Merge branch 'main' into redsun82/fix-windows-ci

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-
+<!-- For GitHub staff: Remember that this is a public repository. -->
 
 ### Risk assessment
 

CHANGELOG.md

@@ -4,6 +4,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
+- We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
+
+## 3.30.3 - 10 Sep 2025
+
 No user facing changes.
 
 ## 3.30.2 - 09 Sep 2025

lib/analyze-action-post.js

@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -117686,7 +117686,7 @@ function withGroup(groupName, f) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -117960,7 +117960,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs3.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -118251,7 +118262,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",

lib/analyze-action.js

@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -90811,7 +90811,7 @@ function formatDuration(durationMs) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -91620,7 +91620,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs9.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -92814,7 +92825,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",
@@ -93707,7 +93717,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
   async function runInterpretResultsFor(analysis, language, queries, enableDebugLogging) {
     logger.info(`Interpreting ${analysis.name} results for ${language}`);
     let category = automationDetailsId;
-    if (dbAnalysisConfig.kind === "code-quality" /* CodeQuality */) {
+    if (analysis.kind === "code-quality" /* CodeQuality */) {
       category = fixCodeQualityCategory(logger, automationDetailsId);
     }
     const sarifFile = path16.join(
@@ -95613,6 +95623,10 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   validateUniqueCategory(sarif, uploadTarget.sentinelPrefix);
   logger.debug(`Serializing SARIF for upload`);
   const sarifPayload = JSON.stringify(sarif);
+  const dumpDir = process.env["CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */];
+  if (dumpDir) {
+    dumpSarifFile(sarifPayload, dumpDir, logger, uploadTarget);
+  }
   logger.debug(`Compressing serialized SARIF`);
   const zippedSarif = import_zlib.default.gzipSync(sarifPayload).toString("base64");
   const checkoutURI = url.pathToFileURL(checkoutPath).href;
@@ -95651,6 +95665,21 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
     sarifID
   };
 }
+function dumpSarifFile(sarifPayload, outputDir, logger, uploadTarget) {
+  if (!fs18.existsSync(outputDir)) {
+    fs18.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs18.lstatSync(outputDir).isDirectory()) {
+    throw new ConfigurationError(
+      `The path specified by the ${"CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */} environment variable exists and is not a directory: ${outputDir}`
+    );
+  }
+  const outputFile = path18.resolve(
+    outputDir,
+    `upload${uploadTarget.sarifExtension}`
+  );
+  logger.info(`Dumping processed SARIF file to ${outputFile}`);
+  fs18.writeFileSync(outputFile, sarifPayload);
+}
 var STATUS_CHECK_FREQUENCY_MILLISECONDS = 5 * 1e3;
 var STATUS_CHECK_TIMEOUT_MILLISECONDS = 2 * 60 * 1e3;
 async function waitForProcessing(repositoryNwo, sarifID, logger, options = {

lib/autobuild-action.js

@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -78426,7 +78426,7 @@ function getActionsLogger() {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -78962,7 +78962,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs4.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -79286,7 +79297,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",

lib/init-action-post.js

@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -129016,7 +129016,7 @@ function formatDuration(durationMs) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -129575,7 +129575,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs9.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -130724,7 +130735,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",
@@ -133050,6 +133060,10 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   validateUniqueCategory(sarif, uploadTarget.sentinelPrefix);
   logger.debug(`Serializing SARIF for upload`);
   const sarifPayload = JSON.stringify(sarif);
+  const dumpDir = process.env["CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */];
+  if (dumpDir) {
+    dumpSarifFile(sarifPayload, dumpDir, logger, uploadTarget);
+  }
   logger.debug(`Compressing serialized SARIF`);
   const zippedSarif = import_zlib.default.gzipSync(sarifPayload).toString("base64");
   const checkoutURI = url.pathToFileURL(checkoutPath).href;
@@ -133088,6 +133102,21 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
     sarifID
   };
 }
+function dumpSarifFile(sarifPayload, outputDir, logger, uploadTarget) {
+  if (!fs17.existsSync(outputDir)) {
+    fs17.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs17.lstatSync(outputDir).isDirectory()) {
+    throw new ConfigurationError(
+      `The path specified by the ${"CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */} environment variable exists and is not a directory: ${outputDir}`
+    );
+  }
+  const outputFile = path17.resolve(
+    outputDir,
+    `upload${uploadTarget.sarifExtension}`
+  );
+  logger.info(`Dumping processed SARIF file to ${outputFile}`);
+  fs17.writeFileSync(outputFile, sarifPayload);
+}
 var STATUS_CHECK_FREQUENCY_MILLISECONDS = 5 * 1e3;
 var STATUS_CHECK_TIMEOUT_MILLISECONDS = 2 * 60 * 1e3;
 async function waitForProcessing(repositoryNwo, sarifID, logger, options = {
@@ -133256,7 +133285,8 @@ function toCodedErrors(errors) {
 }
 var WorkflowErrors = toCodedErrors({
   MissingPushHook: `Please specify an on.push hook to analyze and see code scanning alerts from the default branch on the Security tab.`,
-  CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`
+  CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
+  InconsistentActionVersion: `Not all workflow steps that use \`github/codeql-action\` actions use the same version. Please ensure that all such steps use the same version to avoid compatibility issues.`
 });
 async function getWorkflow(logger) {
   const maybeWorkflow = process.env["CODE_SCANNING_WORKFLOW_FILE"];

