Merge pull request #1972 from github/update-v2.22.5-2d5ffa777

Merge main into releases/v2

.github/workflows/rebuild.yml

@@ -0,0 +1,60 @@
+name: Rebuild Action
+
+on:
+  pull_request:
+    types: [labeled]
+
+jobs:
+  rebuild:
+    name: Rebuild Action
+    runs-on: ubuntu-latest
+    if: github.event.label.name == 'Rebuild'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - name: Remove label
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit --repo github/codeql-action "$PR_NUMBER" \
+            --remove-label "Rebuild"
+
+      - name: Compile TypeScript
+        run: |
+          npm install
+          npm run lint -- --fix
+          npm run build
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+
+      - name: Generate workflows
+        run: |
+          cd pr-checks
+          python -m pip install --upgrade pip
+          pip install ruamel.yaml==0.17.31
+          python3 sync.py
+
+      - name: Check for changes and push
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          if [ ! -z "$(git status --porcelain)" ]; then
+            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git config --global user.name "github-actions[bot]"
+            git commit -am "Rebuild"
+            git push origin "HEAD:$BRANCH"
+            echo "Pushed a commit to rebuild the Action." \
+              "Please mark the PR as ready for review to trigger PR checks." |
+              gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
+            gh pr ready --undo --repo github/codeql-action "$PR_NUMBER"
+          fi

.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+repos:
+  - repo: local
+    hooks:
+      - id: compile-ts
+        name: Compile typescript
+        files: \.[tj]s$
+        language: system
+        entry: npm run build
+        pass_filenames: false
+      - id: lint-ts
+        name: Lint typescript code
+        files: \.ts$
+        language: system
+        entry: npm run lint -- --fix
+      - id: pr-checks-sync
+        name: Synchronize PR check workflows
+        files: ^.github/workflows/__.*\.yml$|^pr-checks
+        language: system
+        entry: python3 pr-checks/sync.py
+        pass_filenames: false

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## [UNRELEASED]
+## 2.22.5 - 27 Oct 2023
 
 No user facing changes.
 

lib/analyze.js

@@ -232,7 +232,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 }
                 statusReport["event_reports"].push(perQueryAlertCountEventReport);
             }
-            if (!(await features.getValue(feature_flags_1.Feature.AnalysisSummaryV2Enabled, codeql))) {
+            if (!(await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_ANALYSIS_SUMMARY_V2))) {
                 await runPrintLinesOfCode(language);
             }
         }

