deps(chat-cli): update openai requirement from >=2.45.0 to >=2.46.0 in /ai-projects/chat-cli in the chat-cli-deps group #4080

Workflow file for this run

	# yamllint disable rule:key-ordering
	# cspell:ignore SARIF sarif
	# CodeQL Advanced workflow for the Aria repository.
	#
	# Tuned for MAXIMUM security signal with INTEGRATED AUTOFIX:
	# - All repo languages covered (Python, JS/TS, GitHub Actions; C/C++ via
	# buildless analysis). HTML is analyzed as part of
	# javascript-typescript.
	# - Query packs: security-extended + security-and-quality + experimental
	# security queries, plus community security packs (when available).
	# - Threat model coverage expanded via a CodeQL config file that:
	# * Includes additional CWE-focused query suites.
	# * Disables noisy path filters so generated / vendored code that ships
	# to users is still scanned (only true third-party deps excluded).
	# * Enables ML-powered queries for JS/TS.
	# - Runs on every push to main, every PR (incl. draft), weekly schedule, and
	# manual dispatch — so nothing slips through.
	# - Pinned actions to immutable SHAs (OpenSSF Scorecard).
	# - Strict, least-privilege permissions.
	# - Hardened runner with egress auditing.
	# - Autofix integration:
	# 1. Copilot Autofix is automatically applied to uploaded SARIF results
	# (when enabled at the repo/org level — see Settings → Code security).
	# 2. A separate `autofix` job runs language-native fixers (ruff, eslint,
	# prettier, clang-format) on PRs and pushes suggested fixes back to
	# the PR branch, or opens a follow-up PR on scheduled / manual runs.
	# 3. A `dependency-review` job blocks PRs that introduce vulnerable
	# dependencies.

	concurrency:
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}
	group: codeql-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.head_ref) \|\| github.ref }}
	defaults:
	run:
	shell: bash
	env:
	ACTIONS_CACHE_SHA: 1bd1e32a3bdc45362d1e726936510720a7c30a57
	CHECKOUT_SHA: 11bd71901bbe5b1630ceea73d27597364c9af683
	CODEQL_ACTION_SHA: 4e828ff8d448a8a6e532957b1811f387a63867e8
	CREATE_PR_SHA: 67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
	DEPENDENCY_REVIEW_SHA: da24556b548a50705dd671f47852072ea4c105d9
	HARDEN_RUNNER_SHA: 0634a2670c59f64b4a01f0f96f84700a4088b9f0
	RUFF_VERSION: '>=0.6,<1.0'
	SETUP_NODE_SHA: 49933ea5288caeca8642d1e84afbd3f7d6820020
	SETUP_PYTHON_SHA: a26af69be951a213d495a4c3e4e4022e16d87065
	UPLOAD_ARTIFACT_SHA: 65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	permissions:
	actions: read
	contents: read
	packages: read
	security-events: write
	runs-on: ${{ matrix.os }}
	steps:
	- name: Harden runner
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
	with:
	disable-sudo: false
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Initialize CodeQL
	uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8
	with:
	build-mode: ${{ matrix.build-mode }}
	config-file: ./.github/codeql/codeql-config.yml
	languages: ${{ matrix.language }}

	- id: analyze
	name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8
	with:
	category: '/language:${{ matrix.language }}'
	output: ${{ runner.temp }}/sarif-${{ matrix.language }}
	upload: always
	wait-for-processing: true

	- if: always()
	name: Upload SARIF as artifact (debug / archival)
	uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
	with:
	if-no-files-found: warn
	name: codeql-sarif-${{ matrix.language }}
	path: ${{ runner.temp }}/sarif-${{ matrix.language }}
	retention-days: 30
	strategy:
	fail-fast: false
	matrix:
	include:
	- build-mode: none
	language: actions
	os: ubuntu-latest

