ewilliams28/releases
1
0
Fork 0
mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-13 03:42:35 -06:00
Code Issues Packages Projects Releases Wiki Activity
6,523 Commits 45 Branches 221 Tags
bf2bb5261cf84958c295dd74e763837e2c021fd8
Commit Graph

403 Commits

Author SHA1 Message Date
Stephan Renatus bf2bb5261c benchmarks: split off script, emit markdown table 
Follow-up to #8811.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-23 16:03:42 +02:00
Sebastian Spaink dec8333b32 deduplicate change-detection output in pr CI checks (#8808) 
follow up to this suggestion from @srenatus:
https://github.com/open-policy-agent/opa/pull/8775#discussion_r3440627903

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-23 14:35:20 +02:00
Stephan Renatus 09679abd11 benchmarks: use details+summary comments for benchlab results (#8811) 
This is how it looked previously:
https://github.com/open-policy-agent/opa/pull/8752#issuecomment-4662153981

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-23 09:59:33 +01:00
Sebastian Spaink 0e6fe9caa2 Add proto schemas for the IR plan and bundle manifest (#8775) 
This adds two new proto schemas:

* v1/bundle/manifest.proto
* v1/ir/plan.proto

---------

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-22 10:02:15 -05:00
dependabot[bot] bfda58ebaf build(deps): bump the gha-dependencies group with 2 updates (#8770) 
Bumps the gha-dependencies group with 2 updates:
[jdx/mise-action](https://github.com/jdx/mise-action) and
[github/codeql-action](https://github.com/github/codeql-action).