lib/codeql.js

@@ -23,12 +23,13 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGeneratedCodeScanningConfigPath = exports.getTrapCachingExtractorConfigArgsForLang = exports.getTrapCachingExtractorConfigArgs = exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_LANGUAGE_ALIASING = exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED = exports.CODEQL_VERSION_BETTER_NO_CODE_ERROR_MESSAGE = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CommandInvocationError = void 0;
+exports.getGeneratedCodeScanningConfigPath = exports.getTrapCachingExtractorConfigArgsForLang = exports.getTrapCachingExtractorConfigArgs = exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = exports.CODEQL_VERSION_LANGUAGE_ALIASING = exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED = exports.CODEQL_VERSION_BETTER_NO_CODE_ERROR_MESSAGE = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_EXPORT_FAILED_SARIF = exports.CommandInvocationError = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const yaml = __importStar(require("js-yaml"));
+const semver = __importStar(require("semver"));
 const actions_util_1 = require("./actions-util");
 const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
@@ -90,6 +91,11 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2023-09-12";
  * For convenience, please keep these in descending order. Once a version
  * flag is older than the oldest supported version above, it may be removed.
  */
+/**
+ * Versions 2.11.3+ of the CodeQL CLI support exporting a failed SARIF file via
+ * `codeql database export-diagnostics` or `codeql diagnostics export`.
+ */
+exports.CODEQL_VERSION_EXPORT_FAILED_SARIF = "2.11.3";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 /**
  * Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for
@@ -126,6 +132,14 @@ exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = "2.14.2";
  * Versions 2.14.4+ of the CodeQL CLI support language aliasing.
  */
 exports.CODEQL_VERSION_LANGUAGE_ALIASING = "2.14.4";
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
+ */
+exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
+ */
+exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
 /**
  * Set up CodeQL CLI access.
  *
@@ -296,10 +310,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG)) {
                 extraArgs.push("--calculate-language-specific-baseline");
             }
-            if (await features.getValue(feature_flags_1.Feature.SublanguageFileCoverageEnabled, this)) {
+            if (await isSublanguageFileCoverageEnabled(config, this)) {
                 extraArgs.push("--sublanguage-file-coverage");
             }
-            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
+            else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
                 extraArgs.push("--no-sublanguage-file-coverage");
             }
             await runTool(cmd, [
@@ -470,10 +484,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (querySuitePath) {
                 codeqlArgs.push(querySuitePath);
             }
-            if (await features.getValue(feature_flags_1.Feature.EvaluatorIntraLayerParallelismEnabled, this)) {
+            if (await features.getValue(feature_flags_1.Feature.EvaluatorFineGrainedParallelismEnabled, this)) {
                 codeqlArgs.push("--intra-layer-parallelism");
             }
-            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_INTRA_LAYER_PARALLELISM)) {
+            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_FINE_GRAINED_PARALLELISM)) {
                 codeqlArgs.push("--no-intra-layer-parallelism");
             }
             await runTool(cmd, codeqlArgs);
@@ -506,10 +520,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (await util.codeQlVersionAbove(this, CODEQL_VERSION_FILE_BASELINE_INFORMATION)) {
                 codeqlArgs.push("--sarif-add-baseline-file-info");
             }
-            if (await features.getValue(feature_flags_1.Feature.SublanguageFileCoverageEnabled, this)) {
+            if (await isSublanguageFileCoverageEnabled(config, this)) {
                 codeqlArgs.push("--sublanguage-file-coverage");
             }
-            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
+            else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
                 codeqlArgs.push("--no-sublanguage-file-coverage");
             }
             if (shouldExportDiagnostics) {
@@ -518,10 +532,15 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             else if (await util.codeQlVersionAbove(this, "2.12.4")) {
                 codeqlArgs.push("--no-sarif-include-diagnostics");
             }
-            if (await features.getValue(feature_flags_1.Feature.AnalysisSummaryV2Enabled, this)) {
+            if (
+            // Analysis summary v2 links to the status page, so check the GHES version we're running on
+            // supports the status page.
+            (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
+                semver.gte(config.gitHubVersion.version, "3.9.0")) &&
+                (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2))) {
                 codeqlArgs.push("--new-analysis-summary");
             }
-            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_ANALYSIS_SUMMARY_V2)) {
+            else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2)) {
                 codeqlArgs.push("--no-new-analysis-summary");
             }
             codeqlArgs.push(databasePath);
@@ -982,4 +1001,11 @@ async function getLanguageAliasingArguments(codeql) {
     }
     return [];
 }
+async function isSublanguageFileCoverageEnabled(config, codeql) {
+    return (
+    // Sub-language file coverage is first supported in GHES 3.12.
+    (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
+        semver.gte(config.gitHubVersion.version, "3.12.0")) &&
+        (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)));
+}
 //# sourceMappingURL=codeql.js.map

