From 0e72543776e866707b7ca718f668fc51e216ae8b Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 15 Oct 2026 14:51:51 +0100 Subject: [PATCH 1/9] Remove overlay version matching dry run Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 35 +----------------------- src/feature-flags.ts | 11 -------- src/setup-codeql.test.ts | 57 ++-------------------------------------- src/setup-codeql.ts | 43 +++--------------------------- 4 files changed, 6 insertions(+), 140 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index d5e64717a..240eb8257 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -172089,11 +172089,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION", minimumVersion: void 0 }, - ["overlay_analysis_match_codeql_version_dry_run" /* OverlayAnalysisMatchCodeqlVersionDryRun */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", - minimumVersion: void 0 - }, ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", @@ -176287,11 +176282,7 @@ async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, raw if (rawLanguages === void 0 || rawLanguages.length === 0) { return []; } - const isEnabled = await features.getValue( - "overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */ - ); - const isDryRun = !isEnabled && await features.getValue("overlay_analysis_match_codeql_version_dry_run" /* OverlayAnalysisMatchCodeqlVersionDryRun */); - if (!isEnabled && !isDryRun) { + if (!await features.getValue("overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */)) { return []; } let cachedVersions; @@ -176316,30 +176307,6 @@ async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, raw if (overlayVersions.length === 0) { return []; } - const isCachedVersionDifferent = overlayVersions[0].cliVersion !== defaultCliVersion.enabledVersions[0].cliVersion; - if (isCachedVersionDifferent) { - addNoLanguageDiagnostic( - void 0, - makeTelemetryDiagnostic( - "codeql-action/overlay-aware-default-codeql-version", - "Overlay-aware default CodeQL version selection", - { - cachedVersions, - enabledVersions: defaultCliVersion.enabledVersions.map( - (v) => v.cliVersion - ), - isDryRun, - overlayAwareVersion: overlayVersions[0].cliVersion - } - ) - ); - } - if (isDryRun) { - logger2.debug( - `Overlay-aware default CodeQL version selection is running in dry-run mode. Would have used version ${overlayVersions[0].cliVersion}.` - ); - return []; - } return overlayVersions; } async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger2) { diff --git a/src/feature-flags.ts b/src/feature-flags.ts index f74d0bd25..d8cc4cd15 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -120,12 +120,6 @@ export enum Feature { * database exists in the cache. */ OverlayAnalysisMatchCodeqlVersion = "overlay_analysis_match_codeql_version", - /** - * Like `OverlayAnalysisMatchCodeqlVersion`, but only logs a diagnostic with the version that - * would have been chosen instead of actually changing the default CodeQL CLI version. - * `OverlayAnalysisMatchCodeqlVersion` overrides this flag. - */ - OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run", /** * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if * none are enabled, the default applies. @@ -389,11 +383,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION", minimumVersion: undefined, }, - [Feature.OverlayAnalysisMatchCodeqlVersionDryRun]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", - minimumVersion: undefined, - }, [Feature.OverlayAnalysisMinDisk8Gb]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 6bdb29f46..98633717d 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -1727,7 +1727,7 @@ test.serial( ); test.serial( - "getEnabledVersionsWithOverlayBaseDatabases does not list caches when both gates are off", + "getEnabledVersionsWithOverlayBaseDatabases does not list caches when the gate is off", async (t) => { const listStub = sinon.stub(api, "listActionsCaches").resolves([]); @@ -1740,64 +1740,11 @@ test.serial( t.deepEqual(result, []); t.assert( listStub.notCalled, - "Should not list Actions caches when both gating feature flags are off.", + "Should not list Actions caches when the gating feature flag is off.", ); }, ); -test.serial( - "getEnabledVersionsWithOverlayBaseDatabases dry-run returns empty but lists caches", - async (t) => { - sinon.stub(api, "getAutomationID").resolves("test/"); - const listStub = sinon.stub(api, "listActionsCaches").resolves([ - { - key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"), - }, - ]); - - const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( - overlayMatchEnabledVersions, - ["javascript"], - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]), - getRunnerLogger(true), - ); - t.deepEqual( - result, - [], - "Dry-run should return an empty list so the caller falls back.", - ); - t.assert( - listStub.calledOnce, - "Dry-run should still list Actions caches to populate the diagnostic.", - ); - }, -); - -test.serial( - "getEnabledVersionsWithOverlayBaseDatabases match flag wins over dry-run", - async (t) => { - sinon.stub(api, "getAutomationID").resolves("test/"); - sinon.stub(api, "listActionsCaches").resolves([ - { - key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"), - }, - ]); - - const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( - overlayMatchEnabledVersions, - ["javascript"], - createFeatures([ - Feature.OverlayAnalysisMatchCodeqlVersion, - Feature.OverlayAnalysisMatchCodeqlVersionDryRun, - ]), - getRunnerLogger(true), - ); - t.deepEqual(result, [ - { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" }, - ]); - }, -); - /** The CLI version that the toolcache cleanup tests download. */ const CLEANUP_CLI_VERSION = "2.21.0"; /** The bundle version that the toolcache cleanup tests download. */ diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 07666d630..9cd8ca470 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -183,10 +183,8 @@ async function findOverridingToolsInCache( /** * Returns the sorted set of enabled versions that have cached overlay-base databases for the - * given languages, or an empty list if neither the `OverlayAnalysisMatchCodeqlVersion` nor the - * `OverlayAnalysisMatchCodeqlVersionDryRun` feature flag is enabled. When only the dry-run flag - * is enabled, this performs the lookup and emits a telemetry diagnostic with the version that - * would have been chosen, but still returns an empty list so the caller falls back. + * given languages, or an empty list if the `OverlayAnalysisMatchCodeqlVersion` feature flag is + * disabled. */ export async function getEnabledVersionsWithOverlayBaseDatabases( defaultCliVersion: CodeQLDefaultVersionInfo, @@ -197,13 +195,7 @@ export async function getEnabledVersionsWithOverlayBaseDatabases( if (rawLanguages === undefined || rawLanguages.length === 0) { return []; } - const isEnabled = await features.getValue( - Feature.OverlayAnalysisMatchCodeqlVersion, - ); - const isDryRun = - !isEnabled && - (await features.getValue(Feature.OverlayAnalysisMatchCodeqlVersionDryRun)); - if (!isEnabled && !isDryRun) { + if (!(await features.getValue(Feature.OverlayAnalysisMatchCodeqlVersion))) { return []; } @@ -234,35 +226,6 @@ export async function getEnabledVersionsWithOverlayBaseDatabases( return []; } - const isCachedVersionDifferent = - overlayVersions[0].cliVersion !== - defaultCliVersion.enabledVersions[0].cliVersion; - - if (isCachedVersionDifferent) { - addNoLanguageDiagnostic( - undefined, - makeTelemetryDiagnostic( - "codeql-action/overlay-aware-default-codeql-version", - "Overlay-aware default CodeQL version selection", - { - cachedVersions, - enabledVersions: defaultCliVersion.enabledVersions.map( - (v) => v.cliVersion, - ), - isDryRun, - overlayAwareVersion: overlayVersions[0].cliVersion, - }, - ), - ); - } - - if (isDryRun) { - logger.debug( - `Overlay-aware default CodeQL version selection is running in dry-run mode. Would have used version ${overlayVersions[0].cliVersion}.`, - ); - return []; - } - return overlayVersions; } From 6d82d4f44173c02171cc06acededab5d1b7d8085 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 15 Oct 2026 11:01:45 +0100 Subject: [PATCH 2/9] Use overlay-aware CodeQL versions by default Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 19 ++--- src/feature-flags.ts | 12 --- src/setup-codeql.test.ts | 177 +++++++++++++++++++++++++++++++-------- src/setup-codeql.ts | 27 +++--- 4 files changed, 162 insertions(+), 73 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 240eb8257..2982b8495 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -172084,11 +172084,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING", minimumVersion: void 0 }, - ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION", - minimumVersion: void 0 - }, ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", @@ -176278,13 +176273,10 @@ async function findOverridingToolsInCache(humanReadableVersion, logger2) { } return void 0; } -async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, rawLanguages, features, logger2) { +async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, rawLanguages, logger2) { if (rawLanguages === void 0 || rawLanguages.length === 0) { return []; } - if (!await features.getValue("overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */)) { - return []; - } let cachedVersions; try { cachedVersions = await getCodeQlVersionsForOverlayBaseDatabases( @@ -176309,14 +176301,13 @@ async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, raw } return overlayVersions; } -async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger2) { - if (!useOverlayAwareDefaultCliVersion || !isAnalyzingPullRequest()) { +async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, variant, logger2) { + if (!useOverlayAwareDefaultCliVersion || variant !== "GitHub.com" /* DOTCOM */ && variant !