chore: bump remaining packs to 0.2.3 to match .release.yml#159
Merged
Conversation
.release.yml's version was bumped to 0.2.3 directly (not via a pack version bump), and java/lib was independently bumped to 0.2.3 by PR #155's hotfix. This closes the gap by bringing every other pack's own qlpack.yml version in line, so merging this triggers the real batch publish of everything to 0.2.3 (java/lib is already live and will be a no-op). Also bumps go/ext and python/ext/qlpack.yml for consistency with .release.yml's 'CodeQL Pack Versions' location pattern, even though those two packs aren't wired into publish.yml's matrix yet (tracked by open PR #144). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aligns the repository’s per-pack qlpack.yml versions with the already-bumped .release.yml release version (0.2.3), completing the repo-wide version migration (excluding ql/hotspots, which is explicitly excluded by .release.yml).
Changes:
- Bump remaining language pack
version:values from0.2.2to0.2.3across src/lib packs. - Bump extension packs (
*/extand*/ext-library-sources) to0.2.3for consistency with the release version.
Show a summary per file
| File | Description |
|---|---|
| ruby/src/qlpack.yml | Bumps Ruby queries pack version to 0.2.3. |
| ruby/lib/qlpack.yml | Bumps Ruby libs pack version to 0.2.3. |
| python/src/qlpack.yml | Bumps Python queries pack version to 0.2.3. |
| python/lib/qlpack.yml | Bumps Python libs pack version to 0.2.3. |
| python/ext/qlpack.yml | Bumps Python extensions pack version to 0.2.3. |
| javascript/src/qlpack.yml | Bumps JavaScript queries pack version to 0.2.3. |
| javascript/lib/qlpack.yml | Bumps JavaScript libs pack version to 0.2.3. |
| java/src/qlpack.yml | Bumps Java queries pack version to 0.2.3. |
| java/ext/qlpack.yml | Bumps Java extensions pack version to 0.2.3. |
| java/ext-library-sources/qlpack.yml | Bumps Java library sources pack version to 0.2.3. |
| go/src/qlpack.yml | Bumps Go queries pack version to 0.2.3. |
| go/lib/qlpack.yml | Bumps Go libs pack version to 0.2.3. |
| go/ext/qlpack.yml | Bumps Go extensions pack version to 0.2.3. |
| csharp/src/qlpack.yml | Bumps C# queries pack version to 0.2.3. |
| csharp/lib/qlpack.yml | Bumps C# libs pack version to 0.2.3. |
| csharp/ext/qlpack.yml | Bumps C# extensions pack version to 0.2.3. |
| csharp/ext-library-sources/qlpack.yml | Bumps C# library sources pack version to 0.2.3. |
| cpp/src/qlpack.yml | Bumps C/C++ queries pack version to 0.2.3. |
| cpp/lib/qlpack.yml | Bumps C/C++ libs pack version to 0.2.3. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 19/19 changed files
- Comments generated: 0
- Review effort level: Low
felickz
added a commit
that referenced
this pull request
Jul 10, 2026
…lease process - publish.yml's push trigger now only fires when .release.yml changes (paths filter), not on every push to main. workflow_dispatch remains as the manual escape hatch for one-off hotfix publishes. - Rewrite CONTRIBUTING.md's Releases & publishing section to match: shipping a pack change now just stages it until the next release cut or a manual dispatch; add a Cutting a release walkthrough for update-release.yml/patch-release-me now that .release.yml's CodeQL Pack Versions location (#158) actually drives every pack's version; document the -alpha.N + workflow_dispatch hotfix convention and note #155 as an accepted one-off exception; note #159 as the recovery path if .release.yml's version is ever hand-edited directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
felickz
added a commit
that referenced
this pull request
Jul 10, 2026
felickz
added a commit
that referenced
this pull request
Jul 10, 2026
…+ docs (#160) * feat(publish): add publish-summary table + GitHub Release upsert publish.yml now records a per-pack JSON result fragment (published / up-to-date / failed) from each of the 4 jobs' matrix entries, uploads them as artifacts, and a new summary job downloads and merges them into a unified markdown table (languages x pack types) that is: 1. written to the Actions run summary ($GITHUB_STEP_SUMMARY) 2. upserted into the matching GitHub Release body (.release.yml's version -> vX.Y.Z tag), inside marker comments so "What's Changed" and other release content is preserved across runs New scripts: - .github/scripts/build-publish-summary.sh - .github/scripts/upsert-release-table.sh Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(publish): avoid tee+pipe fragility in Build summary table step The previous form piped the script's stdout through tee and redirected tee's own stdout (not the file write) into GITHUB_STEP_SUMMARY. Combined with 'bash -e' (no pipefail) at the step level, this masked failures and produced an empty summary.md in a real run, upserting empty publish-summary markers into the v0.2.2 release. Switch to plain sequential redirects and add debug output (fragment listing, line/byte counts) to make future failures visible in the step