lib/codeql.test.js

@@ -624,30 +624,46 @@ const injectedConfigMacro = ava_1.default.macro({
 });
 const NEW_ANALYSIS_SUMMARY_TEST_CASES = [
     {
-        featureEnabled: true,
         codeqlVersion: "2.15.0",
+        githubVersion: {
+            type: util.GitHubVariant.DOTCOM,
+        },
         flagPassed: true,
         negativeFlagPassed: false,
     },
     {
-        featureEnabled: false,
         codeqlVersion: "2.15.0",
+        githubVersion: {
+            type: util.GitHubVariant.GHES,
+            version: "3.9.0",
+        },
+        flagPassed: true,
+        negativeFlagPassed: false,
+    },
+    {
+        codeqlVersion: "2.15.0",
+        githubVersion: {
+            type: util.GitHubVariant.GHES,
+            version: "3.8.6",
+        },
         flagPassed: false,
         negativeFlagPassed: true,
     },
     {
-        featureEnabled: false,
         codeqlVersion: "2.14.6",
+        githubVersion: {
+            type: util.GitHubVariant.DOTCOM,
+        },
         flagPassed: false,
         negativeFlagPassed: false,
     },
 ];
-for (const { featureEnabled, codeqlVersion, flagPassed, negativeFlagPassed, } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
+for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
     (0, ava_1.default)(`database interpret-results passes ${flagPassed
         ? "--new-analysis-summary"
         : negativeFlagPassed
             ? "--no-new-analysis-summary"
-            : "nothing"} for CodeQL CLI v${codeqlVersion} when the new analysis summary feature is ${featureEnabled ? "enabled" : "disabled"}`, async (t) => {
+            : "nothing"} for CodeQL CLI v${codeqlVersion} and ${util.GitHubVariant[githubVersion.type]} ${githubVersion.version ? ` ${githubVersion.version}` : ""}`, async (t) => {
         const runnerConstructorStub = stubToolRunnerConstructor();
         const codeqlObject = await codeql.getCodeQLForTesting();
         sinon
@@ -655,7 +671,7 @@ for (const { featureEnabled, codeqlVersion, flagPassed, negativeFlagPassed, } of
             .resolves((0, testing_utils_1.makeVersionInfo)(codeqlVersion));
         // safeWhich throws because of the test CodeQL object.
         sinon.stub(safeWhich, "safeWhich").resolves("");
-        await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", stubConfig, (0, testing_utils_1.createFeatures)(featureEnabled ? [feature_flags_1.Feature.AnalysisSummaryV2Enabled] : []), (0, logging_1.getRunnerLogger)(true));
+        await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", Object.assign({}, stubConfig, { gitHubVersion: githubVersion }), (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.is(runnerConstructorStub.firstCall.args[1].includes("--new-analysis-summary"), flagPassed, `--new-analysis-summary should${flagPassed ? "" : "n't"} be passed`);
         t.is(runnerConstructorStub.firstCall.args[1].includes("--no-new-analysis-summary"), negativeFlagPassed, `--no-new-analysis-summary should${negativeFlagPassed ? "" : "n't"} be passed`);
     });

lib/feature-flags.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logCodeScanningConfigInCli = exports.useCodeScanningConfigInCli = exports.Features = exports.FEATURE_FLAGS_FILE_NAME = exports.featureConfig = exports.Feature = exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = exports.CODEQL_VERSION_INTRA_LAYER_PARALLELISM = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = void 0;
+exports.logCodeScanningConfigInCli = exports.useCodeScanningConfigInCli = exports.Features = exports.FEATURE_FLAGS_FILE_NAME = exports.featureConfig = exports.Feature = exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const semver = __importStar(require("semver"));
@@ -37,18 +37,10 @@ const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
  */
 exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = "2.13.4";
 /**
- * Versions 2.14.0+ of the CodeQL CLI support intra-layer parallelism (aka fine-grained parallelism) options, but we
- * limit to 2.14.6 onwards, since that's the version that has mitigations against OOM failures.
+ * Evaluator fine-grained parallelism (aka intra-layer parallelism) is only safe to enable in 2.15.1 onwards.
+ * (Some earlier versions recognize the command-line flag, but they contain a bug which makes it unsafe to use).
  */
-exports.CODEQL_VERSION_INTRA_LAYER_PARALLELISM = "2.14.6";
-/**
- * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
- */
-exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
-/**
- * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
- */
-exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
+exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM = "2.15.1";
 /**
  * Feature enablement as returned by the GitHub API endpoint.
  *
@@ -56,24 +48,16 @@ exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
  */
 var Feature;
 (function (Feature) {
-    Feature["AnalysisSummaryV2Enabled"] = "analysis_summary_v2_enabled";
     Feature["CliConfigFileEnabled"] = "cli_config_file_enabled";
     Feature["CodeqlJavaLombokEnabled"] = "codeql_java_lombok_enabled";
     Feature["CppDependencyInstallation"] = "cpp_dependency_installation_enabled";
     Feature["DisableKotlinAnalysisEnabled"] = "disable_kotlin_analysis_enabled";
     Feature["DisablePythonDependencyInstallationEnabled"] = "disable_python_dependency_installation_enabled";
-    Feature["EvaluatorIntraLayerParallelismEnabled"] = "evaluator_intra_layer_parallelism_enabled";
+    Feature["EvaluatorFineGrainedParallelismEnabled"] = "evaluator_fine_grained_parallelism_enabled";
     Feature["ExportDiagnosticsEnabled"] = "export_diagnostics_enabled";
     Feature["QaTelemetryEnabled"] = "qa_telemetry_enabled";
-    Feature["SublanguageFileCoverageEnabled"] = "sublanguage_file_coverage_enabled";
-    Feature["UploadFailedSarifEnabled"] = "upload_failed_sarif_enabled";
 })(Feature || (exports.Feature = Feature = {}));
 exports.featureConfig = {
-    [Feature.AnalysisSummaryV2Enabled]: {
-        envVar: "CODEQL_ACTION_ANALYSIS_SUMMARY_V2",
-        minimumVersion: exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
-        defaultValue: false,
-    },
     [Feature.CodeqlJavaLombokEnabled]: {
         envVar: "CODEQL_JAVA_LOMBOK",
         minimumVersion: "2.14.0",
@@ -94,9 +78,9 @@ exports.featureConfig = {
         minimumVersion: "2.11.6",
         defaultValue: true,
     },
-    [Feature.EvaluatorIntraLayerParallelismEnabled]: {
-        envVar: "CODEQL_EVALUATOR_INTRA_LAYER_PARALLELISM",
-        minimumVersion: exports.CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
+    [Feature.EvaluatorFineGrainedParallelismEnabled]: {
+        envVar: "CODEQL_EVALUATOR_FINE_GRAINED_PARALLELISM",
+        minimumVersion: exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
         defaultValue: false,
     },
     [Feature.ExportDiagnosticsEnabled]: {
@@ -109,16 +93,6 @@ exports.featureConfig = {
         minimumVersion: undefined,
         defaultValue: false,
     },
-    [Feature.SublanguageFileCoverageEnabled]: {
-        envVar: "CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE",
-        minimumVersion: exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
-        defaultValue: false,
-    },
-    [Feature.UploadFailedSarifEnabled]: {
-        envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
-        minimumVersion: "2.11.3",
-        defaultValue: true,
-    },
     [Feature.DisablePythonDependencyInstallationEnabled]: {
         envVar: "CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION",
         // Although the python extractor only started supporting not extracting installed

