Merge analyze-javascript and analyze-other into one matrixed job

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/codeql/codeql-config-actions.yml

@@ -0,0 +1,5 @@
+paths-ignore:
+  - lib
+  - tests
+queries:
+  - uses: security-and-quality

.github/workflows/__runner-images.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: PR Check - Linux Arm64
+name: PR Check - Runner images
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -47,16 +47,38 @@ defaults:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: runner-images-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
-  linux-arm64:
+  runner-images:
     strategy:
       fail-fast: false
       matrix:
         include:
+          - os: ubuntu-22.04
+            version: linked
+          - os: ubuntu-22.04-arm
+            version: linked
+          - os: ubuntu-24.04
+            version: linked
           - os: ubuntu-24.04-arm
-            version: nightly-latest
-    name: Linux Arm64
+            version: linked
+          - os: ubuntu-26.04
+            version: linked
+          - os: ubuntu-26.04-arm
+            version: linked
+          - os: windows-2022
+            version: linked
+          - os: windows-2025
+            version: linked
+          - os: macos-15-large
+            version: linked
+          - os: macos-15-xlarge
+            version: linked
+          - os: macos-26-large
+            version: linked
+          - os: macos-26-xlarge
+            version: linked
+    name: Runner images
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -102,5 +124,5 @@ jobs:
             echo "Found database for $lang"
           done
     env:
-      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
+      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/codeql.yml

@@ -19,70 +19,16 @@ env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
-  # Identify the CodeQL tool versions to use in the analysis job.
-  check-codeql-versions:
+  analyze:
     if: github.triggering_actor != 'dependabot[bot]'
     runs-on: ubuntu-26.04
-    outputs:
-      versions: ${{ steps.compare.outputs.versions }}
 
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up default CodeQL bundle
-        id: setup-default
-        uses: ./setup-codeql
-      - name: Set up linked CodeQL bundle
-        id: setup-linked
-        uses: ./setup-codeql
-        with:
-          tools: linked
-      - name: Compare default and linked CodeQL bundle versions
-        id: compare
-        env:
-          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-        run: |
-          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
-
-          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-          # required status check.
-          #
-          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-          # the same as running with `tools: null`.
-          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-            VERSIONS_JSON='[null]'
-          else
-            VERSIONS_JSON='[null, "linked"]'
-          fi
-
-          # Output a JSON-encoded list with the distinct versions to test against.
-          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
-
-  analyze-javascript:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: [check-codeql-versions]
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-22.04
-          - ubuntu-24.04
-          - windows-2022
-          - windows-2025
-          - macos-14-xlarge
-          - macos-15-xlarge
-        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
-    runs-on: ${{ matrix.os }}
+        language:
+          - actions
+          - javascript
 
     permissions:
       contents: read
@@ -95,49 +41,15 @@ jobs:
         uses: ./init
         id: init
         with:
-          languages: javascript
-          config-file: ./.github/codeql/codeql-config-javascript.yml
-          tools: ${{ matrix.tools }}
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
       # confirm steps.init.outputs.codeql-path points to the codeql binary
       - name: Print CodeQL Version
         run: >
           "$CODEQL" version --format=json
         env:
           CODEQL: ${{steps.init.outputs.codeql-path}}
-      - name: Perform CodeQL Analysis
-        uses: ./analyze
-        with:
-          category: "/language:javascript"
-          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
-
-  analyze-other:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-26.04
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: ./init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config: >
-            paths-ignore:
-              - lib
-              - tests
-            queries:
-              - uses: security-and-quality
       - name: Perform CodeQL Analysis
         uses: ./analyze
         with:

.github/workflows/deflake.yml

@@ -61,6 +61,7 @@ on:
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
       - "PR Check - Ruby analysis"
+      - "PR Check - Runner images"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"
       - "PR Check - Start proxy"

CHANGELOG.md

@@ -6,6 +6,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 No user facing changes.
 
+## 4.39.3 - 04 Nov 2026
+
+- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
+
 ## 4.39.2 - 03 Nov 2026
 
 - Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.3",
+      "version": "4.39.4",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -59,7 +59,7 @@
         "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jsdoc": "^65.4.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
-        "glob": "^13.0.6",
+        "glob": "^14.0.3",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
         "prettier": "^3.9.10",
@@ -1811,6 +1811,12 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
+      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@mapbox/node-pre-gyp": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -3524,7 +3530,6 @@
     },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -3534,7 +3539,6 @@
       "version": "6.2.3",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
       "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -4439,7 +4443,6 @@
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -4450,7 +4453,6 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/comment-parser": {
@@ -4575,7 +4577,6 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "dev": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -4830,7 +4831,6 @@
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-abstract": {
@@ -6273,14 +6273,14 @@
       }
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
+      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.2",
+        "minimatch": "^11.0.2",
         "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
+        "path-scurry": "^3.0.0"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6324,12 +6324,13 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
+      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "@isaacs/nonrecursive-glob-match": "^1.0.2",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6858,7 +6859,6 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7169,7 +7169,6 @@
     },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/js-string-escape": {
@@ -7479,9 +7478,9 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="
     },
     "node_modules/lru-cache": {
-      "version": "11.5.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
-      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -8572,7 +8571,6 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8584,9 +8582,9 @@
       "license": "MIT"
     },
     "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
@@ -9172,7 +9170,6 @@
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -9183,7 +9180,6 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -9269,7 +9265,6 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "dev": true,
       "engines": {
         "node": ">=14"
       },
@@ -9456,7 +9451,6 @@
     },
     "node_modules/string-width": {
       "version": "4.2.3",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -9542,7 +9536,6 @@
     },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -10280,7 +10273,6 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.4",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -69,7 +69,7 @@
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-jsdoc": "^65.4.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^13.0.6",
+    "glob": "^14.0.3",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
     "prettier": "^3.9.10",
@@ -96,7 +96,7 @@
     "eslint-plugin-jsx-a11y": {
       "semver": ">=6.3.1"
     },
-    "glob": "^13.0.6",
+    "glob": "^14.0.3",
     "undici": "^7.30.1"
   }
 }

pr-checks/checks/linux-arm64.yml

@@ -1,35 +0,0 @@
-name: "Linux Arm64"
-description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
-operatingSystems:
-  - os: ubuntu
-    runner-image: ubuntu-24.04-arm
-# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
-# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
-# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
-versions:
-  - nightly-latest
-installGo: true
-installDotNet: true
-# The set of languages CodeQL supports on this platform, excluding Swift (macOS only).
-env:
-  LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
-steps:
-  - uses: ./../action/init
-    with:
-      languages: ${{ env.LANGUAGES }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Build code
-    run: ./build.sh
-  - uses: ./../action/analyze
-    with:
-      upload-database: false
-  - name: Assert databases exist
-    run: |
-      cd "$RUNNER_TEMP/codeql_databases"
-      for lang in ${LANGUAGES//,/ }; do
-        if [[ ! -d "$lang" ]]; then
-          echo "Did not find a database for $lang"
-          exit 1
-        fi
-        echo "Found database for $lang"
-      done