log. * feat(publish): gate auto-publish on .release.yml changes; document release process - publish.yml's push trigger now only fires when .release.yml changes (paths filter), not on every push to main. workflow_dispatch remains as the manual escape hatch for one-off hotfix publishes. - Rewrite CONTRIBUTING.md's Releases & publishing section to match: shipping a pack change now just stages it until the next release cut or a manual dispatch; add a Cutting a release walkthrough for update-release.yml/patch-release-me now that .release.yml's CodeQL Pack Versions location (#158) actually drives every pack's version; document the -alpha.N + workflow_dispatch hotfix convention and note #155 as an accepted one-off exception; note #159 as the recovery path if .release.yml's version is ever hand-edited directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: address Copilot review feedback on PR #160 - Anchor CURRENT_VERSION extraction to '^version:' (with head -1) in all four publish.yml jobs so a stray 'version' substring elsewhere in a qlpack.yml (e.g. a comment) can't be matched instead of the real field. - upsert-release-table.sh: only take the in-place marker-replacement path when BOTH the start and end marker are present in the existing release body; otherwise append, so a corrupted/partial marker pair can't cause the awk script to silently truncate the rest of the release notes. - CONTRIBUTING.md: grammar fix (find/replaces -> finds and replaces). Verified gh release create --notes-file + --generate-notes together is NOT mutually exclusive in gh 2.96.0 (contrary to a review comment) -- confirmed empirically: the v0.2.3 release this script created has both the publish-summary table (from --notes-file) and the auto-generated 'What's Changed' changelog (from --generate-notes) in its body. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * feat(publish): add CodeQL standard library versions cross-check table Every publish.yml run now builds and upserts a second table into the matching GitHub Release: for each language, the locked codeql/<lang>-all version (from lib/codeql-pack.lock.yml) versus the version github/codeql itself bundles with the pinned CodeQL CLI (.codeqlversion), read from its own <lang>/ql/lib/qlpack.yml at tag codeql-cli/v<version>. Mismatches are flagged with an actions warning annotation and a table marker, giving a machine-checkable tripwire for the drift risk documented in CONTRIBUTING.md (CI's 'codeql pack install' step is non-resolving, so a forgotten 'codeql pack upgrade <dir>' after a .codeqlversion bump silently pins a language to a stale library version forever). - Add .github/scripts/build-codeql-lib-versions-table.sh - Parameterize upsert-release-table.sh with an optional block-name arg so multiple independent marker-comment blocks can coexist in one release body without clobbering each other - Wire both into publish.yml's summary job - Document the new table and cross-check in CONTRIBUTING.md Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: mark build-codeql-lib-versions-table.sh executable git-created file lost the exec bit, causing publish.yml's new step to fail with 'Permission denied' (exit 126). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(build-codeql-lib-versions-table): check src lock file, not lib CONTRIBUTING.md's 'Supported CodeQL versions' table already documents <language>/src/codeql-pack.lock.yml as the source-of-truth lock file (the queries pack CI actually compiles/tests against), not lib. Reading from lib/codeql-pack.lock.yml instead meant the tripwire could miss drift in the src lock, or flag drift that didn't actually affect the compiled queries. Switch the check (and its remediation guidance) to src, per Copilot review feedback on PR #160. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * feat(publish): commit/tag-anchored links + queries pack in lib-versions table - Discover direct codeql/* dependencies dynamically from each language's src/qlpack.yml instead of hardcoding codeql/<lang>-all, so this also covers codeql/<lang>-queries for C++/C# (which additionally depend on the upstream standard queries pack). - Link every "our locked" version to the exact commit/file/line in this repo (blob/<GITHUB_SHA>/...