Bump artifact dependencies if `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` enabled by angelapwen · Pull Request #2482 · github/codeql-action

angelapwen · 2024-09-13T18:51:36Z

We need to bump actions/upload-artifact and actions/download-artifact to v4 in our PR checks, as v3 will be deprecated in November: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/

To do so, we also need to bump @actions/artifact to v2, but it is not yet supported on GHES: https://www.npmjs.com/package/@actions/artifact#v2---whats-new

This change would immediately cause customers using v3 of actions/download-artifact in their workflows to see failures, so we are gating it behind an opt-in feature flag for another month. Customers will be able to set the CODEQL_ACTION_ARTIFACT_V4_UPGRADE environment variable to true in their workflows as they upgrade actions/download-artifact to v4.

At the beginning of November, we will set the default value of the feature flag to true and the upgraded version of the artifact dependencies will be the default.

This PR:

imports @actions/artifact@v1 as artifact-legacy and imports @actions/artifact@v2 as artifact
adds a feature flag, defaulting to false, that can be enabled by setting the CODEQL_ACTION_ARTIFACT_V4_UPGRADE environment variable to true
uses the legacy version of the artifact client on GHES or when the CODEQL_ACTION_ARTIFACT_V4_UPGRADE flag is false; and otherwise the upgraded version
adds a PR check that sets CODEQL_ACTION_ARTIFACT_V4_UPGRADE to true, bumping upload-artifact and download-artifact to v4.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Confirm the readme has been updated if necessary.
Confirm the changelog has been updated if necessary.

github-actions · 2024-09-13T19:21:41Z

Pushed a commit to update the checked-in dependencies. Please mark the PR as ready for review to trigger PR checks.

angelapwen · 2024-09-13T21:23:27Z

💭 People who have workflows using download-artifacts@v3 will no longer be able to access the debug artifacts that way (they will need to use @v4) — I'm not sure how many users do that as usually the debug artifacts are more of a manual inspection sort of thing. If we think enough people do that we could add a changenote.

aeisenberg

Nice. Some suggestions inline.

+2,174,754 −72,459

Productive day! 🎉 😄

src/analyze-action-post.ts

src/debug-artifacts.ts

src/start-proxy-action-post.ts

src/upload-sarif-action-post.ts

angelapwen · 2024-09-16T18:50:45Z

Holding on this as I investigate internal reports that #2475 has caused some regressions

…act`

github-actions · 2024-09-25T21:33:11Z

Pushed a commit to update the checked-in dependencies. Please mark the PR as ready for review to trigger PR checks.

henrymercer

Thanks for the extra work here to get this behind a feature flag and provide a smooth upgrade path! ✨

src/debug-artifacts.ts

src/feature-flags.ts

src/debug-artifacts.ts

src/start-proxy-action-post.ts

.github/workflows/debug-artifacts-upgrade.yml

CHANGELOG.md

github-actions · 2024-09-26T20:52:21Z

Pushed a commit to update the checked-in dependencies. Please mark the PR as ready for review to trigger PR checks.

aeisenberg

Looks good. The test makes sense, but I just want to make sure it is easy to maintain.

aeisenberg · 2024-09-26T23:33:08Z

.github/workflows/debug-artifacts-upgrade.yml

+        - stable-v2.13.5
+        - stable-v2.14.6
+        - stable-v2.15.5
+        - stable-v2.16.6
+        - stable-v2.17.6
+        - default
+        - linked
+        - nightly-latest


Are we not testing 2.18 or 2.19? How will we maintain this list going forward? Same question for the set of versions below.

We try to keep the list of versions in the checks that don't use the PR check generator consistent with the sync.py file:

codeql-action/pr-checks/sync.py

Lines 9 to 28 in 46e0c78

defaultTestVersions = [

# The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`

"stable-v2.13.5",

# The last CodeQL release in the 2.14 series.

"stable-v2.14.6",

# The last CodeQL release in the 2.15 series.

"stable-v2.15.5",

# The last CodeQL release in the 2.16 series.

"stable-v2.16.6",

# The last CodeQL release in the 2.17 series.

"stable-v2.17.6",

# The default version of CodeQL for Dotcom, as determined by feature flags.

"default",

# The version of CodeQL shipped with the Action in `defaults.json`. During the release process

# for a new CodeQL release, there will be a period of time during which this will be newer than

# the default version on Dotcom.

"linked",

# A nightly build directly from the our private repo, built in the last 24 hours.

"nightly-latest"

]

. When we update the list in that file, we also update the manually created PR checks.

default is currently 2.19.0, so looks like we'll need to add 2.18.6 to the list. I'll open up a separate internal issue to track that.