pr-checks/checks/runner-images.yml

@@ -0,0 +1,66 @@
+name: "Runner images"
+description: "An end-to-end integration test checking that CodeQL can analyze interpreted and compiled code on the GitHub-hosted runner images"
+# This check runs on each image listed in
+# https://github.com/actions/runner-images#available-images, except for:
+# - `ubuntu-slim`, which is intended for lightweight jobs rather than builds like this one.
+# - `windows-11-arm`, since CodeQL doesn't support Windows on Arm64.
+# - `xcode-27`, a preview image that the `unsupported-macos` check runs on.
+operatingSystems:
+  # The Ubuntu 22.04 images have brownouts from 23 March 2027 and are retired on 17 April 2027, so
+  # remove them before the brownouts start.
+  # See https://github.com/actions/runner-images/issues/14254.
+  - os: ubuntu
+    runner-image: ubuntu-22.04
+  - os: ubuntu
+    runner-image: ubuntu-22.04-arm
+  - os: ubuntu
+    runner-image: ubuntu-24.04
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+  - os: ubuntu
+    runner-image: ubuntu-26.04
+  - os: ubuntu
+    runner-image: ubuntu-26.04-arm
+  - os: windows
+    runner-image: windows-2022
+  - os: windows
+    runner-image: windows-2025
+  # Use larger runners for macOS to keep these jobs off the critical path.
+  - os: macos
+    runner-image: macos-15-large
+  - os: macos
+    runner-image: macos-15-xlarge
+  - os: macos
+    runner-image: macos-26-large
+  - os: macos
+    runner-image: macos-26-xlarge
+# Other PR checks cover the supported CodeQL versions, so this check only tests the linked version.
+# Linux Arm64 bundles are only available for CodeQL 2.27.0 and later, so older stable versions
+# can't run on the Arm64 images.
+versions:
+  - linked
+installGo: true
+installDotNet: true
+# The languages to build and analyze. CodeQL only supports Swift on macOS.
+env:
+  LANGUAGES: "cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}"
+steps:
+  - uses: ./../action/init
+    with:
+      languages: ${{ env.LANGUAGES }}
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in ${LANGUAGES//,/ }; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+        echo "Found database for $lang"
+      done

pr-checks/excluded.yml

@@ -24,3 +24,5 @@ is:
   # PRs), so requiring them would block the PRs they don't run on.
   - "github-advanced-security"
   - "License compliance check"
+  # Only runs when a PR is removed from the merge queue.
+  - "Notify"

src/actions-util.ts

@@ -78,6 +78,12 @@ export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
   );
 }
 
+const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
+
+export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
+  return path.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
+}
+
 export function getActionVersion(): string {
   return __CODEQL_ACTION_VERSION__;
 }

src/analyze.ts

@@ -19,10 +19,9 @@ import {
 } from "./dependency-caching";
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
-  type DiffThunkRange,
-  getDiffRangesJsonFilePath,
+  DiffThunkRange,
   readDiffRangesJsonFile,
-} from "./diff-informed";
+} from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
 import { getGitRoot } from "./git-utils";
@@ -296,10 +295,7 @@ export async function setupDiffInformedQueryRun(
   return await withGroupAsync(
     "Generating diff range extension pack",
     async () => {
-      const diffRanges = readDiffRangesJsonFile(
-        logger,
-        getDiffRangesJsonFilePath(),
-      );
+      const diffRanges = readDiffRangesJsonFile(logger);
       if (diffRanges === undefined) {
         logger.info(
           "No precomputed diff ranges found; skipping diff-informed analysis stage.",

src/config-utils.test.ts

@@ -15,7 +15,6 @@ import { createStubCodeQL } from "./codeql";
 import { UserConfig } from "./config/db-config";
 import * as file from "./config/file";
 import * as configUtils from "./config-utils";
-import { ActionsEnvVars } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
@@ -43,7 +42,6 @@ import {
   SAMPLE_DOTCOM_API_DETAILS,
   AssertableTarget,
   RecordingLogger,
-  getTestEnv,
 } from "./testing-utils";
 import {
   GitHubVariant,
@@ -153,11 +151,9 @@ function mockListLanguages(languages: string[]) {
 test.serial("load empty config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
-
     const languages = "javascript,python";
 
-    setupActionsVars(tempDir, tempDir, {}, state.env);
+    setupActionsVars(tempDir, tempDir);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -170,6 +166,7 @@ test.serial("load empty config", async (t) => {
       },
     });
 
+    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -200,10 +197,9 @@ test.serial("load empty config", async (t) => {
 test.serial("load code quality config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
     const languages = "actions";
 
-    setupActionsVars(tempDir, tempDir, {}, state.env);
+    setupActionsVars(tempDir, tempDir);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -215,6 +211,7 @@ test.serial("load code quality config", async (t) => {
       },
     });
 