lib/init-action-post-helper.js

@@ -49,8 +49,8 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
         return { upload_failed_run_skipped_because: "CodeQL command not found" };
     }
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-    if (!(await features.getValue(feature_flags_1.Feature.UploadFailedSarifEnabled, codeql))) {
-        return { upload_failed_run_skipped_because: "Feature disabled" };
+    if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_EXPORT_FAILED_SARIF))) {
+        return { upload_failed_run_skipped_because: "Unsupported by CodeQL CLI" };
     }
     const workflow = await (0, workflow_1.getWorkflow)(logger);
     const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");

lib/init-action-post-helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAqC;AACrC,iDAAmD;AACnD,+CAAuC;AACvC,mDAA6D;AAG7D,wDAA0C;AAC1C,iCAKgB;AAChB,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,6BAA6B,EAAE,YAAY,CAAC,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EAAE;QACxE,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,CAAC;KAClE;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAClC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CACzC;QACD,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IAEvC,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,kFAAkF;IAClF,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EACpE;QACA,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC7D;SAAM;QACL,8EAA8E;QAC9E,MAAM,MAAM,CAAC,yBAAyB,CACpC,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;KACH;IAED,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAC3C,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,YAAY,EAAE,YAAY,IAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,iCAAiC,CAAC,KAAK,MAAM,EAAE;QACpE,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,KAAK,GAAG,CACzC,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAtDD,kBAsDC"}
+{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAyE;AACzE,iDAAmD;AACnD,+CAAuC;AACvC,mDAA6D;AAG7D,wDAA0C;AAC1C,iCAMgB;AAChB,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,6BAA6B,EAAE,YAAY,CAAC,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,2CAAkC,CAAC,CAAC,EAAE;QAC3E,OAAO,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAC;KAC3E;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAClC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CACzC;QACD,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IAEvC,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,kFAAkF;IAClF,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EACpE;QACA,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC7D;SAAM;QACL,8EAA8E;QAC9E,MAAM,MAAM,CAAC,yBAAyB,CACpC,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;KACH;IAED,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAC3C,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,YAAY,EAAE,YAAY,IAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,iCAAiC,CAAC,KAAK,MAAM,EAAE;QACpE,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,KAAK,GAAG,CACzC,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAtDD,kBAsDC"}