CHANGELOG.md

src/debug-artifacts.ts

Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>

henrymercer

This looks great. Just a couple of comments about whether we can avoid the confusion between the npm and Action versions by always talking about the Action versions, in line with the public changelog posts.

CHANGELOG.md

src/debug-artifacts.ts

…ts-rebase

angelapwen · 2024-09-27T20:48:10Z

There is some kind of unrelated CI incident related to Docker so will have to re-run these checks later~

henrymercer

Nice! A couple of small suggestions, but this looks good!

CHANGELOG.md

henrymercer · 2024-09-30T13:40:32Z

src/feature-flags.ts

 */
 export enum Feature {
-  ArtifactV2Upgrade = "artifact_v2_upgrade",
+  ArtifactV4Upgrade = "artifact_v2_upgrade",


Should we also update the name of the feature flag?

Good point — forgot to do that because we don't really use that value. Fixed!

henrymercer · 2024-09-30T13:41:59Z

src/debug-artifacts.ts

+  } else if (!(await features.getValue(Feature.ArtifactV4Upgrade))) {
    logger.info(
-      "Uploading debug artifacts using the `@actions/artifact@v1` client because the value of the relevant feature flag is false. To use the `v2` version of the client, set the `CODEQL_ACTION_ARTIFACT_V2_UPGRADE` environment variable to true.",
+      "Debug artifacts can be consumed with `actions/download-artifact@v3` because the value of the relevant feature flag is false. To use the `actions/download-artifact@v4`, set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to true.",


I'd suggest we drop "because the value of the relevant feature flag is false" here, since customers shouldn't need to know about feature flags.

Makes sense 👍 to them it's just behind an environment variable. Done!

Co-authored-by: Henry Mercer <henrymercer@github.com>

henrymercer

Looks good, just one merge conflict to resolve in the changelog.

angelapwen mentioned this pull request Sep 13, 2024

Bump artifacts dependencies #2461

Closed

3 tasks

angelapwen added the Update dependencies Trigger PR workflow to update dependencies label Sep 13, 2024

github-actions bot removed the Update dependencies Trigger PR workflow to update dependencies label Sep 13, 2024

angelapwen marked this pull request as ready for review September 13, 2024 19:22

angelapwen requested a review from a team as a code owner September 13, 2024 19:22

aeisenberg reviewed Sep 13, 2024

View reviewed changes

src/analyze-action-post.ts Show resolved Hide resolved

src/debug-artifacts.ts Outdated Show resolved Hide resolved

src/start-proxy-action-post.ts Outdated Show resolved Hide resolved

angelapwen commented Sep 13, 2024

View reviewed changes

src/upload-sarif-action-post.ts Outdated Show resolved Hide resolved

angelapwen added 2 commits September 25, 2024 12:06

Install actions/artifact@v1 as artifact-legacy and v2 as `artif…

76b799d

…act`

Update original import statements to use artifact-legacy

6d887c1

angelapwen marked this pull request as draft September 25, 2024 20:09

angelapwen added 2 commits September 25, 2024 13:58

Use new artifact dependency if not on GHES & feature flag enabled

4de3002

Add PR check with feature flag enabled to test upgrade

35684ba

angelapwen force-pushed the angelapwen/bump-artifacts branch from 26b076b to 35684ba Compare September 25, 2024 21:15

Add changenote

4a5884a

angelapwen added the Update dependencies Trigger PR workflow to update dependencies label Sep 25, 2024

github-actions bot removed the Update dependencies Trigger PR workflow to update dependencies label Sep 25, 2024

angelapwen marked this pull request as ready for review September 25, 2024 21:33

angelapwen changed the title ~~Bump artifact dependencies~~ Bump artifact dependencies if CODEQL_ACTION_ARTIFACT_UPGRADE enabled Sep 25, 2024

henrymercer reviewed Sep 26, 2024

View reviewed changes

angelapwen added 5 commits September 26, 2024 13:19

Refactor: remove argument array indirection and pass directly instead

8e4d3c2

Rename feature flag to CODEQL_ACTION_ARTIFACT_V2_UPGRADE

bca51cd

Add log messages at INFO level about which artifact version used

ce99e34

Refactor: reuse getArtifactUploaderClient in start-proxy-action

0c5c594

Update changenote

fbe39bd

angelapwen force-pushed the angelapwen/bump-artifacts branch from e96bc99 to fbe39bd Compare September 26, 2024 20:49

angelapwen added the Update dependencies Trigger PR workflow to update dependencies label Sep 26, 2024

github-actions bot removed the Update dependencies Trigger PR workflow to update dependencies label Sep 26, 2024

