From 69b18fb8032fdd5509d62f14ab91166d58c7604c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 28 Jul 2026 02:58:26 +0000
Subject: [PATCH 1/3] Initial plan


From 59e62c1eed5b00361c38e0727dad8f8408c0032d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 28 Jul 2026 03:30:35 +0000
Subject: [PATCH 2/3] Fix validate-test-results and configs CI job failures

- Validate test results: use jq --slurp flag so all test report files
  are combined into a single array before selecting failing tests.
  Without --slurp, jq processes files independently and can produce
  a parse error when encountering empty/non-JSON slice output files.

- Configs: add 'Install Packs' step before 'Check Configurations' to
  run codeql pack install for each language src directory. This ensures
  upstream packs (e.g. codeql/cpp-queries) are available in
  ~/.codeql/packages when codeql database create resolves transitive
  dependencies from the githubsecuritylab community packs.

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
---
 .github/workflows/ci.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e22a308a..0f703c8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -152,7 +152,7 @@ jobs:
           do
             jq --raw-output '"PASS \(map(select(.pass == true)) | length)/\(length)"' "$json_report"
           done
-          FAILING_TESTS=$(jq --raw-output '.[] | select(.pass == false)' "${test_reports[@]}")
+          FAILING_TESTS=$(jq --slurp --raw-output '.[][] | select(.pass == false)' "${test_reports[@]}")
           if [[ ! -z "$FAILING_TESTS" ]]; then
             echo "ERROR: The following tests failed:"
             echo $FAILING_TESTS | jq .
@@ -245,6 +245,17 @@ jobs:
         if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
+      - name: Install Packs
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          for lang in cpp csharp go java javascript python ruby; do
+            if [[ -d "${lang}/src" ]]; then
+              codeql pack install "${lang}/src"
+            fi
+          done
+
       - name: "Check Configurations"
         if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:

From a0610f3eec972a950a73610713b9d199668db371 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 28 Jul 2026 03:50:20 +0000
Subject: [PATCH 3/3] ci: add packages: read permission to configs job for GHCR
 rate limiting

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f703c8a..348c425b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,6 +229,7 @@ jobs:
     needs: compile-and-test
     permissions:
       contents: read
+      packages: read # required by codeql pack install (GHCR rate limiting)
       pull-requests: read # required by pr-configs.sh (gh pr view)
 
     steps: