Merge analyze-javascript and analyze-other into one matrixed job

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/codeql/codeql-config-actions.yml

@@ -0,0 +1,5 @@
+paths-ignore:
+  - lib
+  - tests
+queries:
+  - uses: security-and-quality

.github/workflows/__runner-images.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: PR Check - Linux Arm64
+name: PR Check - Runner images
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -47,16 +47,38 @@ defaults:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: runner-images-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
-  linux-arm64:
+  runner-images:
     strategy:
       fail-fast: false
       matrix:
         include:
+          - os: ubuntu-22.04
+            version: linked
+          - os: ubuntu-22.04-arm
+            version: linked
+          - os: ubuntu-24.04
+            version: linked
           - os: ubuntu-24.04-arm
-            version: nightly-latest
-    name: Linux Arm64
+            version: linked
+          - os: ubuntu-26.04
+            version: linked
+          - os: ubuntu-26.04-arm
+            version: linked
+          - os: windows-2022
+            version: linked
+          - os: windows-2025
+            version: linked
+          - os: macos-15-large
+            version: linked
+          - os: macos-15-xlarge
+            version: linked
+          - os: macos-26-large
+            version: linked
+          - os: macos-26-xlarge
+            version: linked
+    name: Runner images
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -102,5 +124,5 @@ jobs:
             echo "Found database for $lang"
           done
     env:
-      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
+      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/codeql.yml

@@ -19,70 +19,16 @@ env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
-  # Identify the CodeQL tool versions to use in the analysis job.
-  check-codeql-versions:
+  analyze:
     if: github.triggering_actor != 'dependabot[bot]'
     runs-on: ubuntu-26.04
-    outputs:
-      versions: ${{ steps.compare.outputs.versions }}
 
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up default CodeQL bundle
-        id: setup-default
-        uses: ./setup-codeql
-      - name: Set up linked CodeQL bundle
-        id: setup-linked
-        uses: ./setup-codeql
-        with:
-          tools: linked
-      - name: Compare default and linked CodeQL bundle versions
-        id: compare
-        env:
-          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-        run: |
-          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
-
-          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-          # required status check.
-          #
-          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-          # the same as running with `tools: null`.
-          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-            VERSIONS_JSON='[null]'
-          else
-            VERSIONS_JSON='[null, "linked"]'
-          fi
-
-          # Output a JSON-encoded list with the distinct versions to test against.
-          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
-
-  analyze-javascript:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: [check-codeql-versions]
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-22.04
-          - ubuntu-24.04
-          - windows-2022
-          - windows-2025
-          - macos-14-xlarge
-          - macos-15-xlarge
-        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
-    runs-on: ${{ matrix.os }}
+        language:
+          - actions
+          - javascript
 
     permissions:
       contents: read
@@ -95,49 +41,15 @@ jobs:
         uses: ./init
         id: init
         with:
-          languages: javascript
-          config-file: ./.github/codeql/codeql-config-javascript.yml
-          tools: ${{ matrix.tools }}
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
       # confirm steps.init.outputs.codeql-path points to the codeql binary
       - name: Print CodeQL Version
         run: >
           "$CODEQL" version --format=json
         env:
           CODEQL: ${{steps.init.outputs.codeql-path}}
-      - name: Perform CodeQL Analysis
-        uses: ./analyze
-        with:
-          category: "/language:javascript"
-          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
-
-  analyze-other:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-26.04
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: ./init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config: >
-            paths-ignore:
-              - lib
-              - tests
-            queries:
-              - uses: security-and-quality
       - name: Perform CodeQL Analysis
         uses: ./analyze
         with:

.github/workflows/deflake.yml

@@ -61,6 +61,7 @@ on:
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
       - "PR Check - Ruby analysis"
+      - "PR Check - Runner images"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"
       - "PR Check - Start proxy"

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## [UNRELEASED]
+
+No user facing changes.
+
 ## 4.39.3 - 04 Nov 2026
 
 - Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)

lib/entry-points.js

@@ -178724,7 +178724,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) {
   return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.39.3";
+  return "4.39.4";
 }
 function getWorkflowEventName(env = getEnv()) {
   return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
@@ -184864,13 +184864,16 @@ async function deleteToolcacheBundles({
       }
       const versionDirectory = path12.join(toolDirectory, entry.name);
       try {
+        const deletionStart = import_perf_hooks3.performance.now();
         await fs15.promises.rm(versionDirectory, {
           force: true,
           recursive: true
         });
         deletedVersions.push(entry.name);
         logger2.info(
-          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space.`
+          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space (${formatDuration(
+            durationMsSince(deletionStart)
+          )}).`
         );
       } catch (e) {
         failed = true;
@@ -185369,13 +185372,14 @@ async function tryDeleteToolcacheBundles({
   if (!isGitHubHostedRunner(env) || !isToolcacheOnWorkspaceFilesystem(logger2)) {
     return;
   }
+  const startTime = import_perf_hooks4.performance.now();
   const result = await deleteToolcacheBundles({ env, logger: logger2 });
   addNoLanguageDiagnostic(
     void 0,
     makeTelemetryDiagnostic(
       "codeql-action/toolcache-bundle-cleanup",
       "Toolcache CodeQL bundle cleanup",
-      { ...result }
+      { ...result, durationMs: durationMsSince(startTime) }
     )
   );
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.3",
+      "version": "4.39.4",
       "license": "MIT",
       "workspaces": [
         "pr-checks"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.4",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