Update checked-in dependencies

fd00289

github-actions bot marked this pull request as draft September 26, 2024 20:52

angelapwen marked this pull request as ready for review September 26, 2024 20:52

angelapwen requested a review from henrymercer September 26, 2024 22:56

angelapwen changed the title ~~Bump artifact dependencies if CODEQL_ACTION_ARTIFACT_UPGRADE enabled~~ Bump artifact dependencies if CODEQL_ACTION_ARTIFACT_V2_UPGRADE enabled Sep 26, 2024

aeisenberg reviewed Sep 26, 2024

View reviewed changes

Update CHANGELOG.md

f52494d

Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>

henrymercer reviewed Sep 27, 2024

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

CHANGELOG.md Outdated Show resolved Hide resolved

src/debug-artifacts.ts Outdated Show resolved Hide resolved

angelapwen added 2 commits September 27, 2024 13:05

Refer to download-artifact@v4 everywhere to reduce confusion

7c14037

Merge remote-tracking branch 'origin' into angelapwen/upgrade-artifac…

3788527

…ts-rebase

henrymercer previously approved these changes Sep 30, 2024

View reviewed changes

angelapwen added 2 commits September 30, 2024 16:08

Update feature flag name

6b58e15

Remove logging that mentions feature flags for clarity

d2642b6

angelapwen dismissed henrymercer’s stale review via d2642b6 September 30, 2024 23:10

Update CHANGELOG.md

f29ffe2

Co-authored-by: Henry Mercer <henrymercer@github.com>

henrymercer previously approved these changes Oct 1, 2024

View reviewed changes

Merge branch 'main' into angelapwen/bump-artifacts

29620a0

angelapwen dismissed henrymercer’s stale review via 29620a0 October 1, 2024 15:47

angelapwen requested a review from henrymercer October 1, 2024 16:02

henrymercer approved these changes Oct 1, 2024

View reviewed changes

angelapwen changed the title ~~Bump artifact dependencies if CODEQL_ACTION_ARTIFACT_V2_UPGRADE enabled~~ Bump artifact dependencies if CODEQL_ACTION_ARTIFACT_V4_UPGRADE enabled Oct 1, 2024

angelapwen merged commit a196a71 into main Oct 1, 2024

angelapwen deleted the angelapwen/bump-artifacts branch October 1, 2024 16:59

This was referenced Oct 3, 2024

Merge main into releases/v3 #2522

Merged

Merge releases/v3 into releases/v2 #2524

Merged

chrisgavin mentioned this pull request Oct 21, 2024

upload-sarif post-action step failed: Input required and not supplied: token #2553

Closed

	defaultTestVersions = [
	# The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
	"stable-v2.13.5",
	# The last CodeQL release in the 2.14 series.
	"stable-v2.14.6",
	# The last CodeQL release in the 2.15 series.
	"stable-v2.15.5",
	# The last CodeQL release in the 2.16 series.
	"stable-v2.16.6",
	# The last CodeQL release in the 2.17 series.
	"stable-v2.17.6",
	# The default version of CodeQL for Dotcom, as determined by feature flags.
	"default",
	# The version of CodeQL shipped with the Action in `defaults.json`. During the release process
	# for a new CodeQL release, there will be a period of time during which this will be newer than
	# the default version on Dotcom.
	"linked",
	# A nightly build directly from the our private repo, built in the last 24 hours.
	"nightly-latest"
	]

Conversation

angelapwen commented Sep 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge / deployment checklist

Uh oh!

github-actions bot commented Sep 13, 2024

Uh oh!

angelapwen commented Sep 13, 2024

Uh oh!

aeisenberg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

angelapwen commented Sep 16, 2024

Uh oh!

github-actions bot commented Sep 25, 2024

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Sep 26, 2024

Uh oh!

aeisenberg left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aeisenberg Sep 26, 2024

Choose a reason for hiding this comment

Uh oh!

angelapwen Sep 26, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

angelapwen commented Sep 27, 2024

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henrymercer Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

angelapwen Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

henrymercer Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

angelapwen Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

angelapwen commented Sep 13, 2024 •

edited

Loading

aeisenberg left a comment •

edited

Loading