Merge branch 'main' into python-mcp-models

Author: Alex-Hofer

.bazelversion

@@ -1 +1 @@
-9.0.0
+9.3.1

.github/instructions/expected-files.instructions.md

@@ -1,4 +1,4 @@
 ---
 applyTo: "**/*.expected"
 ---
-Ignore these files. These are generated to be correct by running the tests, and should not be edited manually.
+Do not edit these files directly. They are generated by running the tests. If a `.expected` file has a non-empty `testFailures `section it should not be committed - you may want to update the inline expectation comments in the corresponding test source file (e.g. marking expected results as `MISSING` / `SPURIOUS`) then re-run the test.

.github/skills/bazel/SKILL.md

@@ -81,9 +81,8 @@ the platform string here; use `os.bzl`.
 
 [`codeql_platform_select`](../../../misc/bazel/os.bzl) takes one keyword argument per CodeQL platform: `linux64`,
 `linux_arm64`, `osx64` and `win64`. `otherwise` supplies the value for whichever of those you leave unset; it is **not**
-a `//conditions:default`. **There is deliberately no fallback from `linux_arm64` to `linux64`.** If you only care about
-the OS, use `os_select`, which gives Linux the same value on both architectures and has a `posix` shorthand for the
-shared Linux/macOS value.
+a `//conditions:default`. If you only care about the OS, use `os_select`, which gives Linux the same value on both
+architectures and has a `posix` shorthand for the shared Linux/macOS value.
 
 In a macro (no `ctx`) it returns a `select()`:
 

.github/workflows/csv-coverage-pr-artifacts.yml

@@ -47,10 +47,10 @@ jobs:
           git checkout HEAD^1
           git log -1 --format='%H'
         working-directory: base
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./merge/.github/actions/fetch-codeql
       - name: Generate CSV files on merge commit of the PR

.github/workflows/csv-coverage-pr-comment.yml

@@ -25,10 +25,10 @@ jobs:
       run: echo "$GITHUB_CONTEXT"
     - name: Clone self (github/codeql)
       uses: actions/checkout@v5
-    - name: Set up Python 3.8
+    - name: Set up Python 3.12
       uses: actions/setup-python@v4
       with:
-        python-version: 3.8
+        python-version: "3.12"
 
     - name: Check coverage difference file and comment
       env:

.github/workflows/csv-coverage-timeseries.yml

@@ -20,10 +20,10 @@ jobs:
         with:
           path: codeqlModels
           fetch-depth: 0
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./script/.github/actions/fetch-codeql
       - name: Build modeled package list

.github/workflows/csv-coverage-update.yml

@@ -25,10 +25,10 @@ jobs:
         with:
           path: ql
           fetch-depth: 0
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./ql/.github/actions/fetch-codeql
       - name: Generate coverage files

.github/workflows/csv-coverage.yml

@@ -24,10 +24,10 @@ jobs:
         with:
           path: codeqlModels
           ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./script/.github/actions/fetch-codeql
       - name: Build modeled package list

.github/workflows/label-external-contributions.yml

@@ -13,7 +13,9 @@ concurrency:
 
 jobs:
   label:
-    if: github.ref_name == github.event.repository.default_branch
+    if: >-
+      github.repository == 'github/codeql' &&
+      github.ref_name == github.event.repository.default_branch
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/query-list.yml

@@ -26,10 +26,10 @@ jobs:
       uses: actions/checkout@v5
       with:
         path: codeql 
-    - name: Set up Python 3.8
+    - name: Set up Python 3.12
       uses: actions/setup-python@v4
       with:
-        python-version: 3.8
+        python-version: "3.12"
     - name: Download CodeQL CLI
       # Look under the `codeql` directory, as this is where we checked out the `github/codeql` repo
       uses: ./codeql/.github/actions/fetch-codeql