actions/checkout#1437</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/RobertWieczoreck"><code>@​RobertWieczoreck</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/579">actions/checkout#579</a></li>
<li><a href="https://github.com/luketomlinson"><code>@​luketomlinson</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1437">actions/checkout#1437</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3.5.3...v3.6.0">https://github.com/actions/checkout/compare/v3.5.3...v3.6.0</a></p>
<h2>v3.5.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix: Checkout Issue in self hosted runner due to faulty submodule check-ins by <a href="https://github.com/megamanics"><code>@​megamanics</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1196">actions/checkout#1196</a></li>
<li>Fix typos found by codespell by <a href="https://github.com/DimitriPapadopoulos"><code>@​DimitriPapadopoulos</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1287">actions/checkout#1287</a></li>
<li>Add support for sparse checkouts by <a href="https://github.com/dscho"><code>@​dscho</code></a> and <a href="https://github.com/dfdez"><code>@​dfdez</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1369">actions/checkout#1369</a></li>
<li>Release v3.5.3 by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1376">actions/checkout#1376</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/megamanics"><code>@​megamanics</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1196">actions/checkout#1196</a></li>
<li><a href="https://github.com/DimitriPapadopoulos"><code>@​DimitriPapadopoulos</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1287">actions/checkout#1287</a></li>
<li><a href="https://github.com/dfdez"><code>@​dfdez</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1369">actions/checkout#1369</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3...v3.5.3">https://github.com/actions/checkout/compare/v3...v3.5.3</a></p>
<h2>v3.5.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix: Use correct API url / endpoint in GHES by <a href="https://github.com/fhammerl"><code>@​fhammerl</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1289">actions/checkout#1289</a> based on <a href="https://redirect.github.com/actions/checkout/issues/1286">#1286</a> by <a href="https://github.com/1newsr"><code>@​1newsr</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3.5.1...v3.5.2">https://github.com/actions/checkout/compare/v3.5.1...v3.5.2</a></p>
<h2>v3.5.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Improve checkout performance on Windows runners by upgrading <code>@​actions/github</code> dependency by <a href="https://github.com/BrettDong"><code>@​BrettDong</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1246">actions/checkout#1246</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/BrettDong"><code>@​BrettDong</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1246">actions/checkout#1246</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/692973e3d937129bcbf40652eb9f2f61becf3332"><code>692973e</code></a> Prepare 4.1.7 release (<a href="https://redirect.github.com/actions/checkout/issues/1775">#1775</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/6ccd57f4c5d15bdc2fef309bd9fb6cc9db2ef1c6"><code>6ccd57f</code></a> Pin actions/checkout's own workflows to a known, good, stable version. (<a href="https://redirect.github.com/actions/checkout/issues/1776">#1776</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b17fe1e4d59a9d1d95a7aead5e6fcd13e50939a5"><code>b17fe1e</code></a> Handle hidden refs (<a href="https://redirect.github.com/actions/checkout/issues/1774">#1774</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b80ff79f1755d06ba70441c368a6fe801f5f3a62"><code>b80ff79</code></a> Bump actions/checkout from 3 to 4 (<a href="https://redirect.github.com/actions/checkout/issues/1697">#1697</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/b1ec3021b8fa02164da82ca1557d017d83b0e179"><code>b1ec302</code></a> Bump the minor-npm-dependencies group across 1 directory with 4 updates (<a href="https://redirect.github.com/actions/checkout/issues/1739">#1739</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/a5ac7e51b41094c92402da3b24376905380afc29"><code>a5ac7e5</code></a> Update for 4.1.6 release (<a href="https://redirect.github.com/actions/checkout/issues/1733">#1733</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/24ed1a352802348c9e4e8d13de9177fb95b537ba"><code>24ed1a3</code></a> Check platform for extension (<a href="https://redirect.github.com/actions/checkout/issues/1732">#1732</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/44c2b7a8a4ea60a981eaca3cf939b5f4305c123b"><code>44c2b7a</code></a> README: Suggest <code>user.email</code> to be `41898282+github-actions[bot]<a href="https://github.com/users"><code>@​users</code></a>.norepl...</li>
<li><a href="https://github.com/actions/checkout/commit/8459bc0c7e3759cdf591f513d9f141a95fef0a8f"><code>8459bc0</code></a> Bump actions/upload-artifact from 2 to 4 (<a href="https://redirect.github.com/actions/checkout/issues/1695">#1695</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/3f603f6d5e9f40714f97b2f017aa0df2a443192a"><code>3f603f6</code></a> Bump actions/setup-node from 1 to 4 (<a href="https://redirect.github.com/actions/checkout/issues/1696">#1696</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v3...v4">compare view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 3.25.7 to 3.25.11
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p>