lib/init-action-post-helper.test.js

@@ -324,6 +324,7 @@ async function testFailedSarifUpload(t, actionsWorkflow, { category, databaseExi
         .returns(JSON.stringify(matrix));
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
+    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.12.0"));
     const databaseExportDiagnosticsStub = sinon.stub(codeqlObject, "databaseExportDiagnostics");
     const diagnosticsExportStub = sinon.stub(codeqlObject, "diagnosticsExport");
     sinon.stub(workflow, "getWorkflow").resolves(actionsWorkflow);
@@ -333,7 +334,7 @@ async function testFailedSarifUpload(t, actionsWorkflow, { category, databaseExi
         statusReport: { raw_upload_size_bytes: 20, zipped_upload_size_bytes: 10 },
     });
     const waitForProcessing = sinon.stub(uploadLib, "waitForProcessing");
-    const features = [feature_flags_1.Feature.UploadFailedSarifEnabled];
+    const features = [];
     if (exportDiagnosticsEnabled) {
         features.push(feature_flags_1.Feature.ExportDiagnosticsEnabled);
     }

lib/init-action.js

@@ -132,7 +132,11 @@ async function run() {
         toolsDownloadDurationMs = initCodeQLResult.toolsDownloadDurationMs;
         toolsVersion = initCodeQLResult.toolsVersion;
         toolsSource = initCodeQLResult.toolsSource;
-        await (0, workflow_1.validateWorkflow)(codeql, logger);
+        core.startGroup("Validating workflow");
+        if ((await (0, workflow_1.validateWorkflow)(codeql, logger)) === undefined) {
+            logger.info("Detected no issues with the code scanning workflow.");
+        }
+        core.endGroup();
         config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), registriesInput, (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), (0, actions_util_1.getOptionalInput)("config"), getTrapCachingEnabled(), 
         // Debug mode is enabled if:
         // - The `init` Action is passed `debug: true`.

pr-checks/sync.py

@@ -1,6 +1,8 @@
+#!/usr/bin/env python
+
 import ruamel.yaml
 from ruamel.yaml.scalarstring import FoldedScalarString
-import os
+import pathlib
 import textwrap
 
 # The default set of CodeQL Bundle versions to use for the PR checks.
@@ -47,9 +49,11 @@ def writeHeader(checkStream):
 yaml = ruamel.yaml.YAML()
 yaml.Representer = NonAliasingRTRepresenter
 
+this_dir = pathlib.Path(__file__).resolve().parent
+
 allJobs = {}
-for file in os.listdir('checks'):
-    with open(f"checks/{file}", 'r') as checkStream:
+for file in (this_dir / 'checks').glob('*.yml'):
+    with open(file, 'r') as checkStream:
         checkSpecification = yaml.load(checkStream)
 
     matrix = []
@@ -126,9 +130,9 @@ for file in os.listdir('checks'):
     checkJob['env'] = checkJob.get('env', {})
     if 'CODEQL_ACTION_TEST_MODE' not in checkJob['env']:
         checkJob['env']['CODEQL_ACTION_TEST_MODE'] = True
-    checkName = file[:len(file) - 4]
+    checkName = file.stem
 
-    with open(f"../.github/workflows/__{checkName}.yml", 'w') as output_stream:
+    with open(this_dir.parent / ".github" / "workflows" / f"__{checkName}.yml", 'w') as output_stream:
         writeHeader(output_stream)
         yaml.dump({
             'name': f"PR Check - {checkSpecification['name']}",

src/analyze.ts

@@ -7,7 +7,11 @@ import del from "del";
 import * as yaml from "js-yaml";
 
 import * as analysisPaths from "./analysis-paths";
-import { CodeQL, getCodeQL } from "./codeql";
+import {
+  CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
+  CodeQL,
+  getCodeQL,
+} from "./codeql";
 import * as configUtils from "./config-utils";
 import {
   FeatureEnablement,
@@ -389,7 +393,10 @@ export async function runQueries(
       }
 
       if (
-        !(await features.getValue(Feature.AnalysisSummaryV2Enabled, codeql))
+        !(await util.codeQlVersionAbove(
+          codeql,
+          CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
+        ))
       ) {
         await runPrintLinesOfCode(language);
       }

src/codeql.test.ts

@@ -1005,29 +1005,45 @@ test("databaseInterpretResults() does not set --sarif-add-baseline-file-info for
 