	- build-mode: none
	language: javascript-typescript
	os: ubuntu-latest

	- build-mode: none
	language: python
	os: ubuntu-latest

	- build-mode: none
	language: c-cpp
	os: ubuntu-latest
	timeout-minutes: 360
	timeout-minutes: 360

	autofix:
	if: >-
	(github.event_name == 'pull_request' \|\|
	github.event_name == 'push' \|\|
	github.event_name == 'schedule' \|\|
	(github.event_name == 'workflow_dispatch' && inputs.run_autofix))
	name: Auto-fix (lint / format)
	needs: analyze
	permissions:
	contents: write
	pull-requests: write
	runs-on: ubuntu-latest
	steps:
	- name: Harden runner
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
	with:
	disable-sudo: false
	egress-policy: audit

	- env:
	EVENT_NAME: ${{ github.event_name }}
	PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
	PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
	PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
	REF_NAME: ${{ github.ref_name }}
	REPOSITORY: ${{ github.repository }}
	id: ref
	name: Determine checkout ref
	run: \|
	set -euo pipefail
	{
	if [ "$EVENT_NAME" = "pull_request" ]; then
	# Use the commit SHA for checkout so the step succeeds even when
	# the PR branch is deleted before the workflow fetches (e.g. after
	# an auto-delete-on-merge). Store the branch name separately as
	# push_ref for the optional push-back step.
	echo "ref=$PR_HEAD_SHA"
	echo "push_ref=$PR_HEAD_REF"
	echo "repo=$PR_HEAD_REPO"
	if [ "$PR_HEAD_REPO" = "$REPOSITORY" ]; then
	echo "can_push=true"
	else
	echo "can_push=false"
	fi
	else
	echo "ref=$REF_NAME"
	echo "push_ref=$REF_NAME"
	echo "repo=$REPOSITORY"
	echo "can_push=false"
	fi
	} >> "$GITHUB_OUTPUT"

	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
	with:
	fetch-depth: 0
	persist-credentials: true
	ref: ${{ steps.ref.outputs.ref }}
	repository: ${{ steps.ref.outputs.repo }}

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
	with:
	cache: 'pip'
	python-version: '3.12'

	- name: Set up Node.js
	uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
	with:
	node-version: '22'

	- name: Cache pip
	uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
	with:
	key: ${{ runner.os }}-pip-${{ hashFiles('*/requirements.txt') }}
	path: ~/.cache/pip
	restore-keys: \|
	${{ runner.os }}-pip-

	- name: Cache npm
	uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
	with:
	key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
	path: \|
	~/.npm
	~/.cache
	restore-keys: \|
	${{ runner.os }}-node-

	- name: Install autofix tooling
	run: \|
	set -euo pipefail
	python -m pip install --upgrade pip
	pip install "ruff${{ env.RUFF_VERSION }}"

	if [ -f package.json ]; then
	if [ -f package-lock.json ]; then
	npm ci --no-audit --no-fund \|\| npm install --no-audit --no-fund
	else
	npm install --no-audit --no-fund
	fi
	# Ensure prettier is available to npx for later steps.
	npx --no-install prettier --version >/dev/null 2>&1 \|\| npm install --no-audit --no-fund --no-save prettier@3
	else
	npm install --global --no-fund --no-audit prettier@3
	fi

	if git ls-files -- '.c' '.cc' '.cpp' '.cxx' '.h' '.hh' '.hpp' '.hxx' ':(exclude).github/workflows/**' \| grep -q .; then
	echo "::notice::C/C++ files detected; attempting to install clang-format"
	sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq \|\| true
	sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends clang-format \|\| true
	else
	echo "No C/C++ files detected; skipping clang-format install."
	fi

	- continue-on-error: true
	name: Run ruff --fix (Python)
	run: \|
	set -euo pipefail
	RUN_UNSAFE="false"
	if [ "${{ github.event_name }}" = "workflow_dispatch" ] \|\| [ "${{ github.event_name }}" = "schedule" ]; then
	if [ "${{ inputs.allow_unsafe_fixes }}" = "true" ]; then
	RUN_UNSAFE="true"
	fi
	fi
	if [ "$RUN_UNSAFE" = "true" ]; then
	ruff check --fix --unsafe-fixes --exit-zero .
	else
	ruff check --fix --exit-zero .
	fi
	ruff format .