<p>Note that the only difference between <code>v2</code> and <code>v3</code> of the CodeQL Action is the node version they support, with <code>v3</code> running on node 20 while we continue to release <code>v2</code> to support running on node 16. For example <code>3.22.11</code> was the first <code>v3</code> release and is functionally identical to <code>2.22.11</code>. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>3.25.11 - 28 Jun 2024</h2>
<ul>
<li>Avoid failing the workflow run if there is an error while uploading debug artifacts. <a href="https://redirect.github.com/github/codeql-action/pull/2349">#2349</a></li>
<li>Update default CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/2352">#2352</a></li>
</ul>
<h2>3.25.10 - 13 Jun 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.5. <a href="https://redirect.github.com/github/codeql-action/pull/2327">#2327</a></li>
</ul>
<h2>3.25.9 - 12 Jun 2024</h2>
<ul>
<li>Avoid failing database creation if the database folder already exists and contains some unexpected files. Requires CodeQL 2.18.0 or higher. <a href="https://redirect.github.com/github/codeql-action/pull/2330">#2330</a></li>
<li>The init Action will attempt to clean up the database cluster directory before creating a new database and at the end of the job. This will help to avoid issues where the database cluster directory is left in an inconsistent state. <a href="https://redirect.github.com/github/codeql-action/pull/2332">#2332</a></li>
</ul>
<h2>3.25.8 - 04 Jun 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.4. <a href="https://redirect.github.com/github/codeql-action/pull/2321">#2321</a></li>
</ul>
<h2>3.25.7 - 31 May 2024</h2>
<ul>
<li>We are rolling out a feature in May/June 2024 that will reduce the Actions cache usage of the Action by keeping only the newest TRAP cache for each language. <a href="https://redirect.github.com/github/codeql-action/pull/2306">#2306</a></li>
</ul>
<h2>3.25.6 - 20 May 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.3. <a href="https://redirect.github.com/github/codeql-action/pull/2295">#2295</a></li>
</ul>
<h2>3.25.5 - 13 May 2024</h2>
<ul>
<li>Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the <a href="https://github.com/github/codeql-action/blob/main/README.md">https://github.com/github/codeql-action/blob/main/README.md</a>. <a href="https://redirect.github.com/github/codeql-action/pull/2273">#2273</a></li>
<li>Avoid printing out a warning for a missing <code>on.push</code> trigger when the CodeQL Action is triggered via a <code>workflow_call</code> event. <a href="https://redirect.github.com/github/codeql-action/pull/2274">#2274</a></li>
<li>The <code>tools: latest</code> input to the <code>init</code> Action has been renamed to <code>tools: linked</code>. This option specifies that the Action should use the tools shipped at the same time as the Action. The old name will continue to work for backwards compatibility, but we recommend that new workflows use the new name. <a href="https://redirect.github.com/github/codeql-action/pull/2281">#2281</a></li>
</ul>
<h2>3.25.4 - 08 May 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.2. <a href="https://redirect.github.com/github/codeql-action/pull/2270">#2270</a></li>
</ul>
<h2>3.25.3 - 25 Apr 2024</h2>
<ul>
<li>Update default CodeQL bundle version to 2.17.1. <a href="https://redirect.github.com/github/codeql-action/pull/2247">#2247</a></li>
<li>Workflows running on <code>macos-latest</code> using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as <code>macos-12</code>. ARM machines with SIP disabled, including the newest <code>macos-latest</code> image, are unsupported for CLI versions before 2.15.1. <a href="https://redirect.github.com/github/codeql-action/pull/2261">#2261</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/b611370bb5703a7efb587f9d136a52ea24c5c38c"><code>b611370</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2357">#2357</a> from github/update-v3.25.11-de945755c</li>
<li><a href="https://github.com/github/codeql-action/commit/3e6431f3accd84bb42779fc3c9d9f447caa3a6d3"><code>3e6431f</code></a> Update changelog for v3.25.11</li>
<li><a href="https://github.com/github/codeql-action/commit/de945755c9edd3a4e5d160a71f1482ece6a3c271"><code>de94575</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2352">#2352</a> from github/update-bundle/codeql-bundle-v2.17.6</li>
<li><a href="https://github.com/github/codeql-action/commit/a32d3058b827f5d2ba08dc2570887f14b164a794"><code>a32d305</code></a> Add changelog note</li>
<li><a href="https://github.com/github/codeql-action/commit/9ccc99508a819cb9c340028d7711b129f96c8a2e"><code>9ccc995</code></a> Update default bundle to codeql-bundle-v2.17.6</li>
<li><a href="https://github.com/github/codeql-action/commit/9b7c22c3b39078582fa6d0d8f3841e944ec54582"><code>9b7c22c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2351">#2351</a> from github/dependabot/npm_and_yarn/npm-6791eaa26c</li>
<li><a href="https://github.com/github/codeql-action/commit/9cf3243b0be3a9e0efff20a7fabd5a11246168e9"><code>9cf3243</code></a> Rebuild</li>
<li><a href="https://github.com/github/codeql-action/commit/1895b29ac8e2046ddb708ac1eca53e6d5e143337"><code>1895b29</code></a> Update checked-in dependencies</li>
<li><a href="https://github.com/github/codeql-action/commit/9dcfde966d641c9a59ee02a83f18329a2b2caace"><code>9dcfde9</code></a> Bump the npm group with 2 updates</li>
<li><a href="https://github.com/github/codeql-action/commit/8723b5be41df185b62efd22191bb83fc24539ca0"><code>8723b5b</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/2350">#2350</a> from github/angelapwen/add-exclude-pr-check-param</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/f079b8493333aace61c81488f8bd40919487bd9f...b611370bb5703a7efb587f9d136a52ea24c5c38c">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions

</details>

Closes #22927.

PiperOrigin-RevId: 650649011
Change-Id: I4176b221be41b6d2f5086ab8f12e6f77fe806951