Updates `jdx/mise-action` from 4.0.1 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jdx/mise-action/releases">jdx/mise-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0: automatic --locked installs</h2>
<p>This release adds automatic locked installs when a
<code>mise.lock</code> is present, and fixes a long-standing cache-key
collision that could poison tool installs when workflows migrate between
runner providers.</p>
<h2>Added</h2>
<h3>Automatic <code>--locked</code> install when <code>mise.lock</code>
exists (<a
href="https://redirect.github.com/jdx/mise-action/pull/495">#495</a>) by
<a
href="https://github.com/zeitlinger"><code>@​zeitlinger</code></a></h3>
<p>When a repo contains <code>mise.lock</code>, the action now
automatically passes <code>--locked</code> to <code>mise install</code>
(on mise versions that support it). This removes the need to manually
set <code>install_args: --locked</code> and prevents <code>mise
install</code> from silently mutating the lockfile in CI. Explicit
<code>install_args</code> and older mise versions are still
respected.</p>
<p>Note: workflows with a stale lockfile may now fail earlier and more
explicitly instead of silently updating <code>mise.lock</code> mid-run —
this surfaces lockfile drift rather than hiding it.</p>
<h2>Fixed</h2>
<ul>
<li><strong>Cache key collisions across runner providers</strong> (<a
href="https://redirect.github.com/jdx/mise-action/pull/456">#456</a>) —
the default cache key now includes the runner image (e.g.
<code>macos15</code>, <code>ubuntu24</code> for GitHub-hosted runners;
<code>self-hosted</code> otherwise). Previously, repos migrating between
providers like github-hosted, namespace.so, BuildJet, and self-hosted
runners with the same OS/arch could restore a peer provider's
<code>~/.local/share/mise/installs/*</code>, causing failures like
<code>does not have an executable named '…'</code> or SIGILL crashes
from binaries built against a different glibc/CPU featureset. Expect a
one-time cache miss after upgrading; thereafter the cache stays scoped
per image.</li>
<li><strong><code>mise-shim.exe</code> missing on Windows</strong> (<a
href="https://redirect.github.com/jdx/mise-action/pull/476">#476</a>) by
<a href="https://github.com/risu729"><code>@​risu729</code></a> — the
action now installs <code>mise-shim.exe</code> alongside
<code>mise.exe</code> and repairs restored caches that lack the shim.
Fixes <a
href="https://redirect.github.com/jdx/mise-action/issues/475">#475</a>.</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Migrated the bundled action build from ncc (CommonJS) to Rollup
(ESM) (<a
href="https://redirect.github.com/jdx/mise-action/pull/436">#436</a>).
No user-facing behavior change.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0">https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jdx/mise-action/blob/main/CHANGELOG.md">jdx/mise-action's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<hr />
<h2><a
href="https://github.com/jdx/mise-action/compare/v4.0.1..v4.1.0">4.1.0</a>
- 2026-06-04</h2>
<h3>🚀 Features</h3>
<ul>
<li>add wings_enabled input (mise-wings cache integration) (<a
href="https://redirect.github.com/jdx/mise-action/issues/454">#454</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/454">#454</a></li>
<li>lock install when mise.lock is present (<a
href="https://redirect.github.com/jdx/mise-action/issues/495">#495</a>)
by <a href="https://github.com/zeitlinger"><code>@​zeitlinger</code></a>
in <a
href="https://redirect.github.com/jdx/mise-action/pull/495">#495</a></li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li><strong>(ci)</strong> add gh auth setup-git to release-plz.sh (<a
href="https://redirect.github.com/jdx/mise-action/issues/473">#473</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/473">#473</a></li>
<li><strong>(ci)</strong> pin codeql-action with exact version comment
(<a
href="https://redirect.github.com/jdx/mise-action/issues/481">#481</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/481">#481</a></li>
<li>include runner image in cache key to prevent cross-provider
collisions (<a
href="https://redirect.github.com/jdx/mise-action/issues/456">#456</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/456">#456</a></li>
<li>install mise-shim.exe on Windows (<a
href="https://redirect.github.com/jdx/mise-action/issues/476">#476</a>)
by <a href="https://github.com/risu729"><code>@​risu729</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/476">#476</a></li>
</ul>
<h3>⚙️ Miscellaneous Tasks</h3>
<ul>
<li><strong>(ci)</strong> use !cancelled() instead of always() for final
job (<a
href="https://redirect.github.com/jdx/mise-action/issues/460">#460</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/460">#460</a></li>
<li><strong>(ci)</strong> remove autofix.ci workflow (<a
href="https://redirect.github.com/jdx/mise-action/issues/470">#470</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/470">#470</a></li>
<li><strong>(ci)</strong> add zizmor workflow for github actions
security analysis (<a
href="https://redirect.github.com/jdx/mise-action/issues/471">#471</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/471">#471</a></li>
<li><strong>(ci)</strong> close failing or conflicted PRs sooner (<a
href="https://redirect.github.com/jdx/mise-action/issues/480">#480</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/480">#480</a></li>
<li>add communique to enhance release notes (<a
href="https://redirect.github.com/jdx/mise-action/issues/411">#411</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/411">#411</a></li>
<li>migrate from ncc (CJS) to rollup (ESM) (<a
href="https://redirect.github.com/jdx/mise-action/issues/436">#436</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/436">#436</a></li>
<li>add final job to aggregate build-test results (<a
href="https://redirect.github.com/jdx/mise-action/issues/438">#438</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/438">#438</a></li>
<li>migrate package manager from npm/pnpm/bun to aube (<a
href="https://redirect.github.com/jdx/mise-action/issues/455">#455</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/455">#455</a></li>
<li>remove pull_request_target workflow (<a
href="https://redirect.github.com/jdx/mise-action/issues/469">#469</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/469">#469</a></li>
<li>update aube tool version (<a
href="https://redirect.github.com/jdx/mise-action/issues/501">#501</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/501">#501</a></li>
</ul>
<hr />
<h2><a
href="https://github.com/jdx/mise-action/compare/v4.0.0..v4.0.1">4.0.1</a>
- 2026-03-22</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>run npm install in pre-commit hook before build (<a
href="https://redirect.github.com/jdx/mise-action/issues/410">#410</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/410">#410</a></li>
</ul>
<h3>🚜 Refactor</h3>
<ul>
<li>extract getCwd() helper to deduplicate working directory resolution
(<a
href="https://redirect.github.com/jdx/mise-action/issues/403">#403</a>)
by <a href="https://github.com/altendky"><code>@​altendky</code></a> in
<a
href="https://redirect.github.com/jdx/mise-action/pull/403">#403</a></li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>bump versions listed im README.md (<a
href="https://redirect.github.com/jdx/mise-action/issues/407">#407</a>)
by <a href="https://github.com/deining"><code>@​deining</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/407">#407</a></li>
<li>bump more versions listed in README.md (<a
href="https://redirect.github.com/jdx/mise-action/issues/408">#408</a>)
by <a href="https://github.com/deining"><code>@​deining</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/408">#408</a></li>
</ul>
<h3>⚙️ Miscellaneous Tasks</h3>
<ul>
<li>add workflow to auto-close stale PRs (<a
href="https://redirect.github.com/jdx/mise-action/issues/409">#409</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/409">#409</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jdx/mise-action/commit/dba19683ed58901619b14f395a24841710cb4925"><code>dba1968</code></a>
chore: release v4.1.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/490">#490</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/f91a09d9ef7e5b4ce6e5df3bd166d39901d95f80"><code>f91a09d</code></a>
fix(ci): resolve zizmor findings (<a
href="https://redirect.github.com/jdx/mise-action/issues/503">#503</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/a9d72a2ac56857d83f06a89da8b45386a519541e"><code>a9d72a2</code></a>
chore(deps): update github/codeql-action action to v4.36.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/500">#500</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/1f56d953238b8d47fa71c5f59d86a41a4f1f9b30"><code>1f56d95</code></a>
chore(deps): update dependency <code>@​actions/cache</code> to v6.0.1
(<a
href="https://redirect.github.com/jdx/mise-action/issues/497">#497</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/e47eed9a5f11d7b1c4e4a27e094fdee05dfb6db3"><code>e47eed9</code></a>
chore: update aube tool version (<a
href="https://redirect.github.com/jdx/mise-action/issues/501">#501</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/69c24ed9206bc145dcdd8fa072fc6031ceb14c8d"><code>69c24ed</code></a>
chore(deps): update dependency aube to v1.15.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/498">#498</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/76f84078a8bb3d593bdc3ba28edbfeea1882fcae"><code>76f8407</code></a>
chore(deps): update zizmorcore/zizmor-action action to v0.5.4 (<a
href="https://redirect.github.com/jdx/mise-action/issues/488">#488</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/4a84c91c82fa1e7d0a1ea17ff19af79ab26643a1"><code>4a84c91</code></a>
chore(deps): update dependency eslint to v10.4.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/492">#492</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/4d5418b7bac561ef4739f99987686d4b21475743"><code>4d5418b</code></a>
chore(deps): update dependency <code>@​types/node</code> to v24.12.4 (<a
href="https://redirect.github.com/jdx/mise-action/issues/485">#485</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/e6760994f7823b9dc6217632e727fb1ff323c0c0"><code>e676099</code></a>
chore(deps): update dependency typescript-eslint to v8.59.3 (<a
href="https://redirect.github.com/jdx/mise-action/issues/487">#487</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jdx/mise-action/compare/1648a7812b9aeae629881980618f079932869151...dba19683ed58901619b14f395a24841710cb4925">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.36.1 to 4.36.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.2</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a>
from github/update-v4.36.2-dcb947ce1</li>
<li><a
href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a>
Add additional changelog notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a>
Update changelog for v4.36.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a>
from github/update-bundle/codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a>
Update default bundle to codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a>
from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a>
from github/robertbrignull/waitForProcessing_backoff</li>
<li><a
href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a>
from github/henrymercer/cache-cli-version-info</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Charlie Egan <charlie_egan@apple.com>
 2026-06-17 11:37:20 +01:00
Charlie Egan e7d0c0e3d1 docs: Add we/our/us check to spell check (#8787) 
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-06-16 10:32:55 +00:00
Charlie Egan ffd7d46ee4 website: Various updates to node and website deps (#8768) 
Replaces https://github.com/open-policy-agent/opa/pull/8762