	- continue-on-error: true
	name: Run eslint --fix (if configured)
	run: \|
	set -euo pipefail
	if [ -f package.json ]; then
	if npx --no-install eslint --version >/dev/null 2>&1; then
	npx eslint --fix --ext .js,.jsx,.ts,.tsx . \|\| true
	else
	echo "eslint not installed locally; skipping eslint --fix."
	fi
	else
	echo "No package.json found; skipping eslint --fix."
	fi

	- continue-on-error: true
	name: Run prettier --write (JS/TS/JSON/YAML/MD/CSS/HTML)
	run: \|
	set -euo pipefail
	if [ -f package.json ]; then
	npx --no-install prettier --write --ignore-unknown \
	"*/.{js,jsx,ts,tsx,mjs,cjs,json,yml,yaml,md,css,scss,html}" \
	"!/node_modules/" \
	"!/.venv/" \
	"!/venv/" \
	"!/dist/" \
	"!/build/" \
	"!/vendor/" \
	"!/third_party/" \
	"!/third-party/" \
	"!/datasets/" \
	"!*/.min.*" \
	"!/.github/workflows/" \|\| true
	else
	prettier --write --ignore-unknown \
	"*/.{js,jsx,ts,tsx,mjs,cjs,json,yml,yaml,md,css,scss,html}" \
	"!/node_modules/" \
	"!/.venv/" \
	"!/venv/" \
	"!/dist/" \
	"!/build/" \
	"!/vendor/" \
	"!/third_party/" \
	"!/third-party/" \
	"!/datasets/" \
	"!*/.min.*" \
	"!/.github/workflows/" \|\| true
	fi

	- continue-on-error: true
	name: Run clang-format (C/C++)
	run: \|
	set -euo pipefail
	mapfile -t files < <(git ls-files -- '.c' '.cc' '.cpp' '.cxx' '.h' '.hh' '.hpp' '.hxx' ':(exclude).github/workflows/**' 2>/dev/null \|\| true)
	if [ "${#files[@]}" -gt 0 ]; then
	clang-format -i --style=file --fallback-style=LLVM "${files[@]}" \|\| true
	else
	echo "No C/C++ files to format."
	fi

	- name: Revert workflow file changes (permissions-safe)
	run: \|
	set -euo pipefail
	git restore --staged --worktree -- .github/workflows \|\| true

	- id: diff
	name: Detect changes
	run: \|
	set -euo pipefail
	if git diff --quiet --exit-code; then
	echo "changed=false" >> "$GITHUB_OUTPUT"
	echo "No autofix changes."
	else
	echo "changed=true" >> "$GITHUB_OUTPUT"
	git --no-pager diff --stat
	fi

	- env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PUSH_REF: ${{ steps.ref.outputs.push_ref }}
	if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'true'
	name: Commit fixes to PR branch
	run: \|
	set -euo pipefail
	git config user.name "github-actions[bot]"
	git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
	git add -A
	git commit -m "style: apply automated autofixes (ruff / prettier / clang-format) [CodeQL Advanced]" \|\| echo "No commit created"
	if git ls-remote --heads origin "$PUSH_REF" \| grep -q .; then
	git push origin "HEAD:$PUSH_REF"
	else
	echo "PR branch '$PUSH_REF' no longer exists on the remote; skipping push."
	fi

	- if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
	name: Produce patch artifact (fork PRs)
	run: \|
	set -euo pipefail
	git diff > autofix.patch \|\| true
	echo "Patch produced."