+    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -256,10 +253,9 @@ test.serial(
   async (t) => {
     return await withTmpDir(async (tempDir) => {
       const logger = new RecordingLogger();
-      const state = initAllState({ logger });
       const languages = "javascript";
 
-      setupActionsVars(tempDir, tempDir, {}, state.env);
+      setupActionsVars(tempDir, tempDir);
 
       const codeql = createStubCodeQL({
         async resolveLanguages() {
@@ -295,6 +291,7 @@ test.serial(
         repositoryProperties,
       });
 
+      const state = initAllState({ logger });
       await t.notThrowsAsync(async () => {
         const config = await configUtils.initConfig(
           state,
@@ -319,8 +316,6 @@ test.serial(
 test.serial("loading a saved config produces the same config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
-    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -339,6 +334,7 @@ test.serial("loading a saved config produces the same config", async (t) => {
     // Sanity check that getConfig returns undefined before we have called initConfig
     t.deepEqual(await configUtils.getConfig(tempDir, logger), undefined);
 
+    const state = initAllState({ logger });
     const config1 = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -368,8 +364,6 @@ test.serial("loading a saved config produces the same config", async (t) => {
 test.serial("loading config with version mismatch throws", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
-    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -393,6 +387,7 @@ test.serial("loading config with version mismatch throws", async (t) => {
       .stub(actionsUtil, "getActionVersion")
       .returns("does-not-exist");
 
+    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -502,8 +497,7 @@ const otherConfigFileContents = `
 
 test.serial("load non-empty input", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    const state = initAllState();
-    setupActionsVars(tempDir, tempDir, {}, state.env);
+    setupActionsVars(tempDir, tempDir);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -544,6 +538,7 @@ test.serial("load non-empty input", async (t) => {
     const languagesInput = "javascript";
     const configFilePath = createConfigFile(otherConfigFileContents, tempDir);
 
+    const state = initAllState();
     const actualConfig = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -662,9 +657,7 @@ test.serial("API client used when reading remote config", async (t) => {
     const configFile = "octo-org/codeql-config/config.yaml@main";
     const languagesInput = "javascript";
 
-    const state = initAllState({
-      env: getTestEnv({ [ActionsEnvVars.RUNNER_TEMP]: tempDir }),
-    });
+    const state = initAllState();
     await configUtils.initConfig(
       state,
       createTestInitConfigInputs({

src/config-utils.ts

@@ -48,10 +48,7 @@ import {
   addNoLanguageDiagnostic,
   makeTelemetryDiagnostic,
 } from "./diagnostics";
-import {
-  getDiffRangesJsonFilePath,
-  prepareDiffInformedAnalysis,
-} from "./diff-informed";
+import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
 import { EnvVar, exportEnvVar, getEnv } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
@@ -1291,10 +1288,9 @@ export async function initConfig(
   }
 
   const hasDiffRanges = await prepareDiffInformedAnalysis(
-    logger,
-    inputs.features,
     inputs.codeql,
-    getDiffRangesJsonFilePath(actionState.env),
+    inputs.features,
+    logger,
   );
 
   await applyIncrementalAnalysisSettings(

src/diff-informed-analysis-utils.test.ts

@@ -1,12 +1,16 @@
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
 
-import * as actionsUtil from "../actions-util";
-import type { PullRequestBranches } from "../actions-util";
-import * as apiClient from "../api-client";
-import { getEnv } from "../environment";
-import { Feature, FeatureEnablement, initFeatures } from "../feature-flags";
-import { parseRepositoryNwo } from "../repository";
+import * as actionsUtil from "./actions-util";
+import type { PullRequestBranches } from "./actions-util";
+import * as apiClient from "./api-client";
+import {
+  getDiffInformedAnalysisBranches,
+  prepareDiffInformedAnalysis,
+  exportedForTesting,
+} from "./diff-informed-analysis-utils";
+import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
+import { parseRepositoryNwo } from "./repository";
 import {
   setupTests,
   createFeatures,
@@ -15,16 +19,9 @@ import {
   setupActionsVars,
   makeMacro,
   RecordingLogger,
-} from "../testing-utils";
-import { GitHubVariant, withTmpDir } from "../util";
-import type { GitHubVersion } from "../util";
-
-import {
-  getDiffInformedAnalysisBranches,
-  prepareDiffInformedAnalysis,
-  exportedForTesting,
-  getDiffRangesJsonFilePath,
-} from ".";
+} from "./testing-utils";
+import { GitHubVariant, withTmpDir } from "./util";
+import type { GitHubVersion } from "./util";
 
 setupTests(test);
 