Original dependabot updates:

Bumps the website group in /docs with 9 updates:

| Package | From | To |
| --- | --- | --- |
|
[@floating-ui/react](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react)
| `0.27.18` | `0.27.19` |
|
[@iconify/react](https://github.com/iconify/iconify/tree/HEAD/components/react)
| `6.0.0` | `6.0.2` |
| [@mermaid-js/layout-elk](https://github.com/mermaid-js/mermaid) |
`0.1.9` | `0.2.1` |
| [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.4.1` |
| [glob](https://github.com/isaacs/node-glob) | `11.1.0` | `13.0.6` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) |
`0.21.0` | `0.22.1` |
| [recharts](https://github.com/recharts/recharts) | `3.7.0` | `3.8.1` |
|
[baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping)
| `2.10.20` | `2.10.33` |


I have also made some updates to use node 24.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-11 13:23:17 +00:00
dependabot[bot] a440330ea7 build(deps): bump the gha-dependencies group with 3 updates 
Bumps the gha-dependencies group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action) and [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)

Updates `github/codeql-action` from 4.36.0 to 4.36.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463)

Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/ce360397dd3f832beb865e1373c09c0e9f86d70a...06116385d9baf250c9f4dcb4858b16962ea869c3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-dependencies
- dependency-name: github/codeql-action
  dependency-version: 4.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-dependencies
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-10 11:21:39 +02:00
Charlie Egan 85e2477c85 website: Update docusaurus (#8756) 
Also add dependabot for website deps.