== "GitHub Enterprise Cloud with data residency" /* GHEC_DR */ || defaultCliVersion.enabledVersions.length === 1 || !isAnalyzingPullRequest()) { return defaultCliVersion.enabledVersions[0]; } const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases( defaultCliVersion, rawLanguages, - features, logger2 ); if (overlayVersions.length > 0) { @@ -176423,7 +176414,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - features, + variant, logger2 ); cliVersion2 = version.cliVersion; @@ -176443,7 +176434,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - features, + variant, logger2 ); cliVersion2 = version.cliVersion; diff --git a/src/feature-flags.ts b/src/feature-flags.ts index d8cc4cd15..fcb2bbc9d 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -113,13 +113,6 @@ export enum Feature { OverlayAnalysisGo = "overlay_analysis_go", OverlayAnalysisJava = "overlay_analysis_java", OverlayAnalysisJavascript = "overlay_analysis_javascript", - /** - * When set, chooses the default CodeQL CLI version as the highest version that is both enabled by - * feature flags and present as an overlay-base database in the Actions cache for the configured - * languages. Falls back to the highest feature flagged version if no intersecting overlay-base - * database exists in the cache. - */ - OverlayAnalysisMatchCodeqlVersion = "overlay_analysis_match_codeql_version", /** * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if * none are enabled, the default applies. @@ -378,11 +371,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING", minimumVersion: undefined, }, - [Feature.OverlayAnalysisMatchCodeqlVersion]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION", - minimumVersion: undefined, - }, [Feature.OverlayAnalysisMinDisk8Gb]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 98633717d..a120d6ebd 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -1069,8 +1069,53 @@ async function fakeOverlayBaseCacheKey( return `${prefix}${suffix}`; } +for (const variant of [GitHubVariant.DOTCOM, GitHubVariant.GHEC_DR]) { + test.serial( + `getCodeQLSource uses overlay-aware default version for a Code Scanning PR on ${variant}`, + async (t) => { + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + process.env[EnvVar.CODE_SCANNING_REF] = "refs/heads/feature-branch"; + process.env[EnvVar.CODE_SCANNING_BASE_BRANCH] = "main"; + + sinon.stub(api, "getAutomationID").resolves("test/"); + const listStub = sinon.stub(api, "listActionsCaches").resolves([ + { + key: await fakeOverlayBaseCacheKey( + "javascript", + "2.20.1", + "abc-1-1", + ), + }, + ]); + sinon + .stub(toolcache, "find") + .withArgs("CodeQL", "2.20.1") + .returns("/path/to/codeql-2.20.1"); + + const source = await setupCodeql.getCodeQLSource( + undefined, + overlayMatchEnabledVersions, + ["javascript"], + undefined, // otherLanguagePacksReason + true, + SAMPLE_DOTCOM_API_DETAILS, + variant, + false, + createFeatures([]), + getRunnerLogger(true), + ); + + t.assert(listStub.calledOnce); + t.is(source.sourceType, "toolcache"); + t.is(source.toolsVersion, "2.20.1"); + }); + }, + ); +} + test.serial( - "getCodeQLSource uses overlay-aware default version when requested for a PR", + "getCodeQLSource skips overlay-aware default version for a Code Scanning PR on GHES", async (t) => { await withTmpDir(async (tmpDir) => { setupActionsVars(tmpDir, tmpDir); @@ -1085,8 +1130,96 @@ test.serial( ]); sinon .stub(toolcache, "find") - .withArgs("CodeQL", "2.20.1") - .returns("/path/to/codeql-2.20.1"); + .withArgs("CodeQL", "2.20.2") + .returns("/path/to/codeql-2.20.2"); + + const source = await setupCodeql.getCodeQLSource( + undefined, + overlayMatchEnabledVersions, + ["javascript"], + undefined, // otherLanguagePacksReason + true, + SAMPLE_DOTCOM_API_DETAILS, + GitHubVariant.GHES, + false, + createFeatures([]), + getRunnerLogger(true), + ); + + t.assert(listStub.notCalled); + t.is(source.sourceType, "toolcache"); + t.is(source.toolsVersion, "2.20.2"); + }); + }, +); + +test.serial( + "getCodeQLSource skips the Actions cache when only one default version is enabled", + async (t) => { + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + process.env[EnvVar.CODE_SCANNING_REF] = "refs/heads/feature-branch"; + process.env[EnvVar.CODE_SCANNING_BASE_BRANCH] = "main"; + + sinon.stub(api, "getAutomationID").resolves("test/"); + const listStub = sinon.stub(api, "listActionsCaches").resolves([ + { + key: await fakeOverlayBaseCacheKey( + "javascript", + SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, + "abc-1-1", + ), + }, + ]); + sinon + .stub(toolcache, "find") + .withArgs( + "CodeQL", + SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, + ) + .returns("/path/to/codeql"); + + const source = await setupCodeql.getCodeQLSource( + undefined, + SAMPLE_DEFAULT_CLI_VERSION, + ["javascript"], + undefined, // otherLanguagePacksReason + true, + SAMPLE_DOTCOM_API_DETAILS, + GitHubVariant.DOTCOM, + false, + createFeatures([]), + getRunnerLogger(true), + ); + + t.assert(listStub.notCalled); + t.is(source.sourceType, "toolcache"); + t.is( + source.toolsVersion, + SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, + ); + }); + }, +); + +test.serial( + "getCodeQLSource skips overlay-aware default version outside pull request analysis", + async (t) => { + sinon.stub(actionsUtil, "isAnalyzingPullRequest").returns(false); + + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + + sinon.stub(api, "getAutomationID").resolves("test/"); + const listStub = sinon.stub(api, "listActionsCaches").resolves([ + { + key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"), + }, + ]); + sinon + .stub(toolcache, "find") + .withArgs("CodeQL", "2.20.2") + .returns("/path/to/codeql-2.20.2"); const source = await setupCodeql.getCodeQLSource( undefined, @@ -1097,19 +1230,19 @@ test.serial( SAMPLE_DOTCOM_API_DETAILS, GitHubVariant.DOTCOM, false, - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), + createFeatures([]), getRunnerLogger(true), ); - t.assert(listStub.calledOnce); + t.assert(listStub.notCalled); t.is(source.sourceType, "toolcache"); - t.is(source.toolsVersion, "2.20.1"); + t.is(source.toolsVersion, "2.20.2"); }); }, ); test.serial( - "getCodeQLSource skips overlay-aware default version when not requested", + "getCodeQLSource skips overlay-aware default version when not requested for Code Scanning", async (t) => { await withTmpDir(async (tmpDir) => { setupActionsVars(tmpDir, tmpDir); @@ -1136,7 +1269,7 @@ test.serial( SAMPLE_DOTCOM_API_DETAILS, GitHubVariant.DOTCOM, false, - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), + createFeatures([]), getRunnerLogger(true), ); @@ -1611,7 +1744,7 @@ test.serial( ); test.serial( - "getEnabledVersionsWithOverlayBaseDatabases returns flag-enabled versions present in cache, sorted desc", + "getEnabledVersionsWithOverlayBaseDatabases returns enabled versions present in cache, sorted desc", async (t) => { sinon.stub(api, "getAutomationID").resolves("test/"); sinon.stub(api, "listActionsCaches").resolves([ @@ -1632,7 +1765,6 @@ test.serial( const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( overlayMatchEnabledVersions, ["javascript"], - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), getRunnerLogger(true), ); t.deepEqual(result, [ @@ -1643,7 +1775,7 @@ test.serial( ); test.serial( - "getEnabledVersionsWithOverlayBaseDatabases returns empty when no cached version is flag-enabled", + "getEnabledVersionsWithOverlayBaseDatabases returns empty when no cached version is enabled", async (t) => { sinon.stub(api, "getAutomationID").resolves("test/"); sinon.stub(api, "listActionsCaches").resolves([ @@ -1655,7 +1787,6 @@ test.serial( const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( overlayMatchEnabledVersions, ["javascript"], - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), getRunnerLogger(true), ); t.deepEqual(result, []); @@ -1672,7 +1803,6 @@ const noLanguagesMacro = makeMacro({ const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( overlayMatchEnabledVersions, rawLanguages, - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), getRunnerLogger(true), ); t.deepEqual(result, []); @@ -1697,7 +1827,6 @@ test.serial( const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( overlayMatchEnabledVersions, ["javascript"], - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), getRunnerLogger(true), ); t.deepEqual(result, []); @@ -1717,7 +1846,6 @@ test.serial( const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( overlayMatchEnabledVersions, ["javascript"], - createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]), getRunnerLogger(true), ); t.deepEqual(result, [ @@ -1726,25 +1854,6 @@ test.serial( }, ); -test.serial( - "getEnabledVersionsWithOverlayBaseDatabases does not list caches when the gate is off", - async (t) => { - const listStub = sinon.stub(api, "listActionsCaches").resolves([]); - - const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases( - overlayMatchEnabledVersions, - ["javascript"], - createFeatures([]), - getRunnerLogger(true), - ); - t.deepEqual(result, []); - t.assert( - listStub.notCalled, - "Should not list Actions caches when the gating feature flag is off.", - ); - }, -); - /** The CLI version that the toolcache cleanup tests download. */ const CLEANUP_CLI_VERSION = "2.21.0"; /** The bundle version that the toolcache cleanup tests download. */ diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 9cd8ca470..6932478bc 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -183,21 +183,16 @@ async function findOverridingToolsInCache( /** * Returns the sorted set of enabled versions that have cached overlay-base databases for the - * given languages, or an empty list if the `OverlayAnalysisMatchCodeqlVersion` feature flag is - * disabled. + * given languages. */ export async function getEnabledVersionsWithOverlayBaseDatabases( defaultCliVersion: CodeQLDefaultVersionInfo, rawLanguages: string[] | undefined, - features: FeatureEnablement, logger: Logger, ): Promise { if (rawLanguages === undefined || rawLanguages.length === 0) { return []; } - if (!