@@ -195,10 +192,9 @@ test.serial(
         .resolves({ type: GitHubVariant.DOTCOM });
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.false(result);
@@ -226,10 +222,9 @@ test.serial(
       };
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.false(result);
@@ -264,10 +259,9 @@ test.serial(
       } as any);
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.true(result);
@@ -302,10 +296,9 @@ test.serial(
       } as any);
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.false(result);

src/diff-informed-analysis-utils.ts

@@ -1,43 +1,23 @@
 import * as fs from "fs";
-import path from "path";
 
-import * as actionsUtil from "../actions-util";
-import type { PullRequestBranches } from "../actions-util";
-import { getApiClient, getGitHubVersion } from "../api-client";
-import type { CodeQL } from "../codeql";
-import { type Env, getEnv } from "../environment";
-import type { FeatureEnablement } from "../feature-flags";
-import { Feature } from "../feature-flags/features";
-import { Logger } from "../logging";
-import { getRepositoryNwoFromEnv } from "../repository";
-import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "../util";
-
-/** The filename used to persist PR diff ranges. */
-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-/**
- * Gets the full path of the file used to persist PR diff ranges.
- */
-export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
-  return path.join(
-    actionsUtil.getTemporaryDirectory(env),
-    PR_DIFF_RANGE_JSON_FILENAME,
-  );
-}
+import * as actionsUtil from "./actions-util";
+import type { PullRequestBranches } from "./actions-util";
+import { getApiClient, getGitHubVersion } from "./api-client";
+import type { CodeQL } from "./codeql";
+import { Feature, FeatureEnablement } from "./feature-flags";
+import { Logger } from "./logging";
+import { getRepositoryNwoFromEnv } from "./repository";
+import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
 
 /**
  * This interface is an abbreviated version of the file diff object returned by
  * the GitHub API.
  */
-export interface FileDiff {
-  /** The name of the file that has changed. */
+interface FileDiff {
   filename: string;
-  /** The number of changes. */
   changes: number;
-  /**
-   * The diff, if available. It may be absent if the file is binary, if the file diff is too large,
-   * or if the file is unchanged.
-   */
+  // A patch may be absent if the file is binary, if the file diff is too large,
+  // or if the file is unchanged.
   patch?: string | undefined;
 }
 
@@ -83,10 +63,9 @@ export async function getDiffInformedAnalysisBranches(
  *   and are therefore available for use, `false` otherwise.
  */
 export async function prepareDiffInformedAnalysis(
-  logger: Logger,
-  features: FeatureEnablement,
   codeql: CodeQL,
-  jsonFilePath: string,
+  features: FeatureEnablement,
+  logger: Logger,
 ): Promise<boolean> {
   let branches: PullRequestBranches | undefined;
   try {
@@ -105,7 +84,7 @@ export async function prepareDiffInformedAnalysis(
   }
 
   try {
-    return await computeAndPersistDiffRanges(logger, jsonFilePath, branches);
+    return await computeAndPersistDiffRanges(branches, logger);
   } catch (e) {
     logger.warning(
       `Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
@@ -114,45 +93,29 @@ export async function prepareDiffInformedAnalysis(
   }
 }
 
-/** Describes a changed line range in a file. */
 export interface DiffThunkRange {
   /** Relative path from the repository root, using forward slashes as separators. */
   path: string;
-  /** The starting line of the change (1-based and inclusive). */
   startLine: number;
-  /** The last line of the change (1-based and inclusive). */
   endLine: number;
 }
 