	- if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
	name: Upload patch artifact
	uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
	with:
	name: autofix-patch
	path: autofix.patch
	retention-days: 14

	- if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'false'
	name: Comment patch link on fork PR
	uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
	with:
	script: \|
	const pr = context.payload.pull_request;
	if (!pr) return;

	const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
	const marker = '<!-- codeql-autofix-patch -->';
	const body = [
	marker,
	'### 🛠️ Autofix patch available',
	'',
	'This PR is from a fork, so the workflow cannot push directly.',
	`Download the patch from the [workflow run artifacts](${runUrl}) and apply with:`,
	'',
	'```bash',
	'git apply autofix.patch',
	'```',
	].join('\n');

	const comments = await github.paginate(github.rest.issues.listComments, {
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: pr.number,
	per_page: 100,
	});

	const existing = comments.find(comment =>
	comment.user?.login === 'github-actions[bot]' &&
	typeof comment.body === 'string' &&
	comment.body.includes(marker)
	);

	if (existing) {
	await github.rest.issues.updateComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	comment_id: existing.id,
	body,
	});
	} else {
	await github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: pr.number,
	body,
	});
	}

	- if: >-
	steps.diff.outputs.changed == 'true' &&
	(github.event_name == 'push' \|\|
	github.event_name == 'schedule' \|\|
	(github.event_name == 'workflow_dispatch' && inputs.open_autofix_pr))
	name: Open autofix follow-up PR
	uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
	with:
	base: ${{ github.ref_name }}
	body: \|
	Automated cleanup pushed by the CodeQL Advanced workflow.

	Tools applied:
	- `ruff check --fix` + `ruff format` (unsafe fixes only enabled when allow_unsafe_fixes=true on scheduled/manual runs)
	- `prettier --write`
	- `eslint --fix` (if configured in the repository)
	- `clang-format -i --style=file` (when C/C++ files are present)

	Triggered by: `${{ github.event_name }}` on `${{ github.ref }}` (run [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})).
	branch: chore/codeql-autofix-${{ github.run_id }}
	commit-message: \|
	style: apply automated autofixes (ruff / prettier / clang-format)
	delete-branch: true
	labels: \|
	automated
	autofix
	auto-merge
	chore
	sign-commits: true
	title: 'style: automated autofixes from CodeQL workflow'
	token: ${{ secrets.GITHUB_TOKEN }}
	timeout-minutes: 20

	copilot-autofix-summary:
	if: github.event_name == 'pull_request'
	name: Copilot Autofix Summary
	needs: analyze
	permissions:
	contents: read
	pull-requests: write
	security-events: read
	runs-on: ubuntu-latest
	steps:
	- name: Harden runner
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
	with:
	egress-policy: audit

	- name: Summarize code scanning alerts + autofixes for this PR
	uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
	with:
	script: \|
	const pr = context.payload.pull_request;
	if (!pr) return;

	const marker = '<!-- codeql-autofix-summary -->';

	const comments = await github.paginate(github.rest.issues.listComments, {
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: pr.number,
	per_page: 100,
	});

	const existing = comments.find(comment =>
	comment.user?.login === 'github-actions[bot]' &&
	typeof comment.body === 'string' &&
	comment.body.includes(marker)
	);

	const alerts = await github.paginate(github.rest.codeScanning.listAlertsForRepo, {
	owner: context.repo.owner,
	repo: context.repo.repo,
	state: 'open',
	ref: `refs/pull/${pr.number}/head`,
	per_page: 100,
	}).catch(err => {
	core.warning(`Could not list alerts: ${err.message}`);
	return [];
	});

	if (!alerts.length) {
	core.info('No open code scanning alerts on this PR.');
	if (existing) {
	const body = [
	marker,
	'### 🔐 CodeQL — Open Alerts on this PR',
	'',
	'✅ No open CodeQL alerts detected for this PR.',
	].join('\n');

	await github.rest.issues.updateComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	comment_id: existing.id,
	body,
	});
	}
	return;
	}

	const bySeverity = alerts.reduce((acc, a) => {
	const sev = a.rule?.security_severity_level \|\| a.rule?.severity \|\| 'note';
	acc[sev] = (acc[sev] \|\| 0) + 1;
	return acc;
	}, {});