lib/init-action.js

@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -86417,7 +86417,7 @@ function formatDuration(durationMs) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -87335,6 +87335,7 @@ async function initActionState({
     augmentationProperties
   );
   return {
+    version: getActionVersion(),
     analysisKinds,
     languages,
     buildMode,
@@ -89408,7 +89409,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",
@@ -90110,7 +90110,8 @@ function toCodedErrors(errors) {
 }
 var WorkflowErrors = toCodedErrors({
   MissingPushHook: `Please specify an on.push hook to analyze and see code scanning alerts from the default branch on the Security tab.`,
-  CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`
+  CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
+  InconsistentActionVersion: `Not all workflow steps that use \`github/codeql-action\` actions use the same version. Please ensure that all such steps use the same version to avoid compatibility issues.`
 });
 async function groupLanguagesByExtractor(languages, codeql) {
   const resolveResult = await codeql.betterResolveLanguages();
@@ -90164,6 +90165,22 @@ async function getWorkflowErrors(doc, codeql) {
       }
     }
   }
+  const codeqlStepRefs = [];
+  for (const job of Object.values(doc?.jobs || {})) {
+    if (Array.isArray(job.steps)) {
+      for (const step of job.steps) {
+        if (step.uses?.startsWith("github/codeql-action/")) {
+          const parts = step.uses.split("@");
+          if (parts.length >= 2) {
+            codeqlStepRefs.push(parts[parts.length - 1]);
+          }
+        }
+      }
+    }
+  }
+  if (codeqlStepRefs.length > 0 && !codeqlStepRefs.every((ref) => ref === codeqlStepRefs[0])) {
+    errors.push(WorkflowErrors.InconsistentActionVersion);
+  }
   const hasPushTrigger = hasWorkflowTrigger("push", doc);
   const hasPullRequestTrigger = hasWorkflowTrigger("pull_request", doc);
   const hasWorkflowCallTrigger = hasWorkflowTrigger("workflow_call", doc);

lib/resolve-environment-action.js

@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -78419,7 +78419,7 @@ function getActionsLogger() {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -78689,7 +78689,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs3.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -78986,7 +78997,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",

lib/start-proxy-action-post.js

@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -117158,7 +117158,7 @@ function getActionsLogger() {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
 // src/tools-features.ts
@@ -117369,7 +117369,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 
 // src/debug-artifacts.ts

