From 4e8e79431d43dd4300c2e8b6bae4d3fdd09f1519 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 26 Feb 2026 18:18:27 +0000 Subject: [PATCH 1/4] Run CodeQL with `linked` tools for merge queue --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 154c21c7b9..ca3942b0b8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -66,7 +66,7 @@ jobs: # # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be # the same as running with `tools: null`. - if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LATEST" ]]; then + if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LATEST" ]]; then VERSIONS_JSON='[null]' else VERSIONS_JSON='[null, "linked"]' From b7d3fb98dfaa2e13619665f7dfe5691617238f43 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 26 Feb 2026 18:19:49 +0000 Subject: [PATCH 2/4] Exclude "Label PR with size" from required checks --- .github/workflows/script/update-required-checks.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/script/update-required-checks.sh b/.github/workflows/script/update-required-checks.sh index 8a930cae74..f6a4c4f5c8 100755 --- a/.github/workflows/script/update-required-checks.sh +++ b/.github/workflows/script/update-required-checks.sh @@ -29,7 +29,7 @@ fi echo "Getting checks for $GITHUB_SHA" # Ignore any checks with "https://", CodeQL, LGTM, Update, and ESLint checks. -CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") or . == "Agent" or . == "Cleanup artifacts" or . == "Prepare" or . == "Upload results" | not)] | unique | sort')" +CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") or . == "Agent" or . == "Cleanup artifacts" or . == "Prepare" or . == "Upload results" or . == "Label PR with size" | not)] | unique | sort')" echo "$CHECKS" | jq From 1b897f391102b857da79a44b42f80dda27b7ac36 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 26 Feb 2026 17:29:58 +0000 Subject: [PATCH 3/4] Fix conditions in code scanning config checks DIff-informed analysis isn't enabled in the merge queue. --- .github/workflows/codescanning-config-cli.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index ca3b554a9f..bf6d90fbf7 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -80,7 +80,7 @@ jobs: # On PRs, overlay analysis may change the config that is passed to the CLI. # Therefore, we have two variants of the following test, one for PRs and one for other events. - name: Empty file (non-PR) - if: github.event_name != 'pull_request' && github.event_name != 'merge_group' + if: github.event_name != 'pull_request' uses: ./../action/.github/actions/check-codescanning-config with: expected-config-file-contents: "{}" @@ -88,7 +88,7 @@ jobs: tools: ${{ steps.prepare-test.outputs.tools-url }} - name: Empty file (PR) - if: github.event_name == 'pull_request' || github.event_name == 'merge_group' + if: github.event_name == 'pull_request' uses: ./../action/.github/actions/check-codescanning-config with: expected-config-file-contents: | From 4406eba03ebd40009c8336528c0af281fa4f20ad Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 27 Feb 2026 12:12:51 +0000 Subject: [PATCH 4/4] Skip uploads in merge queue --- .github/workflows/codeql.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ca3942b0b8..92f5e24b3c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -110,7 +110,7 @@ jobs: uses: ./analyze with: category: "/language:javascript" - upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }} + upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }} analyze-other: if: github.triggering_actor != 'dependabot[bot]' @@ -145,3 +145,4 @@ jobs: uses: ./analyze with: category: "/language:${{ matrix.language }}" + upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}