Merge branch 'main' into muiriswoulfe/message-filtering

microsoft · Jun 6, 2024 · d4573db · d4573db
2 parents 06ee159 + cc27349
commit d4573db
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 47 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -12,6 +12,9 @@ on:
   pull_request:
     branches:
       - main
+  merge_group:
+    types:
+      - checks_requested
   schedule:
     - cron: 0 0 * * 1
   workflow_dispatch: null
@@ -29,6 +32,9 @@ jobs:
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b  # v4.1.4
         with:
           ref: ${{ github.HEAD_REF }}
+          # Fine-grained Personal Access Token (PAT) with the following permissions for microsoft/PR-Metrics:
+          # - Read access to Metadata
+          # - Read and Write access to Code (aka Contents)
           token: ${{ secrets.BUILD_UPDATE_CODE_CHECKOUT }}
 
       - name: Install Node.js
@@ -270,10 +276,33 @@ jobs:
           print-valid-files: true
           strict: false
 
+  validate-codeql:
+    name: Validate – CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b  # v4.1.4
+
+      - name: Initialize
+        uses: github/codeql-action/init@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff  # v3.25.8
+        with:
+          build-mode: none
+          config-file: .github/linters/codeql.yml
+          languages: javascript-typescript
+          queries: security-extended,security-and-quality
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff  # v3.25.8
+        with:
+          category: TypeScript
+
   validate-linter:
     name: Validate – Linter
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      statuses: write
     steps:
       - name: Checkout
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b  # v4.1.4

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
diff --git a/.github/workflows/release-phase-2.yml b/.github/workflows/release-phase-2.yml
@@ -57,7 +57,7 @@ jobs:
           Write-Output -InputObject "VERSION=v$Version" >> $Env:GITHUB_OUTPUT
 
       - name: GitHub Release
-        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564  # v0.1.15
+        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87  # v0.1.15
         with:
           discussion_category_name: Releases
           files: ${{ github.workspace }}/ms-omex.PRMetrics.vsix