lib/start-proxy-action.js

@@ -44966,7 +44966,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {

lib/upload-lib.js

@@ -33584,7 +33584,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -89114,7 +89114,7 @@ function formatDuration(durationMs) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -89403,7 +89403,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs7.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -90552,7 +90563,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",
@@ -92422,6 +92432,10 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   validateUniqueCategory(sarif, uploadTarget.sentinelPrefix);
   logger.debug(`Serializing SARIF for upload`);
   const sarifPayload = JSON.stringify(sarif);
+  const dumpDir = process.env["CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */];
+  if (dumpDir) {
+    dumpSarifFile(sarifPayload, dumpDir, logger, uploadTarget);
+  }
   logger.debug(`Compressing serialized SARIF`);
   const zippedSarif = import_zlib.default.gzipSync(sarifPayload).toString("base64");
   const checkoutURI = url.pathToFileURL(checkoutPath).href;
@@ -92460,6 +92474,21 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
     sarifID
   };
 }
+function dumpSarifFile(sarifPayload, outputDir, logger, uploadTarget) {
+  if (!fs13.existsSync(outputDir)) {
+    fs13.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs13.lstatSync(outputDir).isDirectory()) {
+    throw new ConfigurationError(
+      `The path specified by the ${"CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */} environment variable exists and is not a directory: ${outputDir}`
+    );
+  }
+  const outputFile = path14.resolve(
+    outputDir,
+    `upload${uploadTarget.sarifExtension}`
+  );
+  logger.info(`Dumping processed SARIF file to ${outputFile}`);
+  fs13.writeFileSync(outputFile, sarifPayload);
+}
 var STATUS_CHECK_FREQUENCY_MILLISECONDS = 5 * 1e3;
 var STATUS_CHECK_TIMEOUT_MILLISECONDS = 2 * 60 * 1e3;
 async function waitForProcessing(repositoryNwo, sarifID, logger, options = {

lib/upload-sarif-action-post.js

@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -117319,7 +117319,7 @@ function withGroup(groupName, f) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
 // src/tools-features.ts

lib/upload-sarif-action.js

@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "3.30.3",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -89108,7 +89108,7 @@ function formatDuration(durationMs) {
 
 // src/overlay-database-utils.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
-var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6e3;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
   const gitFileOids = await getFileOidsUnderPath(sourceRoot);
@@ -89677,7 +89677,18 @@ async function getConfig(tempDir, logger) {
   const configString = fs8.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString);
+  const config = JSON.parse(configString);
+  if (config.version === void 0) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`
+    );
+  }
+  return config;
 }
 function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   const augmentedConfig = cloneObject(cliConfig);
@@ -91253,7 +91264,6 @@ ${output}`
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024",
         // Try to leave at least 1GB free
         "-v",
@@ -93123,6 +93133,10 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   validateUniqueCategory(sarif, uploadTarget.sentinelPrefix);
   logger.debug(`Serializing SARIF for upload`);
   const sarifPayload = JSON.stringify(sarif);
+  const dumpDir = process.env["CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */];
+  if (dumpDir) {
+    dumpSarifFile(sarifPayload, dumpDir, logger, uploadTarget);
+  }
   logger.debug(`Compressing serialized SARIF`);
   const zippedSarif = import_zlib.default.gzipSync(sarifPayload).toString("base64");
   const checkoutURI = url.pathToFileURL(checkoutPath).href;
@@ -93161,6 +93175,21 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
     sarifID
   };
 }
+function dumpSarifFile(sarifPayload, outputDir, logger, uploadTarget) {
+  if (!fs14.existsSync(outputDir)) {
+    fs14.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs14.lstatSync(outputDir).isDirectory()) {
+    throw new ConfigurationError(
+      `The path specified by the ${"CODEQL_ACTION_SARIF_DUMP_DIR" /* SARIF_DUMP_DIR */} environment variable exists and is not a directory: ${outputDir}`
+    );
+  }
+  const outputFile = path15.resolve(
+    outputDir,
+    `upload${uploadTarget.sarifExtension}`
+  );
+  logger.info(`Dumping processed SARIF file to ${outputFile}`);
+  fs14.writeFileSync(outputFile, sarifPayload);
+}
 var STATUS_CHECK_FREQUENCY_MILLISECONDS = 5 * 1e3;
 var STATUS_CHECK_TIMEOUT_MILLISECONDS = 2 * 60 * 1e3;
 async function waitForProcessing(repositoryNwo, sarifID, logger, options = {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "3.30.3",
+  "version": "3.30.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "3.30.3",
+      "version": "3.30.4",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^2.3.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.30.3",
+  "version": "3.30.4",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/analyze.ts