 const NEW_ANALYSIS_SUMMARY_TEST_CASES = [
   {
-    featureEnabled: true,
     codeqlVersion: "2.15.0",
+    githubVersion: {
+      type: util.GitHubVariant.DOTCOM,
+    },
     flagPassed: true,
     negativeFlagPassed: false,
   },
   {
-    featureEnabled: false,
     codeqlVersion: "2.15.0",
+    githubVersion: {
+      type: util.GitHubVariant.GHES,
+      version: "3.9.0",
+    },
+    flagPassed: true,
+    negativeFlagPassed: false,
+  },
+  {
+    codeqlVersion: "2.15.0",
+    githubVersion: {
+      type: util.GitHubVariant.GHES,
+      version: "3.8.6",
+    },
     flagPassed: false,
     negativeFlagPassed: true,
   },
   {
-    featureEnabled: false,
     codeqlVersion: "2.14.6",
+    githubVersion: {
+      type: util.GitHubVariant.DOTCOM,
+    },
     flagPassed: false,
     negativeFlagPassed: false,
   },
 ];
 
 for (const {
-  featureEnabled,
   codeqlVersion,
   flagPassed,
+  githubVersion,
   negativeFlagPassed,
 } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
   test(`database interpret-results passes ${
@@ -1036,9 +1052,9 @@ for (const {
       : negativeFlagPassed
       ? "--no-new-analysis-summary"
       : "nothing"
-  } for CodeQL CLI v${codeqlVersion} when the new analysis summary feature is ${
-    featureEnabled ? "enabled" : "disabled"
-  }`, async (t) => {
+  } for CodeQL CLI v${codeqlVersion} and ${
+    util.GitHubVariant[githubVersion.type]
+  } ${githubVersion.version ? ` ${githubVersion.version}` : ""}`, async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon
@@ -1054,8 +1070,8 @@ for (const {
       "",
       "-v",
       "",
-      stubConfig,
-      createFeatures(featureEnabled ? [Feature.AnalysisSummaryV2Enabled] : []),
+      Object.assign({}, stubConfig, { gitHubVersion: githubVersion }),
+      createFeatures([]),
       getRunnerLogger(true),
     );
     t.is(

src/codeql.ts

@@ -4,6 +4,7 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as yaml from "js-yaml";
+import * as semver from "semver";
 
 import {
   getActionVersion,
@@ -14,13 +15,11 @@ import * as api from "./api-client";
 import type { Config } from "./config-utils";
 import { EnvVar } from "./environment";
 import {
-  CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
-  CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
+  CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
   CodeQLDefaultVersionInfo,
   Feature,
   FeatureEnablement,
   useCodeScanningConfigInCli,
-  CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
 } from "./feature-flags";
 import { isTracedLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -317,6 +316,12 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2023-09-12";
  * flag is older than the oldest supported version above, it may be removed.
  */
 
+/**
+ * Versions 2.11.3+ of the CodeQL CLI support exporting a failed SARIF file via
+ * `codeql database export-diagnostics` or `codeql diagnostics export`.
+ */
+export const CODEQL_VERSION_EXPORT_FAILED_SARIF = "2.11.3";
+
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 
 /**
@@ -362,6 +367,16 @@ export const CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = "2.14.2";
  */
 export const CODEQL_VERSION_LANGUAGE_ALIASING = "2.14.4";
 
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
+ */
+export const CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
+
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
+ */
+export const CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
+
 /**
  * Set up CodeQL CLI access.
  *
@@ -615,9 +630,7 @@ export async function getCodeQLForCmd(
         extraArgs.push("--calculate-language-specific-baseline");
       }
 