-/**
- * Writes an array of {@link DiffThunkRange} objects to the file given by {@link jsonFilePath}.
- *
- * @param logger The logger to use.
- * @param jsonFilePath The path of the file to write.
- * @param ranges The changed line ranges to write.
- */
 export function writeDiffRangesJsonFile(
   logger: Logger,
-  jsonFilePath: string,
   ranges: DiffThunkRange[],
 ): void {
   const jsonContents = JSON.stringify(ranges, null, 2);
+  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
   fs.writeFileSync(jsonFilePath, jsonContents);
   logger.debug(
     `Wrote pr-diff-range JSON file to ${jsonFilePath}:\n${jsonContents}`,
   );
 }
 
-/**
- * Reads an array of {@link DiffThunkRange} objects from the file given by {@link jsonFilePath}.
- *
- * @param logger The logger to use.
- * @returns The array of {@link DiffThunkRange} objects or `undefined` if the file couldn't be read.
- */
 export function readDiffRangesJsonFile(
   logger: Logger,
-  jsonFilePath: string,
 ): DiffThunkRange[] | undefined {
+  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
   if (!fs.existsSync(jsonFilePath)) {
     logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`);
     return undefined;
@@ -175,12 +138,12 @@ export function readDiffRangesJsonFile(
  * Return the file line ranges that were added or modified in the pull request.
  *
  * @param branches The base and head branches of the pull request.
- * @param logger The logger to use.
- *
- * @returns
- *  An array of {@link DiffThunkRange} objects, where each describes a line range in a file
- *  that was changed in the pull request described by {@link branches} or `undefined` if
- *  we were unable to compute them.
+ * @param logger
+ * @returns An array of tuples, where each tuple contains the relative path of a
+ * file (relative to the repository root, as returned by the GitHub compare API),
+ * the start line and the end line (both 1-based and inclusive) of an
+ * added or modified range in that file. Returns `undefined` if the action was
+ * not triggered by a pull request or if there was an error.
  */
 export async function getPullRequestEditedDiffRanges(
   branches: PullRequestBranches,
@@ -217,25 +180,22 @@ export async function getPullRequestEditedDiffRanges(
  * diff from the GitHub API and writes it to the diff ranges JSON file so that
  * CodeQL can use it for diff-informed analysis.
  *
- * @param logger The logger to use.
- * @param jsonFilePath The path of the JSON file to write.
  * @param branches The base and head branches of the pull request, as returned
  *   by `getDiffInformedAnalysisBranches`.
- *
+ * @param logger
  * @returns `true` if the diff ranges were successfully computed and persisted,
  *   otherwise `false`.
  */
 export async function computeAndPersistDiffRanges(
-  logger: Logger,
-  jsonFilePath: string,
   branches: PullRequestBranches,
+  logger: Logger,
 ): Promise<boolean> {
   logger.info("Computing PR diff ranges...");
   const ranges = await getPullRequestEditedDiffRanges(branches, logger);
   if (ranges === undefined) {
     return false;
   }
-  writeDiffRangesJsonFile(logger, jsonFilePath, ranges);
+  writeDiffRangesJsonFile(logger, ranges);
   const distinctFiles = new Set(ranges.map((r) => r.path)).size;
   logger.info(
     `Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
@@ -243,19 +203,6 @@ export async function computeAndPersistDiffRanges(
   return true;
 }
 
-/**
- * Fetch an array of {@link FileDiff} objects using the GitHub API describing the changed files
- * in the pull request with the base and head refs given by {@link branches}.
- *
- * @param branches The pull request branch refs.
- * @param logger The logger to use.
- *
- * @throws Non-HTTP errors that occur while fetching the file diffs.
- *
- * @returns
- *  An array of {@link FileDiff} objects describing the changed files in the PR, or
- *  `undefined` if we couldn't obtain the changed files from the API.
- */
 async function getFileDiffsWithBasehead(
   branches: PullRequestBranches,
   logger: Logger,
@@ -296,16 +243,6 @@ async function getFileDiffsWithBasehead(
   }
 }
 
