[beer-sakthai]

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
• High risk: Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

Which use cases does this change impact?

Workflow types:

• Advanced setup - Impacts users who have custom CodeQL workflows.
• Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

• Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
• Code Quality - The changes impact analyses when analysis-kinds: code-quality.
• Other first-party - The changes impact other first-party analyses.
• Third-party analyses - The changes affect the upload-sarif action.

Environments:

• Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
• GHES - Impacts CodeQL workflows on GitHub Enterprise Server.
• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• Test repository - This change will be tested on a test repository before merging.
• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).
• Other - Please provide details.
• None - I am not validating these changes.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.
• Development/testing only - This change cannot cause any failures in production.
• Other - Please provide details.

How will you know if something goes wrong after this change is released?

• Telemetry - I rely on existing telemetry or have made changes to the telemetry.
  • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
  • Alerts - New or existing monitors will trip if something goes wrong with this change.
• Other - Please provide details.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.
• Special considerations - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

🟡 Changes recommended

The CodeQL workflow’s repository check still allows fork pull requests to attempt SARIF uploads with a fork-restricted token, so the guard needs to be corrected to include the pull request’s source repository.

1 open issue

• Exclude fork pull requests from SARIF upload · New

What changed in this PR

Updates CI to use standard macOS GitHub-hosted runners, synchronizes generated workflows, refreshes transitive brace-expansion dependencies, and adjusts CodeQL SARIF upload conditions.

Changes:

• Replaced macOS xlarge runner labels with standard macos-14, macos-15, and macos-latest labels.
• Updated the Xcode 16 selection condition for the macOS 15 runner.
• Refreshed brace-expansion entries and integrity metadata in the lockfile.
• Added a canonical-repository guard around CodeQL SARIF uploads.

File	Description
pr-checks/​checks/​swift-custom-build.yml	Uses the standard macOS runner for Swift custom-build checks.
pr-checks/​checks/​swift-autobuild.yml	Uses the standard macOS runner for Swift autobuild checks.
pr-checks/​checks/​per-language-bundle-validation.yml	Uses the standard macOS runner for Swift bundle validation.
pr-checks/​checks/​multi-language-autodetect.yml	Updates macOS runner labels and the Xcode 16 selection condition.
pr-checks/​checks/​all-platform-bundle.yml	Uses the standard macOS runner for all-platform bundle checks.
package-lock.json	Refreshes transitive brace-expansion package versions and integrity metadata.
.github/​workflows/​codeql.yml	Updates the macOS analysis matrix and CodeQL SARIF upload condition.
.github/​workflows/​__swift-custom-build.yml	Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__swift-autobuild.yml	Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__per-language-bundle-validation.yml	Synchronizes the generated workflow with the standard macOS runner change.
.github/​workflows/​__multi-language-autodetect.yml	Synchronizes the generated workflow with the runner and Xcode selection updates.
.github/​workflows/​__all-platform-bundle.yml	Synchronizes the generated workflow with the standard macOS runner change.

_{Review effort: Lite (auto)}

[beer-sakthai]

Review completed. Before release, please ensure the stated risk level matches the production code paths affected, appropriate validation has been completed, and rollback/monitoring coverage is in place. Also confirm backwards compatibility and whether a changelog or documentation update is required.