	const lines = [
	marker,
	'### 🔐 CodeQL — Open Alerts on this PR',
	'',
	'\| Severity \| Count \|',
	'\| --- \| --- \|',
	...Object.entries(bySeverity).map(([k, v]) => `\| \`${k}\` \| ${v} \|`),
	'',
	`Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.`,
	`See the full list in the [Security tab](${pr.base.repo.html_url}/security/code-scanning?query=pr%3A${pr.number}).`,
	];

	const body = lines.join('\n');
	if (existing) {
	await github.rest.issues.updateComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	comment_id: existing.id,
	body,
	});
	} else {
	await github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: pr.number,
	body,
	});
	}
	timeout-minutes: 10

	dependency-review:
	if: github.event_name == 'pull_request'
	name: Dependency Review
	permissions:
	contents: read
	pull-requests: write
	runs-on: ubuntu-latest
	steps:
	- name: Harden runner
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
	with:
	disable-sudo: true
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
	with:
	fetch-depth: 0
	persist-credentials: false

	- id: deps_changed
	name: Check for dependency file changes
	run: \|
	# cspell:ignore pyproject
	set -euo pipefail
	BASE_REF="${{ github.event.pull_request.base.ref }}"
	[ -z "$BASE_REF" ] && { echo "::error::BASE_REF is empty"; exit 1; }
	git fetch --no-tags --depth=1 origin "$BASE_REF" \|\| true
	files=$(git diff --name-only "origin/$BASE_REF...HEAD" \|\| true)
	echo "::debug::Files changed in PR: $files"
	if echo "$files" \| grep -E -q '(^\|/)(package.json\|package-lock.json\|yarn.lock\|pyproject.toml\|requirements(\.txt)?\|Pipfile\|setup\.py\|poetry.lock\|go.mod\|Gemfile\|pom.xml)'; then
	echo "changed=true" >> "$GITHUB_OUTPUT"
	else
	echo "changed=false" >> "$GITHUB_OUTPUT"
	fi

	- if: steps.deps_changed.outputs.changed == 'true'
	name: Dependency Review
	uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9
	with:
	comment-summary-in-pr: on-failure
	deny-licenses: AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later
	fail-on-severity: high

	- if: steps.deps_changed.outputs.changed != 'true'
	name: Skip dependency review (no relevant files changed)
	run: \|
	echo "No dependency files modified; skipping Dependency Review."
	timeout-minutes: 10
	name: 'CodeQL'
	on:
	pull_request:
	branches: ['main']
	paths-ignore:
	- '*/.md'
	- '*/.rst'
	- 'docs/**'
	- '.github/ISSUE_TEMPLATE/**'
	- '.github/PULL_REQUEST_TEMPLATE/**'
	- 'LICENSE'
	- 'CODEOWNERS'
	types: [opened, reopened, synchronize, ready_for_review, edited]
	push:
	branches: ['main']
	paths-ignore:
	- '*/.md'
	- '*/.rst'
	- 'docs/**'
	- '.github/ISSUE_TEMPLATE/**'
	- '.github/PULL_REQUEST_TEMPLATE/**'
	- 'LICENSE'
	- 'CODEOWNERS'
	schedule:
	- cron: '36 23 * * 1'
	- cron: '36 23 * * 4'
	workflow_dispatch:
	inputs:
	allow_unsafe_fixes:
	default: true
	description: 'Allow potentially unsafe autofixes (e.g. ruff --unsafe-fixes) on scheduled/manual runs only'
	type: boolean
	open_autofix_pr:
	default: true
	description: 'Open a PR with autofix results (scheduled/manual runs)'
	type: boolean
	run_autofix:
	default: true
	description: 'Run language-native autofixers and push results'
	type: boolean
	permissions:
	contents: read

Navigation Menu

Uh oh!

deps(chat-cli): update openai requirement from >=2.45.0 to >=2.46.0 in /ai-projects/chat-cli in the chat-cli-deps group #4080

Workflow file

deps(chat-cli): update openai requirement from >=2.45.0 to >=2.46.0 in /ai-projects/chat-cli in the chat-cli-deps group #4080

Uh oh!

Workflow file for this run