From 6276a09a3e84afee71dbb631965f394063b86f13 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 6 Oct 2026 10:45:17 +0000 Subject: [PATCH 1/7] Bump brace-expansion Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21) Updates `brace-expansion` from 2.1.4 to 2.1.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 2.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 48 +++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/package-lock.json b/package-lock.json index 18d1724..5a2488d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -324,9 +324,9 @@ "license": "MIT" }, "node_modules/@eslint/config-array/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -422,9 +422,9 @@ "license": "MIT" }, "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -1477,9 +1477,9 @@ "license": "MIT" }, "node_modules/@vscode/test-cli/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -2285,9 +2285,9 @@ "license": "BSD-2-Clause" }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { @@ -3396,9 +3396,9 @@ "license": "MIT" }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -3911,9 +3911,9 @@ "license": "MIT" }, "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -5268,9 +5268,9 @@ "license": "MIT" }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -7241,9 +7241,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { From c42170a756aaab4c7e7f9b177123933d65fe6eb3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 6 Oct 2026 10:45:18 +0000 Subject: [PATCH 2/7] Bump source-map-js from 1.2.1 to 1.2.2 in /vscode-acp/webview-ui Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- vscode-acp/webview-ui/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/vscode-acp/webview-ui/package-lock.json b/vscode-acp/webview-ui/package-lock.json index da774d2..394caab 100644 --- a/vscode-acp/webview-ui/package-lock.json +++ b/vscode-acp/webview-ui/package-lock.json @@ -3041,9 +3041,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, "license": "BSD-3-Clause", "engines": { From 45f405a12ffa72f2a77d9343ef5cdfe869e40d2b Mon Sep 17 00:00:00 2001 From: patil-utkarsh Date: Tue, 6 Oct 2026 16:42:52 +0530 Subject: [PATCH 3/7] Refactor CodeQL workflow settings and schedules Updated CodeQL workflow configuration for better analysis. --- .github/workflows/codeql.yml | 80 ++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..c4c7e13 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,80 @@ +name: "CodeQL" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '20 3 * * 1' + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + include: + - language: javascript-typescript + build-mode: none + - language: java-kotlin + build-mode: manual + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # --- Java/Kotlin (hosts/intellij) prerequisites ----------------------- + # The IntelliJ plugin's Gradle build has a hard dependency on the shared + # React webview bundle existing before Gradle runs (see syncWebview task + # in hosts/intellij/build.gradle.kts), plus JDK 17. Autobuild can't know + # this, so we build it manually. + - name: Set up Node.js + if: matrix.language == 'java-kotlin' + uses: actions/setup-node@v4 + with: + node-version-file: '.nvmrc' + cache: npm + cache-dependency-path: vscode-acp/webview-ui/package-lock.json + + - name: Build shared webview bundle (required by Gradle syncWebview task) + if: matrix.language == 'java-kotlin' + working-directory: vscode-acp/webview-ui + run: | + npm ci + npm run build + + - name: Set up JDK 17 + if: matrix.language == 'java-kotlin' + uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: '17' + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + # --- Manual build step for java-kotlin only ----------------------- + - name: Build IntelliJ plugin (Kotlin/Java) + if: matrix.language == 'java-kotlin' + working-directory: hosts/intellij + run: | + chmod +x ./gradlew + ./gradlew compileKotlin compileTestKotlin compileJava --no-daemon + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4 + with: + category: "/language:${{ matrix.language }}" From c6a79084c53a3f8db6bc599f59d631fb35d46382 Mon Sep 17 00:00:00 2001 From: patil-utkarsh Date: Mon, 12 Oct 2026 17:27:58 +0530 Subject: [PATCH 4/7] Fix Dependabot and CodeQL alerts (#3) * Fix npm audit findings and CodeQL XSS alerts in docs viewer * Render mermaid via mermaid.run to avoid re-parsing DOM text as HTML * Show diagram source when mermaid fails to render --------- Co-authored-by: patil-utkarsh <331620036+patil-utkarsh@users.noreply.github.com> --- docs/index.html | 39 +++++++++++++++++++++++---------------- package-lock.json | 12 ++++++------ 2 files changed, 29 insertions(+), 22 deletions(-) diff --git a/docs/index.html b/docs/index.html index 422dd7b..728ff7b 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1400,6 +1400,7 @@