(await features.getValue(Feature.OverlayAnalysisMatchCodeqlVersion))) { - return []; - } let cachedVersions: string[] | undefined; try { @@ -231,24 +226,30 @@ export async function getEnabledVersionsWithOverlayBaseDatabases( /** * Resolves the newest enabled default CLI version that has a cached overlay-base database for the - * relevant languages, if running a Code Scanning analysis for a pull request and one exists. - * Otherwise, falls back to the newest enabled default CLI version. + * relevant languages, if running a Code Scanning analysis for a pull request with multiple enabled + * default versions in a supported environment and one exists. Otherwise, falls back to the newest + * enabled default CLI version. */ async function resolveDefaultCliVersion( defaultCliVersion: CodeQLDefaultVersionInfo, rawLanguages: string[] | undefined, useOverlayAwareDefaultCliVersion: boolean, - features: FeatureEnablement, + variant: util.GitHubVariant, logger: Logger, ): Promise { - if (!useOverlayAwareDefaultCliVersion || !isAnalyzingPullRequest()) { + if ( + !useOverlayAwareDefaultCliVersion || + (variant !== util.GitHubVariant.DOTCOM && + variant !== util.GitHubVariant.GHEC_DR) || + defaultCliVersion.enabledVersions.length === 1 || + !isAnalyzingPullRequest() + ) { return defaultCliVersion.enabledVersions[0]; } const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases( defaultCliVersion, rawLanguages, - features, logger, ); if (overlayVersions.length > 0) { @@ -445,7 +446,7 @@ export async function getCodeQLSource( defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - features, + variant, logger, ); cliVersion = version.cliVersion; @@ -468,7 +469,7 @@ export async function getCodeQLSource( defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - features, + variant, logger, ); cliVersion = version.cliVersion; From 912708411bb42510370cb242ff6dd011cda4af78 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Fri, 16 Oct 2026 15:07:36 +0100 Subject: [PATCH 3/9] Remove redundant empty-list check Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 6 +----- src/setup-codeql.ts | 8 +------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 2982b8495..b6728397f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -176293,13 +176293,9 @@ async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, raw return []; } const cachedVersionsSet = new Set(cachedVersions); - const overlayVersions = defaultCliVersion.enabledVersions.filter( + return defaultCliVersion.enabledVersions.filter( (v) => cachedVersionsSet.has(v.cliVersion) ); - if (overlayVersions.length === 0) { - return []; - } - return overlayVersions; } async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, variant, logger2) { if (!useOverlayAwareDefaultCliVersion || variant !== "GitHub.com" /* DOTCOM */ && variant !== "GitHub Enterprise Cloud with data residency" /* GHEC_DR */ || defaultCliVersion.enabledVersions.length === 1 || !isAnalyzingPullRequest()) { diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 6932478bc..cece0dcd2 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -213,15 +213,9 @@ export async function getEnabledVersionsWithOverlayBaseDatabases( } const cachedVersionsSet = new Set(cachedVersions); - const overlayVersions = defaultCliVersion.enabledVersions.filter((v) => + return defaultCliVersion.enabledVersions.filter((v) => cachedVersionsSet.has(v.cliVersion), ); - - if (overlayVersions.length === 0) { - return []; - } - - return overlayVersions; } /** From d1db36d3020dba2af0937a898accb5b0c9d8bdbd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:54:13 +0000 Subject: [PATCH 4/9] Bump the npm-minor group across 1 directory with 3 updates Bumps the npm-minor group with 3 updates in the / directory: [uuid](https://github.com/uuidjs/uuid), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `uuid` from 14.0.2 to 14.0.3 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](https://github.com/uuidjs/uuid/compare/v14.0.2...v14.0.3) Updates `eslint-plugin-jsdoc` from 65.2.0 to 65.3.4 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.2.0...v65.3.4) Updates `typescript-eslint` from 8.71.1 to 8.71.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 65.3.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 140 +++++++++++++++++++++++----------------------- package.json | 6 +- 2 files changed, 73 insertions(+), 73 deletions(-) diff --git a/package-lock.json b/package-lock.json index cfc9b231f..8f37440fe 100644 --- a/package-lock.json +++ b/package-lock.json @@ -36,7 +36,7 @@ "node-forge": "^1.4.0", "semver": "^7.8.5", "undici": "^6.28.0", - "uuid": "^14.0.2" + "uuid": "^14.0.3" }, "devDependencies": { "@ava/typescript": "6.0.0", @@ -57,14 +57,14 @@ "eslint-import-resolver-typescript": "^4.4.5", "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", - "eslint-plugin-jsdoc": "^65.2.0", + "eslint-plugin-jsdoc": "^65.3.4", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", "globals": "^17.13.0", "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.71.1" + "typescript-eslint": "^8.71.2" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -2702,17 +2702,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz", - "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz", + "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.71.1", - "@typescript-eslint/type-utils": "8.71.1", - "@typescript-eslint/utils": "8.71.1", - "@typescript-eslint/visitor-keys": "8.71.1", + "@typescript-eslint/scope-manager": "8.71.2", + "@typescript-eslint/type-utils": "8.71.2", + "@typescript-eslint/utils": "8.71.2", + "@typescript-eslint/visitor-keys": "8.71.2", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2725,7 +2725,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.71.1", + "@typescript-eslint/parser": "^8.71.2", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2741,16 +2741,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz", - "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz", + "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.71.1", - "@typescript-eslint/types": "8.71.1", - "@typescript-eslint/typescript-estree": "8.71.1", - "@typescript-eslint/visitor-keys": "8.71.1", + "@typescript-eslint/scope-manager": "8.71.2", + "@typescript-eslint/types": "8.71.2", + "@typescript-eslint/typescript-estree": "8.71.2", + "@typescript-eslint/visitor-keys": "8.71.2", "debug": "^4.4.3" }, "engines": { @@ -2784,14 +2784,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz", - "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz", + "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.71.1", - "@typescript-eslint/types": "^8.71.1", + "@typescript-eslint/tsconfig-utils": "^8.71.2", + "@typescript-eslint/types": "^8.71.2", "debug": "^4.4.3" }, "engines": { @@ -2824,14 +2824,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz", - "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz", + "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.71.1", - "@typescript-eslint/visitor-keys": "8.71.1" + "@typescript-eslint/types": "8.71.2", + "@typescript-eslint/visitor-keys": "8.71.2" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2842,9 +2842,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz", - "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz", + "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==", "dev": true, "license": "MIT", "engines": { @@ -2859,15 +2859,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz", - "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz", + "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.71.1", - "@typescript-eslint/typescript-estree": "8.71.1", - "@typescript-eslint/utils": "8.71.1", + "@typescript-eslint/types": "8.71.2", + "@typescript-eslint/typescript-estree": "8.71.2", + "@typescript-eslint/utils": "8.71.2", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2902,9 +2902,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz", - "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz", + "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==", "dev": true, "license": "MIT", "engines": { @@ -2916,16 +2916,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz", - "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz", + "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.71.1", - "@typescript-eslint/tsconfig-utils": "8.71.1", - "@typescript-eslint/types": "8.71.1", - "@typescript-eslint/visitor-keys": "8.71.1", + "@typescript-eslint/project-service": "8.71.2", + "@typescript-eslint/tsconfig-utils": "8.71.2", + "@typescript-eslint/types": "8.71.2", + "@typescript-eslint/visitor-keys": "8.71.2", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -3001,16 +3001,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz", - "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz", + "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.71.1", - "@typescript-eslint/types": "8.71.1", - "@typescript-eslint/typescript-estree": "8.71.1" + "@typescript-eslint/scope-manager": "8.71.2", + "@typescript-eslint/types": "8.71.2", + "@typescript-eslint/typescript-estree": "8.71.2" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -3025,13 +3025,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz", - "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz", + "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.71.1", + "@typescript-eslint/types": "8.71.2", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -5365,9 +5365,9 @@ } }, "node_modules/eslint-plugin-jsdoc": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz", - "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==", + "version": "65.3.4", + "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz", + "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==", "dev": true, "license": "BSD-3-Clause", "dependencies": { @@ -9981,16 +9981,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.71.1", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz", - "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==", + "version": "8.71.2", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz", + "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.71.1", - "@typescript-eslint/parser": "8.71.1", - "@typescript-eslint/typescript-estree": "8.71.1", - "@typescript-eslint/utils": "8.71.1" + "@typescript-eslint/eslint-plugin": "8.71.2", + "@typescript-eslint/parser": "8.71.2", + "@typescript-eslint/typescript-estree": "8.71.2", + "@typescript-eslint/utils": "8.71.2" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -10167,9 +10167,9 @@ "license": "MIT" }, "node_modules/uuid": { - "version": "14.0.