@@ -780,7 +780,7 @@ export async function runQueries(
     // If this is a Code Quality analysis, correct the category to one
     // accepted by the Code Quality backend.
     let category = automationDetailsId;
-    if (dbAnalysisConfig.kind === analyses.AnalysisKind.CodeQuality) {
+    if (analysis.kind === analyses.AnalysisKind.CodeQuality) {
       category = fixCodeQualityCategory(logger, automationDetailsId);
     }
 

src/codeql.test.ts

@@ -953,7 +953,7 @@ test("runTool recognizes fatal internal errors", async (t) => {
       await codeqlObject.databaseRunQueries(stubConfig.dbLocation, []),
     {
       instanceOf: CliError,
-      message: `Encountered a fatal error while running "codeql-for-testing database run-queries  --intra-layer-parallelism --min-disk-free=1024 -v". Exit code was 1 and error was: Oops! A fatal internal error occurred. Details:
+      message: `Encountered a fatal error while running "codeql-for-testing database run-queries  --min-disk-free=1024 -v". Exit code was 1 and error was: Oops! A fatal internal error occurred. Details:
     com.semmle.util.exception.CatastrophicError: An error occurred while evaluating ControlFlowGraph::ControlFlow::Root.isRootOf/1#dispred#f610e6ed/2@86282cc8
     Severe disk cache trouble (corruption or out of space) at /home/runner/work/_temp/codeql_databases/go/db-go/default/cache/pages/28/33.pack: Failed to write item to disk. See the logs for more details.`,
     },

src/codeql.ts

@@ -789,7 +789,6 @@ export async function getCodeQLForCmd(
         "run-queries",
         ...flags,
         databasePath,
-        "--intra-layer-parallelism",
         "--min-disk-free=1024", // Try to leave at least 1GB free
         "-v",
         ...queries,

src/config-utils.test.ts

@@ -199,6 +199,7 @@ test("load code quality config", async (t) => {
 
     // And the config we expect it to result in
     const expectedConfig: configUtils.Config = {
+      version: actionsUtil.getActionVersion(),
       analysisKinds: [AnalysisKind.CodeQuality],
       languages: [KnownLanguage.actions],
       buildMode: undefined,
@@ -273,6 +274,55 @@ test("loading config saves config", async (t) => {
   });
 });
 
+test("loading config with version mismatch throws", async (t) => {
+  return await withTmpDir(async (tempDir) => {
+    const logger = getRunnerLogger(true);
+
+    const codeql = createStubCodeQL({
+      async betterResolveLanguages() {
+        return {
+          extractors: {
+            javascript: [{ extractor_root: "" }],
+            python: [{ extractor_root: "" }],
+          },
+        };
+      },
+    });
+
+    // Sanity check the saved config file does not already exist
+    t.false(fs.existsSync(configUtils.getPathToParsedConfigFile(tempDir)));
+
+    // Sanity check that getConfig returns undefined before we have called initConfig
+    t.deepEqual(await configUtils.getConfig(tempDir, logger), undefined);
+
+    // Stub `getActionVersion` to return some nonsense.
+    const getActionVersionStub = sinon
+      .stub(actionsUtil, "getActionVersion")
+      .returns("does-not-exist");
+
+    await configUtils.initConfig(
+      createTestInitConfigInputs({
+        languagesInput: "javascript,python",
+        tempDir,
+        codeql,
+        workspacePath: tempDir,
+        logger,
+      }),
+    );
+
+    // Restore `getActionVersion`.
+    getActionVersionStub.restore();
+
+    // The saved config file should now exist
+    t.true(fs.existsSync(configUtils.getPathToParsedConfigFile(tempDir)));
+
+    // Trying to read the configuration should now throw an error.
+    await t.throwsAsync(configUtils.getConfig(tempDir, logger), {
+      instanceOf: ConfigurationError,
+    });
+  });
+});
+
 test("load input outside of workspace", async (t) => {
   return await withTmpDir(async (tempDir) => {
     try {
@@ -389,6 +439,7 @@ test("load non-empty input", async (t) => {
 
     // And the config we expect it to parse to
     const expectedConfig: configUtils.Config = {
+      version: actionsUtil.getActionVersion(),
       analysisKinds: [AnalysisKind.CodeScanning],
       languages: [KnownLanguage.javascript],
       buildMode: BuildMode.None,

src/config-utils.ts

@@ -5,7 +5,7 @@ import { performance } from "perf_hooks";
 import * as yaml from "js-yaml";
 import * as semver from "semver";
 