Generation Info

// Initialize mermaid mermaid.initialize({ startOnLoad: false, + securityLevel: 'strict', theme: 'default', themeVariables: { primaryColor: '#2563eb', @@ -1579,13 +1580,10 @@

Generation Info

html = html.replace( /
([\s\S]*?)<\/code><\/pre>/g,
                 (match, code) => {
-                    const decodedCode = code
-                        .replace(/</g, '<')
-                        .replace(/>/g, '>')
-                        .replace(/&/g, '&')
-                        .replace(/"/g, '"')
-                        .replace(/'/g, "'");
-                    return `
${decodedCode}
`;
+                    // Keep the code HTML-escaped. The browser decodes entities when
+                    // renderMermaidDiagrams() reads element.textContent, so no manual
+                    // unescaping (and no injection of raw markup) is needed here.
+                    return `
${code}
`;
                 }
             );
             
@@ -1599,13 +1597,20 @@ 
Generation Info

                 const element = mermaidElements[i];
                 const id = `mermaid-${Date.now()}-${i}`;
                 element.id = id;
+                // Capture the source up front: on a syntax error mermaid.run() has already
+                // replaced the node's contents with its own error SVG before it throws.
+                const source = element.textContent;
                 
                 try {
-                    const { svg } = await mermaid.render(id + '-svg', element.textContent);
-                    element.innerHTML = svg;
+                    // mermaid.run() reads the (still HTML-escaped) diagram source from the
+                    // node and writes the sanitised SVG back itself (securityLevel: 'strict'),
+                    // so this page never re-parses DOM text as HTML.
+                    await mermaid.run({ nodes: [element] });
                 } catch (error) {
                     console.error('Mermaid rendering error:', error);
-                    element.innerHTML = `
Error rendering diagram:\n${element.textContent}
`;
+                    const pre = document.createElement('pre');
+                    pre.textContent = `Error rendering diagram:\n${source}`;
+                    element.replaceChildren(pre);
                 }
             }
         }
@@ -1616,12 +1621,14 @@ 
Generation Info

             
             loading.style.display = 'none';
             content.style.display = 'block';
-            content.innerHTML = `
-                

-                    
⚠️ Error

-                    
${message}

-                

-            `;
+            const box = document.createElement('div');
+            box.className = 'error';
+            const title = document.createElement('h3');
+            title.textContent = '⚠️ Error';
+            const text = document.createElement('p');
+            text.textContent = message;
+            box.append(title, text);
+            content.replaceChildren(box);
         }
     
 
diff --git a/package-lock.json b/package-lock.json
index 5a2488d..e816466 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3599,9 +3599,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "dev": true,
       "funding": [
         {
@@ -6559,9 +6559,9 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.1.tgz",
-      "integrity": "sha512-k3CMsaIvvdSwm8oLB4MXSl0wH2/cwlH7xGcnRd2DaeRmBkbzYmyT8j0tsX60DwD1eRwHTpNpH8ljKu9oUT1MeQ==",
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.2.tgz",
+      "integrity": "sha512-GL2BWwVa6JydKO6l/ljVgjAZF4QJ3S7dWDWi53s5GZT8PJzD2fNxi67HANQGKAqPrwEpL5ba7gUBGi0Ls/sEoQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {

From d5ee4a37deadecced791a289587bc58778990c33 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 13:30:09 +0530
Subject: [PATCH 5/7] Bump markdown-it from 14.3.1 to 14.3.3 (#4)

Bumps [markdown-it](https://github.com/markdown-it/markdown-it) from 14.3.1 to 14.3.3.
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.3/CHANGELOG.md)
- [Commits](https://github.com/markdown-it/markdown-it/compare/14.3.1...14.3.3)