#L<n>) and every "upstream" version to the exact file/line in github/codeql at the matching codeql-cli/vX tag, so each row can be verified with one click instead of trusting the table. - Rename the section/table to "CodeQL standard library & query pack versions" and update CONTRIBUTING.md references accordingly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * feat: automate CodeQL CLI version bump detection and dependency refresh Adds the two workflows needed to close the gap identified while reviewing PR #118 (codeql pack upgrade weekly cron): - detect-codeql-release.yml: weekly (+ workflow_dispatch) tripwire that compares .codeqlversion against github/codeql-cli-binaries' latest release and keeps a single tracking issue open/updated while behind, auto-closing it once caught up. Never opens a PR itself. - update-codeql-version.yml: workflow_dispatch with a codeql_version input. Bumps .codeqlversion, runs codeql pack upgrade <dir> for every pack, and opens a PR via the same GitHub App token pattern as update-release.yml so CI actually runs on it (a GITHUB_TOKEN-authored PR would not trigger downstream workflows). Together these cover detection + mechanical dependency refresh; fixing compile/test breakage from upstream API changes and bumping each pack's own version: still needs a human (or delegated Copilot coding agent) - documented as a 3-step process in CONTRIBUTING.md. Rewrites CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library version" section to describe this new process and adds reference-style links for both new workflows and codeql-cli-binaries. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(publish): gate release-table upsert to push trigger, clarify failed-check cell Two fixes from Copilot review on PR #160: - publish.yml: only run the "Upsert release table" step on the push (release-cut) trigger, not workflow_dispatch. A manual one-off hotfix publish (see CONTRIBUTING.md) still points .release.yml at the last cut release, so upserting that run's tables into it would overwrite an already-published release's notes with a misleading summary of an unrelated hotfix run. - build-publish-summary.sh: when a pack's version-check step itself fails, previous_version can be empty/null, which rendered as the confusing "publish failed (still ``)". Now shows an explicit "previous version unknown" message in that case. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(publish): check both src and lib lock files for CodeQL version drift src/qlpack.yml and lib/qlpack.yml each declare their own codeql/<lang>-all dependency and resolve it into their own independent codeql-pack.lock.yml. Nothing keeps these two lock files in sync automatically - codeql pack upgrade resolves each pack directory separately, so running it against one and not the other silently lets them drift. The standard-library-versions table previously only checked src as a 'coarse signal', which meant a stale lib lock could go undetected while the table showed all green. Now checks both src and lib for every language (ext/ext-library-sources are still out of scope: they pin via extensionTargets, not dependencies, so CodeQL never resolves a locked version for them). Adds a Pack column to the table to distinguish rows. Also updates CONTRIBUTING.md's Supported CodeQL versions section, which similarly implied a single lock file was the source of truth per language. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: fix publish.yml job count in CONTRIBUTING.md (five jobs, not four) CONTRIBUTING.md said publish.yml is organized as four jobs, but it also has a fifth 'summary' job (needs: [queries, library, extensions, library_sources_extensions], if: always()) that aggregates results into the publish-summary and CodeQL lib-versions tables and upserts them into the Release notes. Clarify the doc to describe all five. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(publish): don't fail check_version when a pack's GHCR container doesn't exist yet All four publish jobs (queries/library/extensions/library_sources_extensions) read the currently-published version via 'gh api .../versions'. run: steps default to bash -e, so a 404 (package never published, e.g. a brand-new language/pack) aborted the step and failed the job before it could ever publish that pack for the first time. Move '|| true' inside the command substitution so a fetch failure just leaves PUBLISHED_VERSION empty (correctly differing from CURRENT_VERSION, triggering a first publish) instead of killing the step under set -e. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
.release.yml'sversion:was bumped straight to0.2.3directly onmain(not via theupdate-release.yml/patch-release-metool, and not via a per-pack bump), andjava/libwas independently bumped to0.2.3by #155's fatal-crash hotfix. That left the repo in a "half-migrated" state:.release.ymlclaimed0.2.3but only 1 of 19 packs actually was.What this does
Bumps every remaining pack's own
qlpack.ymlversion:from0.2.2→0.2.3, so this now matches.release.ymlfor real (java/libalready at0.2.3is untouched).publish.yml(cpp, csharp, go, java, javascript, python, ruby —src/lib, pluscsharp/javaext/ext-library-sources)go/extandpython/ext— not yet wired intopublish.yml's matrix (that's Add python and go extension to publish workflow #144), but still matched by.release.yml's "CodeQL Pack Versions" location pattern, so bumped here too for consistency.What happens after merge
publish.ymltriggers on the merge push and does a real batch publish: every pack exceptjava/lib(already live at0.2.3, so a no-op) will publish0.2.3to GHCR.Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com