-import { isAnalyzingPullRequest } from "./actions-util";
+import { getActionVersion, isAnalyzingPullRequest } from "./actions-util";
 import {
   AnalysisConfig,
   AnalysisKind,
@@ -102,6 +102,10 @@ interface IncludeQueryFilter {
  * Format of the parsed config file.
  */
 export interface Config {
+  /**
+   * The version of the CodeQL Action that the configuration is for.
+   */
+  version: string;
   /**
    * Set of analysis kinds that are enabled.
    */
@@ -591,6 +595,7 @@ export async function initActionState(
   );
 
   return {
+    version: getActionVersion(),
     analysisKinds,
     languages,
     buildMode,
@@ -1308,7 +1313,21 @@ export async function getConfig(
   const configString = fs.readFileSync(configFile, "utf8");
   logger.debug("Loaded config:");
   logger.debug(configString);
-  return JSON.parse(configString) as Config;
+
+  const config = JSON.parse(configString) as Partial<Config>;
+
+  if (config.version === undefined) {
+    throw new ConfigurationError(
+      `Loaded configuration file, but it does not contain the expected 'version' field.`,
+    );
+  }
+  if (config.version !== getActionVersion()) {
+    throw new ConfigurationError(
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`,
+    );
+  }
+
+  return config as Config;
 }
 
 /**

src/environment.ts

@@ -119,4 +119,10 @@ export enum EnvVar {
    * Whether to enable experimental extractors for CodeQL.
    */
   EXPERIMENTAL_FEATURES = "CODEQL_ENABLE_EXPERIMENTAL_FEATURES",
+
+  /**
+   * Whether and where to dump the processed SARIF file that would be uploaded, regardless of
+   * whether the upload is disabled. This is intended for testing and debugging purposes.
+   */
+  SARIF_DUMP_DIR = "CODEQL_ACTION_SARIF_DUMP_DIR",
 }

src/overlay-database-utils.ts

@@ -22,18 +22,23 @@ export const CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 
 /**
  * The maximum (uncompressed) size of the overlay base database that we will
- * upload. Actions Cache has an overall capacity of 10 GB, and the Actions Cache
- * client library uses zstd compression.
+ * upload. By default, the Actions Cache has an overall capacity of 10 GB, and
+ * the Actions Cache client library uses zstd compression.
  *
  * Ideally we would apply a size limit to the compressed overlay-base database,
  * but we cannot do so because compression is handled transparently by the
  * Actions Cache client library. Instead we place a limit on the uncompressed
  * size of the overlay-base database.
  *
- * Assuming 2.5:1 compression ratio, the 6 GB limit on uncompressed data would
- * translate to a limit of around 2.4 GB after compression.
+ * Assuming 2.5:1 compression ratio, the 15 GB limit on uncompressed data would
+ * translate to a limit of around 6 GB after compression. This is a high limit
+ * compared to the default 10GB Actions Cache capacity, but enforcement of Actions
+ * Cache quotas is not immediate.
+ *
+ * TODO: revisit this limit before removing the restriction for overlay analysis
+ * to the `github` and `dsp-testing` orgs.
  */
-const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 6000;
+const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15000;
 const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES =
   OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1_000_000;
 

src/testing-utils.ts

@@ -6,6 +6,7 @@ import { TestFn } from "ava";
 import nock from "nock";
 import * as sinon from "sinon";
 
+import { getActionVersion } from "./actions-util";
 import { AnalysisKind } from "./analyses";
 import * as apiClient from "./api-client";
 import { GitHubApiDetails } from "./api-client";
@@ -356,6 +357,7 @@ export function createTestConfig(overrides: Partial<Config>): Config {
   return Object.assign(
     {},
     {
+      version: getActionVersion(),
       analysisKinds: [AnalysisKind.CodeScanning],
       languages: [],
       buildMode: undefined,

src/upload-lib.ts

@@ -696,6 +696,12 @@ export async function uploadSpecifiedFiles(
   validateUniqueCategory(sarif, uploadTarget.sentinelPrefix);
   logger.debug(`Serializing SARIF for upload`);
   const sarifPayload = JSON.stringify(sarif);
+
+  const dumpDir = process.env[EnvVar.SARIF_DUMP_DIR];
+  if (dumpDir) {
+    dumpSarifFile(sarifPayload, dumpDir, logger, uploadTarget);
+  }
+
   logger.debug(`Compressing serialized SARIF`);
   const zippedSarif = zlib.gzipSync(sarifPayload).toString("base64");
   const checkoutURI = url.pathToFileURL(checkoutPath).href;
@@ -742,6 +748,30 @@ export async function uploadSpecifiedFiles(
   };
 }
 