---
updated-dependencies:
- dependency-name: markdown-it
  dependency-version: 14.3.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e816466..423b710 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4958,9 +4958,9 @@
       }
     },
     "node_modules/markdown-it": {
-      "version": "14.3.1",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.1.tgz",
-      "integrity": "sha512-4Ej49aYTDFIQ+uBkfX8GBvJGccoARxxPep+7aWTs55ozbjQJpW9M26Fe53vnGgvLeVzva/amzjQQaQu9w0vMhA==",
+      "version": "14.3.3",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz",
+      "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==",
       "dev": true,
       "funding": [
         {

From 6eea9a7ba74be40677768f8c4d2dc45c6fc4996d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 13:39:26 +0530
Subject: [PATCH 6/7] Bump vite from 6.4.3 to 6.4.5 in /vscode-acp/webview-ui
 (#5)

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.3 to 6.4.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.5/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 6.4.5
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] 
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 vscode-acp/webview-ui/package-lock.json | 8 ++++----
 vscode-acp/webview-ui/package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/vscode-acp/webview-ui/package-lock.json b/vscode-acp/webview-ui/package-lock.json
index 394caab..31b009e 100644
--- a/vscode-acp/webview-ui/package-lock.json
+++ b/vscode-acp/webview-ui/package-lock.json
@@ -19,7 +19,7 @@
         "@types/react-dom": "^19.0.0",
         "@vitejs/plugin-react": "^4.3.4",
         "typescript": "^5.6.3",
-        "vite": "^6.4.3"
+        "vite": "^6.4.5"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -3304,9 +3304,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.4.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
-      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
+      "version": "6.4.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.5.tgz",
+      "integrity": "sha512-4enwjFfi4IwtEh0w+jPzpLVOFQiPHmmzPxcHXQOyEur47o6u0jE573DmGpjA+7irXoMLYRZD5ZaFUEneS3abPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/vscode-acp/webview-ui/package.json b/vscode-acp/webview-ui/package.json
index 306778f..a427b85 100644
--- a/vscode-acp/webview-ui/package.json
+++ b/vscode-acp/webview-ui/package.json
@@ -19,6 +19,6 @@
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^4.3.4",
     "typescript": "^5.6.3",
-    "vite": "^6.4.3"
+    "vite": "^6.4.5"
   }
 }

From dfc3df4a36a46cb56ed3652d907412dccb355c48 Mon Sep 17 00:00:00 2001
From: patil-utkarsh 
Date: Fri, 23 Oct 2026 17:11:21 +0530
Subject: [PATCH 7/7] ci: remove advanced CodeQL workflow

The upstream repository uses CodeQL default setup, which rejects SARIF uploads from advanced workflows. Drop the workflow so the PR's Analyze jobs no longer fail.

Signed-off-by: patil-utkarsh 
---
 .github/workflows/codeql.yml | 80 ------------------------------------
 1 file changed, 80 deletions(-)
 delete mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index c4c7e13..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '20 3 * * 1'
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: javascript-typescript
-            build-mode: none
-          - language: java-kotlin
-            build-mode: manual
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      # --- Java/Kotlin (hosts/intellij) prerequisites -----------------------
-      # The IntelliJ plugin's Gradle build has a hard dependency on the shared
-      # React webview bundle existing before Gradle runs (see syncWebview task
-      # in hosts/intellij/build.gradle.kts), plus JDK 17. Autobuild can't know
-      # this, so we build it manually.
-      - name: Set up Node.js
-        if: matrix.language == 'java-kotlin'
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: '.nvmrc'
-          cache: npm
-          cache-dependency-path: vscode-acp/webview-ui/package-lock.json
-
-      - name: Build shared webview bundle (required by Gradle syncWebview task)
-        if: matrix.language == 'java-kotlin'
-        working-directory: vscode-acp/webview-ui
-        run: |
-          npm ci
-          npm run build
-
-      - name: Set up JDK 17
-        if: matrix.language == 'java-kotlin'
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '17'
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-
-      # --- Manual build step for java-kotlin only -----------------------
-      - name: Build IntelliJ plugin (Kotlin/Java)
-        if: matrix.language == 'java-kotlin'
-        working-directory: hosts/intellij
-        run: |
-          chmod +x ./gradlew
-          ./gradlew compileKotlin compileTestKotlin compileJava --no-daemon
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:${{ matrix.language }}"