From 99971dd136aecba06b031d54b7695b66be2b5ce2 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Wed, 28 Oct 2026 13:19:40 +0000
Subject: [PATCH] Gate checks behind FF

---
 lib/entry-points.js          |  3 +++
 src/languages/traced.test.ts | 51 +++++++++++++++++++++++++++++++++---
 src/languages/traced.ts      |  7 +++++
 3 files changed, 58 insertions(+), 3 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index 4deb1fb26..d01987f6f 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -193983,6 +193983,9 @@ async function hasTracedLanguages(config, codeql) {
 async function checkRunnerSupportsTracedAnalysis(action, config, codeql) {
   const version = darwinVersion(action);
   await checkSwiftCompatibility(config, codeql, version);
+  if (!await action.features.getValue("check_unsupported_traced_analysis" /* CheckUnsupportedTracedAnalysis */)) {
+    return;
+  }
   if (config.buildMode !== void 0 && config.buildMode === "none") {
     return;
   }
diff --git a/src/languages/traced.test.ts b/src/languages/traced.test.ts
index 3b8a3b331..2faf7f1ba 100644
--- a/src/languages/traced.test.ts
+++ b/src/languages/traced.test.ts
@@ -139,11 +139,12 @@ for (const nonTracedLanguage of nonTracedLanguages) {
     }));
 }
 
-test("checkRunnerSupportsTracedAnalysis warns if version string is not a semver", async (t) =>
+test("checkRunnerSupportsTracedAnalysis doesn't perform checks if FF is not enabled", async (t) =>
   withTmpDir(async (tmpDir) => {
     const logger = new RecordingLogger();
     const env = getTestEnv();
     env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+    const features = createFeatures([]);
 
     const codeql = await getCodeQLWithTracedStub(
       "codeql-for-testing",
@@ -158,6 +159,38 @@ test("checkRunnerSupportsTracedAnalysis warns if version string is not a semver"
         platform: "darwin",
         osRelease: "unexpected",
         env,
+        features,
+      }),
+      createTestConfig({ languages: [BuiltInLanguage.go] }),
+      codeql,
+    );
+
+    checkUnexpectedLogMessages(t, logger.messages, [
+      "Unable to determine version of macOS, got: unexpected",
+    ]);
+  }));
+
+test("checkRunnerSupportsTracedAnalysis warns if version string is not a semver", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+    const features = createFeatures([Feature.CheckUnsupportedTracedAnalysis]);
+
+    const codeql = await getCodeQLWithTracedStub(
+      "codeql-for-testing",
+      logger,
+      env,
+    );
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await checkRunnerSupportsTracedAnalysis(
+      initAllState({
+        logger,
+        platform: "darwin",
+        osRelease: "unexpected",
+        env,
+        features,
       }),
       createTestConfig({ languages: [BuiltInLanguage.go] }),
       codeql,
@@ -174,6 +207,7 @@ test.serial(
   async (t) =>
     withTmpDir(async (tmpDir) => {
       const logger = new RecordingLogger();
+      const features = createFeatures([Feature.CheckUnsupportedTracedAnalysis]);
       const env = getTestEnv();
       env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
 
@@ -193,6 +227,7 @@ test.serial(
           platform: "darwin",
           osRelease: "27.0.0",
           env,
+          features,
         }),
         config,
         codeql,
@@ -235,7 +270,10 @@ test.serial(
       const env = getTestEnv();
       env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
 
-      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
+      const features = createFeatures([
+        Feature.CheckUnsupportedTracedAnalysis,
+        Feature.SkipUnsupportedTracedAnalysis,
+      ]);
 
       const codeql = await getCodeQLWithTracedStub(
         "codeql-for-testing",
@@ -293,6 +331,7 @@ test.serial(
       const logger = new RecordingLogger();
       const env = getTestEnv();
       env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+      const features = createFeatures([Feature.CheckUnsupportedTracedAnalysis]);
 
       const lstatSync = sinon
         .stub(fs, "lstatSync")
@@ -317,6 +356,7 @@ test.serial(
           platform: "darwin",
           osRelease: "26.0.0",
           env,
+          features,
         }),
         config,
         codeql,
@@ -346,6 +386,7 @@ test.serial(
       const logger = new RecordingLogger();
       const env = getTestEnv();
       env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+      const features = createFeatures([Feature.CheckUnsupportedTracedAnalysis]);
 
       const lstatSync = sinon
         .stub(fs, "lstatSync")
@@ -370,6 +411,7 @@ test.serial(
           platform: "darwin",
           osRelease: "26.0.0",
           env,
+          features,
         }),
         config,
         codeql,
@@ -427,7 +469,10 @@ test.serial(
         .stub(fs, "readlinkSync")
         .returns("/Applications/Xcode_27.0.app/Contents/Developer");
 
-      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
+      const features = createFeatures([
+        Feature.CheckUnsupportedTracedAnalysis,
+        Feature.SkipUnsupportedTracedAnalysis,
+      ]);
 
       const codeql = await getCodeQLWithTracedStub(
         "codeql-for-testing",
diff --git a/src/languages/traced.ts b/src/languages/traced.ts
index f2b23170b..2d0c5f934 100644
--- a/src/languages/traced.ts
+++ b/src/languages/traced.ts
@@ -125,6 +125,13 @@ export async function checkRunnerSupportsTracedAnalysis(
   // Perform some initial, Swift-specific checks.
   await checkSwiftCompatibility(config, codeql, version);
 
+  // Skip the checks for unsupported traced analysis if the FF is not enabled.
+  if (
+    !(await action.features.getValue(Feature.CheckUnsupportedTracedAnalysis))
+  ) {
+    return;
+  }
+
   // `build-mode: none` doesn't use the tracer, so it is always supported.
   if (config.buildMode !== undefined && config.buildMode === "none") {
     return;