From 4707994e6e9979b210fcf8fc655fac8b5665b670 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Wed, 21 Oct 2026 13:03:37 +0100
Subject: [PATCH] Don't include diagnostics if FF is off

---
 lib/entry-points.js                 |  8 ++++++--
 src/init-action-post-helper.test.ts |  2 +-
 src/init-action-post-helper.ts      | 13 ++++++++-----
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index 5ab2e57fe..6128fe3b4 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -187041,11 +187041,15 @@ async function generateFailedSarif(logger2, features, config, category, checkout
   if (sarifFile === void 0) {
     sarifFile = "../codeql-failed-run.sarif";
   }
-  if (databasePath === void 0 || !await features.getValue("export_diagnostics_enabled" /* ExportDiagnosticsEnabled */, codeql)) {
+  const exportDiagnosticsEnabled = await features.getValue(
+    "export_diagnostics_enabled" /* ExportDiagnosticsEnabled */,
+    codeql
+  );
+  if (databasePath === void 0 || !exportDiagnosticsEnabled) {
     let diagnosticDir = getTempDiagnosticPath(
       config.tempDir
     );
-    if (!fs31.existsSync(diagnosticDir)) {
+    if (!exportDiagnosticsEnabled || !fs31.existsSync(diagnosticDir)) {
       diagnosticDir = void 0;
     }
     await codeql.diagnosticsExport(sarifFile, category, config, diagnosticDir);
diff --git a/src/init-action-post-helper.test.ts b/src/init-action-post-helper.test.ts
index aaee9c33f..0458dbf52 100644
--- a/src/init-action-post-helper.test.ts
+++ b/src/init-action-post-helper.test.ts
@@ -56,7 +56,7 @@ test.serial("generateFailedSarif picks up unwritten diagnostics", async (t) =>
     const sarifFile = path.join(tmpDir, "failed.sarif");
     const result = await initActionPostHelper.generateFailedSarif(
       logger,
-      createFeatures([]),
+      createFeatures([Feature.ExportDiagnosticsEnabled]),
       createTestConfig({
         tempDir: tmpDir,
         // Explicitly undefined to ensure we get the "no database" path.
diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts
index 83c2aec9f..b86ed9dbb 100644
--- a/src/init-action-post-helper.ts
+++ b/src/init-action-post-helper.ts
@@ -204,19 +204,22 @@ export async function generateFailedSarif(
   }
 
   // If there is no database or the feature flag is off, we run 'export diagnostics'
-  if (
-    databasePath === undefined ||
-    !(await features.getValue(Feature.ExportDiagnosticsEnabled, codeql))
-  ) {
+  const exportDiagnosticsEnabled = await features.getValue(
+    Feature.ExportDiagnosticsEnabled,
+    codeql,
+  );
+  if (databasePath === undefined || !exportDiagnosticsEnabled) {
     // If we don't have a database path, then we may have diagnostics that were written to a
     // temporary location. Get the path that they would have been written to and check whether
     // it exists. If so, pass it on to the CLI. The CLI will not complain if we give it a
     // path that doesn't exist, so we are just being extra defensive here.
+    // We also don't pass the path to the CLI if `exportDiagnosticsEnabled` is not enabled, to preserve
+    // its intended behaviour of controlling whether diagnostics are included in the SARIF or not.
     let diagnosticDir: string | undefined = getTempDiagnosticPath(
       config.tempDir,
     );
 
-    if (!fs.existsSync(diagnosticDir)) {
+    if (!exportDiagnosticsEnabled || !fs.existsSync(diagnosticDir)) {
       diagnosticDir = undefined;
     }