---------

Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-06-10 10:13:01 +01:00
Stephan Renatus c15c1ca12c workflows: use go-version-file with actions/setup-go (#8751) 
Just simplifying things a little. Noticed this when putting together
https://github.com/open-policy-agent/opa-envoy-plugin/pull/851

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-09 15:52:07 +01:00
Stephan Renatus 323fb241e9 nightly: use regal@main 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-04 11:51:09 +02:00
dependabot[bot] a8d339aa32 build(deps): bump the gha-dependencies group with 3 updates 
Bumps the gha-dependencies group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `github/codeql-action` from 4.35.3 to 4.36.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)

Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5)

Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...5f14fd08f7cf1cb1609c1e344975f152c7ee938d)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-dependencies
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-dependencies
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 12:18:36 +02:00
Stephan Renatus d04a62b63d workflow: remove tests from docker (edge) image build 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-02 11:37:22 +02:00
Stephan Renatus d474d70750 workflows: bring back docker edge tags for post-merge 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-02 11:05:16 +02:00
Stephan Renatus 68c9de5da0 benchmarks: tweak per-PR benchmark regression check based on pr-check 
We can't run them all. It's too much.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-28 12:09:19 +02:00
Stephan Renatus 3e22f562f1 benchmarks: only run for go changes 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-28 09:47:50 +02:00
Stephan Renatus 13aaeabce2 benchmarks: move env vars, remove zizmor-ignore comment 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-28 09:47:50 +02:00
Stephan Renatus 93e170868a benchmarks: fix PR message, skip tests 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-28 09:47:10 +02:00
Stephan Renatus 4ce3991901 benchmarks: use go tool machinery, add benchstat 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-28 09:18:33 +02:00
Stephan Renatus 41df8df4a2 benchmarks: use benchlab for per-PR feedback 
Hopefully makes stuff a little more robust.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-28 08:53:39 +02:00
Stephan Renatus 7d918f5718 workflows: fix cache-dependency-path warnings in nightly run 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-22 16:40:52 +02:00
Stephan Renatus a444d1e660 workflows: note improvements in benchmark comments 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-19 08:57:26 +02:00
Sebastian Spaink 593559b768 Cleanup post-merge from previous edge release attempt (#8672) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-05-18 11:24:54 -05:00
Charlie Egan 019eec1f03 chore: Push edge binaries to bucket (#8668) 
This will allow us to have a redirect URL for edge binaries from the
website as we had before.

The new secret has been created but will need to merge to get access to
it and test.

Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-05-18 15:52:20 +01:00
Stephan Renatus 1da23e49c5 workflows: fix benchmarks workflow (replace action, avoid stackoverflow) 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-13 14:09:41 +02:00
Johan Fylling acf9aaea4b docs: Add documentation for the future.keywords.not import (#8641) 
Fixes: #8556

Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2026-05-13 13:49:38 +02:00
Stephan Renatus 9445535681 release-vuln-check: fix tools install 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-13 11:10:12 +02:00
dependabot[bot] 2770e3a093 build(deps): bump the gha-dependencies group with 2 updates (#8648) 
Bumps the gha-dependencies group with 2 updates:
[github/codeql-action](https://github.com/github/codeql-action) and
[slackapi/slack-github-action](https://github.com/slackapi/slack-github-action).