-      if (
-        await features.getValue(Feature.SublanguageFileCoverageEnabled, this)
-      ) {
+      if (await isSublanguageFileCoverageEnabled(config, this)) {
         extraArgs.push("--sublanguage-file-coverage");
       } else if (
         await util.codeQlVersionAbove(
@@ -845,7 +858,7 @@ export async function getCodeQLForCmd(
       }
       if (
         await features.getValue(
-          Feature.EvaluatorIntraLayerParallelismEnabled,
+          Feature.EvaluatorFineGrainedParallelismEnabled,
           this,
         )
       ) {
@@ -853,7 +866,7 @@ export async function getCodeQLForCmd(
       } else if (
         await util.codeQlVersionAbove(
           this,
-          CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
+          CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
         )
       ) {
         codeqlArgs.push("--no-intra-layer-parallelism");
@@ -908,9 +921,7 @@ export async function getCodeQLForCmd(
       ) {
         codeqlArgs.push("--sarif-add-baseline-file-info");
       }
-      if (
-        await features.getValue(Feature.SublanguageFileCoverageEnabled, this)
-      ) {
+      if (await isSublanguageFileCoverageEnabled(config, this)) {
         codeqlArgs.push("--sublanguage-file-coverage");
       } else if (
         await util.codeQlVersionAbove(
@@ -925,7 +936,16 @@ export async function getCodeQLForCmd(
       } else if (await util.codeQlVersionAbove(this, "2.12.4")) {
         codeqlArgs.push("--no-sarif-include-diagnostics");
       }
-      if (await features.getValue(Feature.AnalysisSummaryV2Enabled, this)) {
+      if (
+        // Analysis summary v2 links to the status page, so check the GHES version we're running on
+        // supports the status page.
+        (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
+          semver.gte(config.gitHubVersion.version, "3.9.0")) &&
+        (await util.codeQlVersionAbove(
+          this,
+          CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
+        ))
+      ) {
         codeqlArgs.push("--new-analysis-summary");
       } else if (
         await util.codeQlVersionAbove(this, CODEQL_VERSION_ANALYSIS_SUMMARY_V2)
@@ -1495,3 +1515,18 @@ async function getLanguageAliasingArguments(codeql: CodeQL): Promise<string[]> {
   }
   return [];
 }
+
+async function isSublanguageFileCoverageEnabled(
+  config: Config,
+  codeql: CodeQL,
+) {
+  return (
+    // Sub-language file coverage is first supported in GHES 3.12.
+    (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
+      semver.gte(config.gitHubVersion.version, "3.12.0")) &&
+    (await util.codeQlVersionAbove(
+      codeql,
+      CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
+    ))
+  );
+}

src/feature-flags.ts

@@ -19,20 +19,10 @@ const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
 export const CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = "2.13.4";
 
 /**
- * Versions 2.14.0+ of the CodeQL CLI support intra-layer parallelism (aka fine-grained parallelism) options, but we
- * limit to 2.14.6 onwards, since that's the version that has mitigations against OOM failures.
+ * Evaluator fine-grained parallelism (aka intra-layer parallelism) is only safe to enable in 2.15.1 onwards.
+ * (Some earlier versions recognize the command-line flag, but they contain a bug which makes it unsafe to use).
  */
-export const CODEQL_VERSION_INTRA_LAYER_PARALLELISM = "2.14.6";
-
-/**
- * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
- */
-export const CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
-
-/**
- * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
- */
-export const CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
+export const CODEQL_VERSION_FINE_GRAINED_PARALLELISM = "2.15.1";
 
 export interface CodeQLDefaultVersionInfo {
   cliVersion: string;
@@ -54,28 +44,20 @@ export interface FeatureEnablement {
  * Each value of this enum should end with `_enabled`.
  */
 export enum Feature {
-  AnalysisSummaryV2Enabled = "analysis_summary_v2_enabled",
   CliConfigFileEnabled = "cli_config_file_enabled",
   CodeqlJavaLombokEnabled = "codeql_java_lombok_enabled",
   CppDependencyInstallation = "cpp_dependency_installation_enabled",
   DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
   DisablePythonDependencyInstallationEnabled = "disable_python_dependency_installation_enabled",
-  EvaluatorIntraLayerParallelismEnabled = "evaluator_intra_layer_parallelism_enabled",
+  EvaluatorFineGrainedParallelismEnabled = "evaluator_fine_grained_parallelism_enabled",
   ExportDiagnosticsEnabled = "export_diagnostics_enabled",
   QaTelemetryEnabled = "qa_telemetry_enabled",
-  SublanguageFileCoverageEnabled = "sublanguage_file_coverage_enabled",
-  UploadFailedSarifEnabled = "upload_failed_sarif_enabled",
 }
 
