Don't include diagnostics if FF is off

lib/entry-points.js

@@ -187041,11 +187041,15 @@ async function generateFailedSarif(logger2, features, config, category, checkout
   if (sarifFile === void 0) {
     sarifFile = "../codeql-failed-run.sarif";
   }
-  if (databasePath === void 0 || !await features.getValue("export_diagnostics_enabled" /* ExportDiagnosticsEnabled */, codeql)) {
+  const exportDiagnosticsEnabled = await features.getValue(
+    "export_diagnostics_enabled" /* ExportDiagnosticsEnabled */,
+    codeql
+  );
+  if (databasePath === void 0 || !exportDiagnosticsEnabled) {
     let diagnosticDir = getTempDiagnosticPath(
       config.tempDir
     );
-    if (!fs31.existsSync(diagnosticDir)) {
+    if (!exportDiagnosticsEnabled || !fs31.existsSync(diagnosticDir)) {
       diagnosticDir = void 0;
     }
     await codeql.diagnosticsExport(sarifFile, category, config, diagnosticDir);

src/init-action-post-helper.test.ts

@@ -56,7 +56,7 @@ test.serial("generateFailedSarif picks up unwritten diagnostics", async (t) =>
     const sarifFile = path.join(tmpDir, "failed.sarif");
     const result = await initActionPostHelper.generateFailedSarif(
       logger,
-      createFeatures([]),
+      createFeatures([Feature.ExportDiagnosticsEnabled]),
       createTestConfig({
         tempDir: tmpDir,
         // Explicitly undefined to ensure we get the "no database" path.

src/init-action-post-helper.ts

@@ -204,19 +204,22 @@ export async function generateFailedSarif(
   }
 
   // If there is no database or the feature flag is off, we run 'export diagnostics'
-  if (
-    databasePath === undefined ||
-    !(await features.getValue(Feature.ExportDiagnosticsEnabled, codeql))
-  ) {
+  const exportDiagnosticsEnabled = await features.getValue(
+    Feature.ExportDiagnosticsEnabled,
+    codeql,
+  );
+  if (databasePath === undefined || !exportDiagnosticsEnabled) {
     // If we don't have a database path, then we may have diagnostics that were written to a
     // temporary location. Get the path that they would have been written to and check whether
     // it exists. If so, pass it on to the CLI. The CLI will not complain if we give it a
     // path that doesn't exist, so we are just being extra defensive here.
+    // We also don't pass the path to the CLI if `exportDiagnosticsEnabled` is not enabled, to preserve
+    // its intended behaviour of controlling whether diagnostics are included in the SARIF or not.
     let diagnosticDir: string | undefined = getTempDiagnosticPath(
       config.tempDir,
     );
 
-    if (!fs.existsSync(diagnosticDir)) {
+    if (!exportDiagnosticsEnabled || !fs.existsSync(diagnosticDir)) {
       diagnosticDir = undefined;
     }