Updates `github/codeql-action` from 4.35.2 to 4.35.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.3</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li>
</ul>
<h2>4.33.0 - 16 Mar 2026</h2>
<ul>
<li>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/e46ed2cbd01164d986452f91f178727624ae40d7"><code>e46ed2c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3867">#3867</a>
from github/update-v4.35.3-8c6e48dbe</li>
<li><a
href="https://github.com/github/codeql-action/commit/b73d1d163446ca5e62b96698027210ab41df6a4a"><code>b73d1d1</code></a>
Add changelog entry for <a
href="https://redirect.github.com/github/codeql-action/issues/3853">#3853</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/24e0bb00a931e2a5edb703ce3b22a70f3a3e800b"><code>24e0bb0</code></a>
Reorder changelog entries</li>
<li><a
href="https://github.com/github/codeql-action/commit/ec298daba71cf7592feacbd1c0887cddc0659f62"><code>ec298da</code></a>
Update changelog for v4.35.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/8c6e48dbe051ceb3015c19554831af1b43275f46"><code>8c6e48d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3865">#3865</a>
from github/update-bundle/codeql-bundle-v2.25.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/719098349ea5beae8aa364bf9b71ff1c8d937df2"><code>7190983</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/2bb209555a024d051f6271c8a846b402497f9445"><code>2bb2095</code></a>
Update default bundle to codeql-bundle-v2.25.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/7851e55dc3be31ec4bcc3ef98453de2cb306e698"><code>7851e55</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3850">#3850</a>
from github/mbg/private-registry/cloudsmith-gcp</li>
<li><a
href="https://github.com/github/codeql-action/commit/262a15f6cf4c7a43d6a38ad76392e5e2d4977751"><code>262a15f</code></a>
Add generic non-printable chars test for OIDC configs</li>
<li><a
href="https://github.com/github/codeql-action/commit/a6109b1c07173a53ece3d179a925ff9644d1fabd"><code>a6109b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3853">#3853</a>
from github/mbg/start-proxy/improved-checks</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7">compare
view</a></li>
</ul>
</details>
<br />

Updates `slackapi/slack-github-action` from 3.0.2 to 3.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/slackapi/slack-github-action/releases">slackapi/slack-github-action's
releases</a>.</em></p>
<blockquote>
<h2>Slack GitHub Action v3.0.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>66834e4: feat: add instrumentation to address error rates</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md">slackapi/slack-github-action's
changelog</a>.</em></p>
<blockquote>
<h1>slack-github-action</h1>
<h2>3.0.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>66834e4: feat: add instrumentation to address error rates</li>
</ul>
<h2>3.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>79529d7: fix: resolve url.parse deprecation warning for webhook
techniques</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/45a88b9581bfab2566dc881e2cd66d334e621e2c"><code>45a88b9</code></a>
chore: release</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/1c0bcf08feaa559a9bcfcc249184e13b136ffa55"><code>1c0bcf0</code></a>
chore: release (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/606">#606</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/66834e4b0cad4cbf09ca680587ad8af71d615d4b"><code>66834e4</code></a>
feat: add instrumentation to address error rates (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/600">#600</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/0fe0f902b9f8da107ca0e1314a388c0f57e20d48"><code>0fe0f90</code></a>
build(deps): bump <code>@​actions/github</code> from 9.0.0 to 9.1.1 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/605">#605</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/c5e70597945c255539c5218d4178ed3c7d8188be"><code>c5e7059</code></a>
build(deps): bump <code>@​slack/web-api</code> from 7.15.0 to 7.15.1 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/604">#604</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/0325526875571a27abcfd2b302453a90871abbff"><code>0325526</code></a>
build(deps-dev): bump <code>@​biomejs/biome</code> from 2.4.10 to 2.4.13
(<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/601">#601</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/900cd3e6fa9d6eacd8a5512ecff230d08e65aec7"><code>900cd3e</code></a>
build(deps-dev): bump <code>@​types/node</code> from 24.12.0 to 24.12.2
(<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/603">#603</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/53fdcffeb6e4d34cbdf3276f7beadb0ecc7c9fcd"><code>53fdcff</code></a>
build(deps): bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/602">#602</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/26856cc7fb2c1c2951483645f5fdc3643dbe96eb"><code>26856cc</code></a>
build(deps): bump slackapi/slack-github-action from 3.0.1 to 3.0.2 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/596">#596</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/feba1e29702383a5a3cd5136af0559ba10859b04"><code>feba1e2</code></a>
ci: skip publish step if no release is needed (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/599">#599</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/slackapi/slack-github-action/compare/03ea5433c137af7c0495bc0cad1af10403fc800c...45a88b9581bfab2566dc881e2cd66d334e621e2c">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 14:43:16 +02:00
Stephan Renatus cb94b005f5 build: go install -> go install tool to control checksums 
This is slightly more control, avoiding a supply chain risk.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-12 12:31:04 +02:00
Stephan Renatus d46681187d benchmarks: improve post-merge comment, move cutoff for "failure" to 25% 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-11 09:24:00 +02:00
Stephan Renatus 881a07e8ce post-merge: use and override dev tag 
This is exactly what wasmtime does, maybe it works with immutable github
releases.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-11 09:12:12 +02:00
Sebastian Spaink e0e2af9057 Deploy edge prelease (#8626) 
follow up to: https://github.com/open-policy-agent/opa/pull/8615

The S3 bucket containing the edge release binaries is no longer
available. setup-opa relies on these binaries. This new `Deploy Edge
Prelease` re-introduces edge release by publishing them as a Github
pre-release instead.