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz", - "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==", + "version": "14.0.3", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.3.tgz", + "integrity": "sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==", "funding": [ "https://github.com/sponsors/broofa", "https://github.com/sponsors/ctavan" diff --git a/package.json b/package.json index 9bfd79222..76ac14cf2 100644 --- a/package.json +++ b/package.json @@ -44,7 +44,7 @@ "node-forge": "^1.4.0", "semver": "^7.8.5", "undici": "^6.28.0", - "uuid": "^14.0.2" + "uuid": "^14.0.3" }, "devDependencies": { "@ava/typescript": "6.0.0", @@ -65,14 +65,14 @@ "eslint-import-resolver-typescript": "^4.4.5", "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", - "eslint-plugin-jsdoc": "^65.2.0", + "eslint-plugin-jsdoc": "^65.3.4", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", "globals": "^17.13.0", "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.71.1" + "typescript-eslint": "^8.71.2" }, "overrides": { "@actions/tool-cache": { From ec3f8658b6956d81e8d3947e0199d9b2a5ee5e44 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:56:03 +0000 Subject: [PATCH 5/9] Bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java), [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad) Updates `ruby/setup-ruby` from 1.327.0 to 1.329.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/14594264cd68ce8a2345dd349bc3d138a4ef85c8...651ff0d62c5c79bed6d53ec518387aae20e72c1a) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: ruby/setup-ruby dependency-version: 1.329.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .../workflows/__autobuild-direct-tracing-with-working-dir.yml | 2 +- .github/workflows/__build-mode-autobuild.yml | 2 +- .github/workflows/__rubocop-multi-language.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/rollback-release.yml | 2 +- .github/workflows/update-release-branch.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index e0ff968bd..bad4921eb 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -63,7 +63,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index edc1d505d..76e3f348a 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -63,7 +63,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 7bda6ce9f..c3348db6c 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0 + uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 354da0afd..76ef6e555 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -134,7 +134,7 @@ jobs: echo "::endgroup::" - name: Generate token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.AUTOMATION_APP_ID }} diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 01651796e..14a8490b8 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -139,7 +139,7 @@ jobs: - name: Generate token if: github.event_name == 'workflow_dispatch' - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.AUTOMATION_APP_ID }} diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index a506b87ce..981a38eac 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -95,7 +95,7 @@ jobs: pull-requests: write # needed to create pull request steps: - name: Generate token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.AUTOMATION_APP_ID }} From fb5d8688b9288d836fcfe44a6ea1f42cb1a47bca Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:58:09 +0000 Subject: [PATCH 6/9] Rebuild --- pr-checks/checks/rubocop-multi-language.yml | 2 +- pr-checks/sync.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 633c2a379..eec3aa833 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0 + uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index d6382786c..08b514adf 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -263,8 +263,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "de7274f081f381c8f8158605e0321c36c376e2e6", - "v6.0.1", + "b843ebf9b913146b38da2eaa7aeddf76074ae1ad", + "v6.1.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, From c758339759af8b8eaa99b7db1d25882a5d1bef9f Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 22 Oct 2026 10:17:07 +0100 Subject: [PATCH 7/9] Trigger workflows From 347d5ce5d59a46d1719e8b2f20356db6ed01c040 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 22 Oct 2026 10:17:39 +0100 Subject: [PATCH 8/9] Trigger workflows From 54af742a29bcb8826f1e5770122d631f23dbc169 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 22 Oct 2026 10:58:51 +0100 Subject: [PATCH 9/9] Simplify the condition for overlay-aware version selection Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 7 +++-- src/setup-codeql.test.ts | 57 +++++----------------------------------- src/setup-codeql.ts | 12 +++------ 3 files changed, 13 insertions(+), 63 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 4c3d9ac8a..0c08cab1b 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -176305,8 +176305,9 @@ async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, raw (v) => cachedVersionsSet.has(v.cliVersion) ); } -async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, variant, logger2) { - if (!useOverlayAwareDefaultCliVersion || variant !