-/**
- * Extracts an array of {@link DiffThunkRange} objects from {@link fileDiff}.
- *
- * @param fileDiff The {@link FileDiff} object describing changes to a particular file.
- * @param logger The logger to use.
- *
- * @returns
- *  The {@link DiffThunkRange} objects extracted from {@link fileDiff},
- *  or `undefined` if there are none that could be extracted.
- */
 function getDiffRanges(
   fileDiff: FileDiff,
   logger: Logger,

src/overlay/index.test.ts

@@ -5,7 +5,6 @@ import test from "ava";
 import * as sinon from "sinon";
 
 import * as actionsUtil from "../actions-util";
-import * as diffInformed from "../diff-informed";
 import * as gitUtils from "../git-utils";
 import {
   createTestConfig,
@@ -61,7 +60,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
       const changesFilePath = await writeOverlayChangesFile(
@@ -127,7 +126,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
 
@@ -197,7 +196,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
 
@@ -260,7 +259,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       // getGitRoot returns the repo root (parent of sourceRoot)
       sinon.stub(gitUtils, "getGitRoot").resolves(repoRoot);

src/overlay/index.ts

@@ -1,9 +1,9 @@
 import * as fs from "fs";
 import * as path from "path";
 
+import * as actionsUtil from "../actions-util";
 import { getOptionalInput, getTemporaryDirectory } from "../actions-util";
 import { type Config } from "../config-utils";
-import { getDiffRangesJsonFilePath } from "../diff-informed";
 import { getFileOidsUnderPath, getGitRoot } from "../git-utils";
 import { Logger } from "../logging";
 import { getBaseDatabaseOidsFilePath } from "../util";
@@ -135,7 +135,7 @@ async function getDiffRangeFilePaths(
   sourceRoot: string,
   logger: Logger,
 ): Promise<string[]> {
-  const jsonFilePath = getDiffRangesJsonFilePath();
+  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
 
   if (!fs.existsSync(jsonFilePath)) {
     logger.debug(

src/setup-codeql.test.ts

@@ -1821,7 +1821,8 @@ function createToolcacheEntry(
 /**
  * Stubs out the download and the diagnostic sink, then downloads the CodeQL tools.
  *
- * @returns the extraction directory and the toolcache cleanup diagnostic, if emitted.
+ * @returns the extraction directory and, if the toolcache cleanup diagnostic was emitted, the
+ * cleanup duration it reports and its other attributes.
  */
 async function runDownloadCodeQL(
   toolcacheRoot: string,
@@ -1837,6 +1838,7 @@ async function runDownloadCodeQL(
 ): Promise<{
   codeqlFolder: string;
   cleanupDiagnostic: toolsDownload.ToolcacheCleanupResult | undefined;
+  cleanupDurationMs: number | undefined;
 }> {
   stubDownloadAndExtract();
   const addDiagnostic = sinon.stub(diagnostics, "addNoLanguageDiagnostic");
@@ -1866,11 +1868,21 @@ async function runDownloadCodeQL(
     .map((call) => call.args[1])
     .find((d) => d.source?.id === "codeql-action/toolcache-bundle-cleanup");
 
-  return {
-    codeqlFolder,
-    cleanupDiagnostic: diagnostic?.attributes as
-      toolsDownload.ToolcacheCleanupResult | undefined,
-  };
+  if (diagnostic === undefined) {
+    return {
+      codeqlFolder,
+      cleanupDiagnostic: undefined,
+      cleanupDurationMs: undefined,
+    };
+  }
+
+  // The duration varies between runs, so split it out to let tests compare the other attributes
+  // exactly.
+  const { durationMs, ...cleanupDiagnostic } =
+    diagnostic.attributes as toolsDownload.ToolcacheCleanupResult & {
+      durationMs: number;
+    };
+  return { codeqlFolder, cleanupDiagnostic, cleanupDurationMs: durationMs };
 }
 