+/**
+ * Dumps the given processed SARIF file contents to `outputDir`.
+ */
+function dumpSarifFile(
+  sarifPayload: string,
+  outputDir: string,
+  logger: Logger,
+  uploadTarget: analyses.AnalysisConfig,
+) {
+  if (!fs.existsSync(outputDir)) {
+    fs.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs.lstatSync(outputDir).isDirectory()) {
+    throw new ConfigurationError(
+      `The path specified by the ${EnvVar.SARIF_DUMP_DIR} environment variable exists and is not a directory: ${outputDir}`,
+    );
+  }
+  const outputFile = path.resolve(
+    outputDir,
+    `upload${uploadTarget.sarifExtension}`,
+  );
+  logger.info(`Dumping processed SARIF file to ${outputFile}`);
+  fs.writeFileSync(outputFile, sarifPayload);
+}
+
 const STATUS_CHECK_FREQUENCY_MILLISECONDS = 5 * 1000;
 const STATUS_CHECK_TIMEOUT_MILLISECONDS = 2 * 60 * 1000;
 

src/workflow.test.ts

@@ -655,6 +655,65 @@ test("getWorkflowErrors() should not report a warning if there is a workflow_cal
   t.deepEqual(...errorCodes(errors, []));
 });
 
+test("getWorkflowErrors() should report a warning if different versions of the CodeQL Action are used", async (t) => {
+  const errors = await getWorkflowErrors(
+    yaml.load(`
+      name: "CodeQL"
+      on:
+        push:
+          branches: [main]
+      jobs:
+        analyze:
+          steps:
+            - uses: github/codeql-action/init@v2
+            - uses: github/codeql-action/analyze@v3
+    `) as Workflow,
+    await getCodeQLForTesting(),
+  );
+
+  t.deepEqual(
+    ...errorCodes(errors, [WorkflowErrors.InconsistentActionVersion]),
+  );
+});
+
+test("getWorkflowErrors() should not report a warning if the same versions of the CodeQL Action are used", async (t) => {
+  const errors = await getWorkflowErrors(
+    yaml.load(`
+      name: "CodeQL"
+      on:
+        push:
+          branches: [main]
+      jobs:
+        analyze:
+          steps:
+            - uses: github/codeql-action/init@v3
+            - uses: github/codeql-action/analyze@v3
+    `) as Workflow,
+    await getCodeQLForTesting(),
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() should not report a warning involving versions of other actions", async (t) => {
+  const errors = await getWorkflowErrors(
+    yaml.load(`
+      name: "CodeQL"
+      on:
+        push:
+          branches: [main]
+      jobs:
+        analyze:
+          steps:
+            - uses: actions/checkout@v5
+            - uses: github/codeql-action/init@v3
+    `) as Workflow,
+    await getCodeQLForTesting(),
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
 test("getCategoryInputOrThrow returns category for simple workflow with category", (t) => {
   process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
   t.is(

src/workflow.ts

@@ -72,6 +72,7 @@ function toCodedErrors(errors: {
 export const WorkflowErrors = toCodedErrors({
   MissingPushHook: `Please specify an on.push hook to analyze and see code scanning alerts from the default branch on the Security tab.`,
   CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
+  InconsistentActionVersion: `Not all workflow steps that use \`github/codeql-action\` actions use the same version. Please ensure that all such steps use the same version to avoid compatibility issues.`,
 });
 
 /**
@@ -161,6 +162,29 @@ export async function getWorkflowErrors(
     }
   }
 
+  // Check that all `github/codeql-action` steps use the same ref, i.e. the same version.
+  // Mixing different versions of the actions can lead to unpredictable behaviour.
+  const codeqlStepRefs: string[] = [];
+  for (const job of Object.values(doc?.jobs || {})) {
+    if (Array.isArray(job.steps)) {
+      for (const step of job.steps) {
+        if (step.uses?.startsWith("github/codeql-action/")) {
+          const parts = step.uses.split("@");
+          if (parts.length >= 2) {
+            codeqlStepRefs.push(parts[parts.length - 1]);
+          }
+        }
+      }
+    }
+  }
+
+  if (
+    codeqlStepRefs.length > 0 &&
+    !codeqlStepRefs.every((ref) => ref === codeqlStepRefs[0])
+  ) {
+    errors.push(WorkflowErrors.InconsistentActionVersion);
+  }
+
   // If there is no push trigger, we will not be able to analyze the default branch.
   // So add a warning to the user to add a push trigger.
   // If there is a workflow_call trigger, we don't need a push trigger since we assume