== "GitHub.com" /* DOTCOM */ && variant !== "GitHub Enterprise Cloud with data residency" /* GHEC_DR */ || defaultCliVersion.enabledVersions.length === 1 || !isAnalyzingPullRequest()) { +async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, logger2) { + if (!useOverlayAwareDefaultCliVersion || // Listing the Actions cache can't change which version we use if only one version is enabled. + defaultCliVersion.enabledVersions.length === 1 || !isAnalyzingPullRequest()) { return defaultCliVersion.enabledVersions[0]; } const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases( @@ -176418,7 +176419,6 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - variant, logger2 ); cliVersion2 = version.cliVersion; @@ -176438,7 +176438,6 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - variant, logger2 ); cliVersion2 = version.cliVersion; diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 5ee914c1e..5bbbf1871 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -1069,53 +1069,8 @@ async function fakeOverlayBaseCacheKey( return `${prefix}${suffix}`; } -for (const variant of [GitHubVariant.DOTCOM, GitHubVariant.GHEC_DR]) { - test.serial( - `getCodeQLSource uses overlay-aware default version for a Code Scanning PR on ${variant}`, - async (t) => { - await withTmpDir(async (tmpDir) => { - setupActionsVars(tmpDir, tmpDir); - process.env[EnvVar.CODE_SCANNING_REF] = "refs/heads/feature-branch"; - process.env[EnvVar.CODE_SCANNING_BASE_BRANCH] = "main"; - - sinon.stub(api, "getAutomationID").resolves("test/"); - const listStub = sinon.stub(api, "listActionsCaches").resolves([ - { - key: await fakeOverlayBaseCacheKey( - "javascript", - "2.20.1", - "abc-1-1", - ), - }, - ]); - sinon - .stub(toolcache, "find") - .withArgs("CodeQL", "2.20.1") - .returns("/path/to/codeql-2.20.1"); - - const source = await setupCodeql.getCodeQLSource( - undefined, - overlayMatchEnabledVersions, - ["javascript"], - undefined, // otherLanguagePacksReason - true, - SAMPLE_DOTCOM_API_DETAILS, - variant, - false, - createFeatures([]), - getRunnerLogger(true), - ); - - t.assert(listStub.calledOnce); - t.is(source.sourceType, "toolcache"); - t.is(source.toolsVersion, "2.20.1"); - }); - }, - ); -} - test.serial( - "getCodeQLSource skips overlay-aware default version for a Code Scanning PR on GHES", + "getCodeQLSource uses overlay-aware default version for a Code Scanning PR", async (t) => { await withTmpDir(async (tmpDir) => { setupActionsVars(tmpDir, tmpDir); @@ -1130,8 +1085,8 @@ test.serial( ]); sinon .stub(toolcache, "find") - .withArgs("CodeQL", "2.20.2") - .returns("/path/to/codeql-2.20.2"); + .withArgs("CodeQL", "2.20.1") + .returns("/path/to/codeql-2.20.1"); const source = await setupCodeql.getCodeQLSource( undefined, @@ -1140,15 +1095,15 @@ test.serial( undefined, // otherLanguagePacksReason true, SAMPLE_DOTCOM_API_DETAILS, - GitHubVariant.GHES, + GitHubVariant.DOTCOM, false, createFeatures([]), getRunnerLogger(true), ); - t.assert(listStub.notCalled); + t.assert(listStub.calledOnce); t.is(source.sourceType, "toolcache"); - t.is(source.toolsVersion, "2.20.2"); + t.is(source.toolsVersion, "2.20.1"); }); }, ); diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index eb7c93be6..c895f57f7 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -220,21 +220,19 @@ export async function getEnabledVersionsWithOverlayBaseDatabases( /** * Resolves the newest enabled default CLI version that has a cached overlay-base database for the - * relevant languages, if running a Code Scanning analysis for a pull request with multiple enabled - * default versions in a supported environment and one exists. Otherwise, falls back to the newest - * enabled default CLI version. + * relevant languages, if this is a Code Scanning analysis of a pull request, multiple default + * versions are enabled, and such a version exists. Otherwise, falls back to the newest enabled + * default CLI version. */ async function resolveDefaultCliVersion( defaultCliVersion: CodeQLDefaultVersionInfo, rawLanguages: string[] | undefined, useOverlayAwareDefaultCliVersion: boolean, - variant: util.GitHubVariant, logger: Logger, ): Promise { if ( !useOverlayAwareDefaultCliVersion || - (variant !== util.GitHubVariant.DOTCOM && - variant !== util.GitHubVariant.GHEC_DR) || + // Listing the Actions cache can't change which version we use if only one version is enabled. defaultCliVersion.enabledVersions.length === 1 || !isAnalyzingPullRequest() ) { @@ -440,7 +438,6 @@ export async function getCodeQLSource( defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - variant, logger, ); cliVersion = version.cliVersion; @@ -463,7 +460,6 @@ export async function getCodeQLSource( defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, - variant, logger, ); cliVersion = version.cliVersion;