On every push to main, after the linux/windows/darwin release builds
complete, a new deploy-edge job deletes any existing edge release and
creates a fresh GitHub prerelease tagged edge with all OPA binaries
attached.

---------

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-05-08 15:28:19 -05:00
Stephan Renatus df98759c2f benchmarks: fix PR comment script 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-08 13:44:44 +02:00
Stephan Renatus 5c535f0019 benchmarks: fix reporting jq call 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-08 11:03:36 +02:00
Stephan Renatus dc77f2e259 workflows: report benchmark regressions back to pull request 
Let's see if this works, it's a bit experimental at this point.

The twist comparred to how it's been done in EOPA (for example) is that
we're running the benchmarks post-merge, and report back if at the end
we find a failing check. This way, the PR goes green without having to
wait for the benchmarks, but there's still a connection between PR and
benchmark.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-08 10:01:50 +02:00
Sebastian Spaink f645d91097 Remove edge releases (#8615) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-05-07 08:47:15 -05:00
Stephan Renatus 192a49a662 workflows: replace setup-zig with mise-action 
The former seems dormant, and we need to deal with the node20
deprecation on github.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-05-04 10:15:17 +02:00
dependabot[bot] b1e1ac4efe build(deps): bump the gha-dependencies group with 2 updates (#8595) 
Bumps the gha-dependencies group with 2 updates:
[actions/cache](https://github.com/actions/cache) and
[slackapi/slack-github-action](https://github.com/slackapi/slack-github-action).

Updates `actions/cache` from 4.2.3 to 5.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<p>When creating cache entries, 429s returned from the cache service
will not be retried.</p>
<h2>v5.0.1</h2>
<blockquote>
<p>[!IMPORTANT]
<strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and
requires a minimum Actions Runner version of
<code>2.327.1</code>.</strong></p>
<p>If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<hr />
<h1>v5.0.1</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]<br />
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.3 <a
href="https://redirect.github.com/actions/cache/pull/1692">#1692</a></li>
</ul>
<h3>5.0.1</h3>
<ul>
<li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via
<code>@actions/cache@5.0.1</code> <a
href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li>
</ul>
<h3>5.0.0</h3>
<blockquote>
<p>[!IMPORTANT]
<code>actions/cache@v5</code> runs on the Node.js 24 runtime and
requires a minimum Actions Runner version of <code>2.327.1</code>.</p>
</blockquote>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/27d5ce7f107fe9357f9df03efb73ab90386fccae"><code>27d5ce7</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1747">#1747</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/cache/commit/f280785d7b6e1884c7d12b9136eb0f4a1574fcfd"><code>f280785</code></a>
licensed changes</li>
<li><a
href="https://github.com/actions/cache/commit/619aeb1606e195be0b36fd0ff68dcf1aff6b65a7"><code>619aeb1</code></a>
npm run build generated dist files</li>
<li><a
href="https://github.com/actions/cache/commit/bcf16c2893940a4899761e55c7ac3c1cf88a04f6"><code>bcf16c2</code></a>
Update ts-http-runtime to 0.3.5</li>
<li><a
href="https://github.com/actions/cache/commit/668228422ae6a00e4ad889ee87cd7109ec5666a7"><code>6682284</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1738">#1738</a>
from actions/prepare-v5.0.4</li>
<li><a
href="https://github.com/actions/cache/commit/e34039626f957d3e3e50843d15c1b20547fc90e2"><code>e340396</code></a>
Update RELEASES</li>
<li><a
href="https://github.com/actions/cache/commit/8a671105293e81530f1af99863cdf94550aba1a6"><code>8a67110</code></a>
Add licenses</li>
<li><a
href="https://github.com/actions/cache/commit/1865903e1b0cb750dda9bc5c58be03424cc62830"><code>1865903</code></a>
Update dependencies &amp; patch security vulnerabilities</li>
<li><a
href="https://github.com/actions/cache/commit/565629816435f6c0b50676926c9b05c254113c0c"><code>5656298</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1722">#1722</a>
from RyPeck/patch-1</li>
<li><a
href="https://github.com/actions/cache/commit/4e380d19e192ace8e86f23f32ca6fdec98a673c6"><code>4e380d1</code></a>
Fix cache key in examples.md for bun.lock</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/5a3ec84eff668545956fd18022155c47e93e2684...27d5ce7f107fe9357f9df03efb73ab90386fccae">compare
view</a></li>
</ul>
</details>
<br />

Updates `slackapi/slack-github-action` from 3.0.1 to 3.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/slackapi/slack-github-action/releases">slackapi/slack-github-action's
releases</a>.</em></p>
<blockquote>
<h2>Slack GitHub Action v3.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>79529d7: fix: resolve url.parse deprecation warning for webhook
techniques</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md">slackapi/slack-github-action's
changelog</a>.</em></p>
<blockquote>
<h1>slack-github-action</h1>
<h2>3.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>79529d7: fix: resolve url.parse deprecation warning for webhook
techniques</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/03ea5433c137af7c0495bc0cad1af10403fc800c"><code>03ea543</code></a>
chore: release</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/90fee45e5a24e9528739e92f00a117715b567f60"><code>90fee45</code></a>
chore: release (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/593">#593</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/b0fbce7f9b4377c9f74655f874e49a08e87de628"><code>b0fbce7</code></a>
ci: send release announcements on publish (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/594">#594</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/0b9c067e72046525581ec13e37caa9d9435cbaec"><code>0b9c067</code></a>
build: automate release packaging and version bumps with changesets (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/592">#592</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/dd817b08e9a373b33f039b7d0ab4328a71425c78"><code>dd817b0</code></a>
docs: update broken hyperlinks to docs (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/591">#591</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/7ce931db3e03539a3974cdb86b42df650e98ce36"><code>7ce931d</code></a>
docs: streamlines doc structure (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/590">#590</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/093434f78f68609806ff1bed395f480e8ada3f8c"><code>093434f</code></a>
build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/589">#589</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/1f09fc7124315577beed7be7ebf027afb94ef524"><code>1f09fc7</code></a>
build(deps-dev): bump typescript from 5.9.3 to 6.0.2 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/584">#584</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/79529d74f960df86c8beb7e51fb8e174fed0c65e"><code>79529d7</code></a>
build(deps): bump axios from 1.14.0 to 1.15.0 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/588">#588</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/4414b7f01f5b1da26c98314521dcc5c802d0419e"><code>4414b7f</code></a>
build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/581">#581</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/slackapi/slack-github-action/compare/af78098f536edbc4de71162a307590698245be95...03ea5433c137af7c0495bc0cad1af10403fc800c">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-01 12:55:31 -05:00
Johan Fylling ccdc35f8d7 ci: skip envoy e2e tests on nightly runs (#8593) 
These require a more advanced setup.
Let's add this at a later time.

Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2026-05-01 10:07:42 +02:00
Stephan Renatus 23ccf9ead3 workflows: print less in benchmark workflow 
It's the printing that takes the longest...

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-04-30 21:31:48 +02:00
Johan Fylling 3937e5370d ci: Test opa-envoy-plugin with nightly OPA build 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2026-04-30 20:45:46 +02:00
Stephan Renatus 7bc92c6075 workflow: update benchmarks notebook generation 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-04-30 15:19:46 +02:00
dependabot[bot] 686c66d717 build(deps): bump the gha-dependencies group with 2 updates (#8576) 
Bumps the gha-dependencies group with 2 updates:
[actions/setup-node](https://github.com/actions/setup-node) and
[github/codeql-action](https://github.com/github/codeql-action).

