From 444333376e064d207fe1dc74e881528bf11649c1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:34:02 +0000 Subject: [PATCH 1/4] Update changelog for v4.39.0 --- CHANGELOG.md | 5 ++++- unreleased-change-notes/analyze-checkout-path-validation.md | 1 - unreleased-change-notes/restore-keys.md | 1 - unreleased-change-notes/start-proxy-setup-logic.md | 1 - 4 files changed, 4 insertions(+), 4 deletions(-) delete mode 100644 unreleased-change-notes/analyze-checkout-path-validation.md delete mode 100644 unreleased-change-notes/restore-keys.md delete mode 100644 unreleased-change-notes/start-proxy-setup-logic.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 8ce2edd612..1a55f7e091 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,12 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.39.0 - 15 Oct 2026 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205) +- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148) +- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206) +- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198) ## 4.38.3 - 08 Oct 2026 diff --git a/unreleased-change-notes/analyze-checkout-path-validation.md b/unreleased-change-notes/analyze-checkout-path-validation.md deleted file mode 100644 index 4704376a47..0000000000 --- a/unreleased-change-notes/analyze-checkout-path-validation.md +++ /dev/null @@ -1 +0,0 @@ -- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148) diff --git a/unreleased-change-notes/restore-keys.md b/unreleased-change-notes/restore-keys.md deleted file mode 100644 index 3612c1b607..0000000000 --- a/unreleased-change-notes/restore-keys.md +++ /dev/null @@ -1 +0,0 @@ -- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206) diff --git a/unreleased-change-notes/start-proxy-setup-logic.md b/unreleased-change-notes/start-proxy-setup-logic.md deleted file mode 100644 index fc3582843e..0000000000 --- a/unreleased-change-notes/start-proxy-setup-logic.md +++ /dev/null @@ -1 +0,0 @@ -- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198) From eb1c428e6e3725d2b527aec0ee5db4303c8f669d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 15 Oct 2026 11:39:58 +0100 Subject: [PATCH 2/4] Trigger workflows From 2edace40f1e5c872d3d716e1ba7d855811e3c47d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:57:06 +0000 Subject: [PATCH 3/4] Update changelog and version after v4.39.0 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1a55f7e091..b63b79671b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.39.0 - 15 Oct 2026 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205) diff --git a/package-lock.json b/package-lock.json index 42ba4bf1ce..d702b0f6f5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.39.0", + "version": "4.39.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.39.0", + "version": "4.39.1", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 755d561f10..209ded6797 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.39.0", + "version": "4.39.1", "private": true, "description": "CodeQL action", "scripts": { From 46d3daa879c9e3d2fad3711ac53836cf88e33e53 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:57:15 +0000 Subject: [PATCH 4/4] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 650857e9c3..824d554aef 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -170183,7 +170183,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.39.0"; + return "4.39.1"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);