 /**
@@ -1991,6 +2003,35 @@ test.serial(
   },
 );
 
+test.serial(
+  "downloadCodeQLBundle reports the total time taken to clean up the toolcache",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+
+      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_CLI_VERSION);
+      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_STALE_VERSION);
+
+      // Advance the clock by 1.5s each time a path is deleted, so that deleting both versions
+      // takes 3s.
+      let elapsedMs = 1000;
+      sinon.stub(performance, "now").callsFake(() => elapsedMs);
+      const rm = fs.promises.rm;
+      sinon.stub(fs.promises, "rm").callsFake(async (...args) => {
+        elapsedMs += 1500;
+        await rm(...args);
+      });
+
+      const { cleanupDurationMs } = await runDownloadCodeQL(
+        tmpDir,
+        CLEANUP_BUNDLE_VERSION,
+      );
+
+      t.is(cleanupDurationMs, 3000);
+    });
+  },
+);
+
 test.serial(
   "downloadCodeQLBundle reports no deleted versions when the toolcache has no CodeQL bundles",
   async (t) => {

src/setup-codeql.ts

@@ -814,6 +814,7 @@ async function tryDeleteToolcacheBundles({
     return;
   }
 
+  const startTime = performance.now();
   const result = await deleteToolcacheBundles({ env, logger });
 
   addNoLanguageDiagnostic(
@@ -821,7 +822,7 @@ async function tryDeleteToolcacheBundles({
     makeTelemetryDiagnostic(
       "codeql-action/toolcache-bundle-cleanup",
       "Toolcache CodeQL bundle cleanup",
-      { ...result },
+      { ...result, durationMs: util.durationMsSince(startTime) },
     ),
   );
 }

src/tools-download.ts

@@ -342,13 +342,16 @@ export async function deleteToolcacheBundles({
       const versionDirectory = path.join(toolDirectory, entry.name);
 
       try {
+        const deletionStart = performance.now();
         await fs.promises.rm(versionDirectory, {
           force: true,
           recursive: true,
         });
         deletedVersions.push(entry.name);
         logger.info(
-          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space.`,
+          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space (${formatDuration(
+            durationMsSince(deletionStart),
+          )}).`,
         );
       } catch (e) {
         failed = true;

src/upload-lib.test.ts

@@ -9,7 +9,7 @@ import * as sinon from "sinon";
 import * as analyses from "./analyses";
 import { AnalysisKind, CodeQuality, CodeScanning } from "./analyses";
 import * as api from "./api-client";
-import * as diffUtils from "./diff-informed";
+import * as diffUtils from "./diff-informed-analysis-utils";
 import { getEnv } from "./environment";
 import { Logger } from "./logging";
 import * as sarif from "./sarif";
@@ -1074,7 +1074,6 @@ function runFilterAlertsByDiffRange(
   logger: Logger = new RecordingLogger(),
 ): Partial<sarif.Log> {
   sinon.stub(diffUtils, "readDiffRangesJsonFile").returns(diffRanges);
-  sinon.stub(diffUtils, "getDiffRangesJsonFilePath").returns("");
   return uploadLib.filterAlertsByDiffRange(logger, input);
 }
 

src/upload-lib.ts

@@ -13,10 +13,7 @@ import * as api from "./api-client";
 import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import type { ActionConfig } from "./config/action-config";
-import {
-  getDiffRangesJsonFilePath,
-  readDiffRangesJsonFile,
-} from "./diff-informed";
+import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
 import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
@@ -1082,10 +1079,7 @@ export function filterAlertsByDiffRange(
   logger: Logger,
   sarifLog: Partial<sarif.Log>,
 ): Partial<sarif.Log> {
-  const diffRanges = readDiffRangesJsonFile(
-    logger,
-    getDiffRangesJsonFilePath(),
-  );
+  const diffRanges = readDiffRangesJsonFile(logger);
   if (!diffRanges?.length) {
     return sarifLog;
   }

unreleased-change-notes/decode-diff-informed-sarif-uris.md

@@ -1 +0,0 @@
-- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)