Updates `actions/setup-node` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Dependency updates:</h3>
<ul>
<li>Upgrade <a
href="https://github.com/actions"><code>@​actions</code></a>
dependencies by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
<li>Update Node.js versions in versions.yml and bump package to v6.4.0
by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"><code>48b55a0</code></a>
Update Node.js versions in versions.yml and bump package to v6.4.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1533">#1533</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9"><code>ab72c7e</code></a>
Upgrade <a href="https://github.com/actions"><code>@​actions</code></a>
dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1525">#1525</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.35.1 to 4.35.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.2</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li>
</ul>
<h2>4.33.0 - 16 Mar 2026</h2>
<ul>
<li>
<p>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p>
<p>To opt out of this change:</p>
<ul>
<li><strong>Repositories owned by an organization:</strong> Create a
custom repository property with the name
<code>github-codeql-file-coverage-on-prs</code> and the type
&quot;True/false&quot;, then set this property to <code>true</code> in
the repository's settings. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing
custom properties for repositories in your organization</a>.
Alternatively, if you are using an advanced setup workflow, you can set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using default setup:</strong> Switch
to an advanced setup workflow and set the
<code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to
<code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using advanced setup:</strong> Set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
</ul>
</li>
<li>
<p>Fixed <a
href="https://redirect.github.com/github/codeql-action/issues/3555">a
bug</a> which caused the CodeQL Action to fail loading repository
properties if a &quot;Multi select&quot; repository property was
configured for the repository. <a
href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p>
</li>
<li>
<p>The CodeQL Action now loads <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom
repository properties</a> on GitHub Enterprise Server, enabling the
customization of features such as
<code>github-codeql-disable-overlay</code> that was previously only
available on GitHub.com. <a
href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p>
</li>
<li>
<p>Once <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registries</a> can be configured with OIDC-based authentication
for organizations, the CodeQL Action will now be able to accept such
configurations. <a
href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p>
</li>
<li>
<p>Fixed the retry mechanism for database uploads. Previously this would
fail with the error &quot;Response body object should not be disturbed
or locked&quot;. <a
href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p>
</li>
<li>
<p>A warning is now emitted if the CodeQL Action detects a repository
property whose name suggests that it relates to the CodeQL Action, but
which is not one of the properties recognised by the current version of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p>
</li>
</ul>
<h2>4.32.6 - 05 Mar 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/95e58e9a2cdfd71adc6e0353d5c52f41a045d225"><code>95e58e9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3824">#3824</a>
from github/update-v4.35.2-d2e135a73</li>
<li><a
href="https://github.com/github/codeql-action/commit/6f31bfe060e817d81e938dbec767969d20031e25"><code>6f31bfe</code></a>
Update changelog for v4.35.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/d2e135a73a39154e3a231aeb49163c4661c5b8b1"><code>d2e135a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3823">#3823</a>
from github/update-bundle/codeql-bundle-v2.25.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/60abb65df09fcf213c398e064c8a80db1f15cdaf"><code>60abb65</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/5a0a562209255e956ad8aafcee303294e64eefa2"><code>5a0a562</code></a>
Update default bundle to codeql-bundle-v2.25.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/65216971a11ded447a6b76263d5a144519e5eee1"><code>6521697</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3820">#3820</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/3c45af2dd258e1623af1898da5c86545b514e028"><code>3c45af2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3821">#3821</a>
from github/dependabot/npm_and_yarn/npm-minor-345b93...</li>
<li><a
href="https://github.com/github/codeql-action/commit/f1c339364c12f922998186ed897e45e3b4ae8874"><code>f1c3393</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/1024fc496c87e944a93e98d8cf2c09e2c7602a30"><code>1024fc4</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/9dd4cfed96030ccdfe1af4daf7a7964322704fed"><code>9dd4cfe</code></a>
Bump the npm-minor group across 1 directory with 6 updates</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-28 16:16:34 -05:00
Stephan Renatus 76a5166b8b workflows: bump setup-regal (#8546) 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-04-22 08:21:37 +00:00
dependabot[bot] 973d83c6e5 build(deps): bump the gha-dependencies group with 3 updates (#8539) 
* build(deps): bump the gha-dependencies group with 3 updates

Bumps the gha-dependencies group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `github/codeql-action` from 4.32.4 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...c10b8064de6f491fea524254123dbe5e09572f13)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f31590499237e7cce841e8e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-dependencies
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* update setup-opa

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-04-21 15:31:38 +00:00
Charlie Egan 8e31a0f1e7 Update Regal docs to v0.40.0 (#8538) 
Add new rule docs, update adopters, and remove automated docs workflow
(broken due to hardening).

Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-04-21 14:32:37 +00:00
Charlie Egan f8c50574d8 Add generated output.jsons for docs examples (#8535) 
This allows us to show the results of example evaluation before the user
clicks evaluate, but also for chatbots to see the output when viewing
without interaction.

Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-04-21 13:01:02 +00:00
Sebastian Spaink 22f8e8d0cd fmt: restore indention level when handling unexpected comments (#8534) 
* fmt: restore indention level when handling unexpected comments

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

* add another test

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

* support "rego-check-pr" in merge group

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

---------

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-04-20 14:57:40 +00:00
Sebastian Spaink d11fece3a3 Fix benchmarks check files changed (#8530) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-04-17 08:35:21 -05:00
Sebastian Spaink f6202bc049 Update benchmarks.yaml to use pr_check.rego (#8526) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-04-17 12:11:14 +00:00