 export const featureConfig: Record<
   Feature,
   { envVar: string; minimumVersion: string | undefined; defaultValue: boolean }
 > = {
-  [Feature.AnalysisSummaryV2Enabled]: {
-    envVar: "CODEQL_ACTION_ANALYSIS_SUMMARY_V2",
-    minimumVersion: CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
-    defaultValue: false,
-  },
   [Feature.CodeqlJavaLombokEnabled]: {
     envVar: "CODEQL_JAVA_LOMBOK",
     minimumVersion: "2.14.0",
@@ -96,9 +78,9 @@ export const featureConfig: Record<
     minimumVersion: "2.11.6",
     defaultValue: true,
   },
-  [Feature.EvaluatorIntraLayerParallelismEnabled]: {
-    envVar: "CODEQL_EVALUATOR_INTRA_LAYER_PARALLELISM",
-    minimumVersion: CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
+  [Feature.EvaluatorFineGrainedParallelismEnabled]: {
+    envVar: "CODEQL_EVALUATOR_FINE_GRAINED_PARALLELISM",
+    minimumVersion: CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
     defaultValue: false,
   },
   [Feature.ExportDiagnosticsEnabled]: {
@@ -111,16 +93,6 @@ export const featureConfig: Record<
     minimumVersion: undefined,
     defaultValue: false,
   },
-  [Feature.SublanguageFileCoverageEnabled]: {
-    envVar: "CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE",
-    minimumVersion: CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
-    defaultValue: false,
-  },
-  [Feature.UploadFailedSarifEnabled]: {
-    envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
-    minimumVersion: "2.11.3",
-    defaultValue: true,
-  },
   [Feature.DisablePythonDependencyInstallationEnabled]: {
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION",
     // Although the python extractor only started supporting not extracting installed

src/init-action-post-helper.test.ts

@@ -8,7 +8,7 @@ import { Feature } from "./feature-flags";
 import * as initActionPostHelper from "./init-action-post-helper";
 import { getRunnerLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
-import { createFeatures, setupTests } from "./testing-utils";
+import { createFeatures, makeVersionInfo, setupTests } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
 import * as util from "./util";
 import * as workflow from "./workflow";
@@ -362,6 +362,7 @@ async function testFailedSarifUpload(
 
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
+  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.12.0"));
   const databaseExportDiagnosticsStub = sinon.stub(
     codeqlObject,
     "databaseExportDiagnostics",
@@ -377,7 +378,7 @@ async function testFailedSarifUpload(
   } as uploadLib.UploadResult);
   const waitForProcessing = sinon.stub(uploadLib, "waitForProcessing");
 
-  const features = [Feature.UploadFailedSarifEnabled];
+  const features = [] as Feature[];
   if (exportDiagnosticsEnabled) {
     features.push(Feature.ExportDiagnosticsEnabled);
   }

src/init-action-post-helper.ts

@@ -1,7 +1,7 @@
 import * as core from "@actions/core";
 
 import * as actionsUtil from "./actions-util";
-import { getCodeQL } from "./codeql";
+import { CODEQL_VERSION_EXPORT_FAILED_SARIF, getCodeQL } from "./codeql";
 import { Config, getConfig } from "./config-utils";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
@@ -9,6 +9,7 @@ import { Logger } from "./logging";
 import { RepositoryNwo } from "./repository";
 import * as uploadLib from "./upload-lib";
 import {
+  codeQlVersionAbove,
   getRequiredEnvParam,
   isInTestMode,
   parseMatrixInput,
@@ -54,8 +55,8 @@ async function maybeUploadFailedSarif(
     return { upload_failed_run_skipped_because: "CodeQL command not found" };
   }
   const codeql = await getCodeQL(config.codeQLCmd);
-  if (!(await features.getValue(Feature.UploadFailedSarifEnabled, codeql))) {
-    return { upload_failed_run_skipped_because: "Feature disabled" };
+  if (!(await codeQlVersionAbove(codeql, CODEQL_VERSION_EXPORT_FAILED_SARIF))) {
+    return { upload_failed_run_skipped_because: "Unsupported by CodeQL CLI" };
   }
   const workflow = await getWorkflow(logger);
   const jobName = getRequiredEnvParam("GITHUB_JOB");

src/init-action.ts

@@ -255,7 +255,11 @@ async function run() {
     toolsVersion = initCodeQLResult.toolsVersion;
     toolsSource = initCodeQLResult.toolsSource;
 
-    await validateWorkflow(codeql, logger);
+    core.startGroup("Validating workflow");
+    if ((await validateWorkflow(codeql, logger)) === undefined) {
+      logger.info("Detected no issues with the code scanning workflow.");
+    }
+    core.endGroup();
 
     config = await initConfig(
       getOptionalInput("languages"),