pr-checks/checks/linux-arm64.yml

@@ -1,35 +0,0 @@
-name: "Linux Arm64"
-description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
-operatingSystems:
-  - os: ubuntu
-    runner-image: ubuntu-24.04-arm
-# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
-# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
-# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
-versions:
-  - nightly-latest
-installGo: true
-installDotNet: true
-# The set of languages CodeQL supports on this platform, excluding Swift (macOS only).
-env:
-  LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
-steps:
-  - uses: ./../action/init
-    with:
-      languages: ${{ env.LANGUAGES }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Build code
-    run: ./build.sh
-  - uses: ./../action/analyze
-    with:
-      upload-database: false
-  - name: Assert databases exist
-    run: |
-      cd "$RUNNER_TEMP/codeql_databases"
-      for lang in ${LANGUAGES//,/ }; do
-        if [[ ! -d "$lang" ]]; then
-          echo "Did not find a database for $lang"
-          exit 1
-        fi
-        echo "Found database for $lang"
-      done

pr-checks/checks/runner-images.yml

@@ -0,0 +1,66 @@
+name: "Runner images"
+description: "An end-to-end integration test checking that CodeQL can analyze interpreted and compiled code on the GitHub-hosted runner images"
+# This check runs on each image listed in
+# https://github.com/actions/runner-images#available-images, except for:
+# - `ubuntu-slim`, which is intended for lightweight jobs rather than builds like this one.
+# - `windows-11-arm`, since CodeQL doesn't support Windows on Arm64.
+# - `xcode-27`, a preview image that the `unsupported-macos` check runs on.
+operatingSystems:
+  # The Ubuntu 22.04 images have brownouts from 23 March 2027 and are retired on 17 April 2027, so
+  # remove them before the brownouts start.
+  # See https://github.com/actions/runner-images/issues/14254.
+  - os: ubuntu
+    runner-image: ubuntu-22.04
+  - os: ubuntu
+    runner-image: ubuntu-22.04-arm
+  - os: ubuntu
+    runner-image: ubuntu-24.04
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+  - os: ubuntu
+    runner-image: ubuntu-26.04
+  - os: ubuntu
+    runner-image: ubuntu-26.04-arm
+  - os: windows
+    runner-image: windows-2022
+  - os: windows
+    runner-image: windows-2025
+  # Use larger runners for macOS to keep these jobs off the critical path.
+  - os: macos
+    runner-image: macos-15-large
+  - os: macos
+    runner-image: macos-15-xlarge
+  - os: macos
+    runner-image: macos-26-large
+  - os: macos
+    runner-image: macos-26-xlarge
+# Other PR checks cover the supported CodeQL versions, so this check only tests the linked version.
+# Linux Arm64 bundles are only available for CodeQL 2.27.0 and later, so older stable versions
+# can't run on the Arm64 images.
+versions:
+  - linked
+installGo: true
+installDotNet: true
+# The languages to build and analyze. CodeQL only supports Swift on macOS.
+env:
+  LANGUAGES: "cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}"
+steps:
+  - uses: ./../action/init
+    with:
+      languages: ${{ env.LANGUAGES }}
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in ${LANGUAGES//,/ }; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+        echo "Found database for $lang"
+      done

pr-checks/excluded.yml

@@ -24,3 +24,5 @@ is:
   # PRs), so requiring them would block the PRs they don't run on.
   - "github-advanced-security"
   - "License compliance check"
+  # Only runs when a PR is removed from the merge queue.
+  - "Notify"

src/feature-flags.ts

@@ -6,6 +6,7 @@ import * as semver from "semver";
 import { getApiClient } from "./api-client";
 import type { CodeQL } from "./codeql";
 import * as defaults from "./defaults.json";
+import { Feature } from "./feature-flags/features";
 import { Logger } from "./logging";
 import {
   CODEQL_OVERLAY_MINIMUM_VERSION,
@@ -21,6 +22,8 @@ import { RepositoryNwo } from "./repository";
 import { ToolsFeature } from "./tools-features";
 import * as util from "./util";
 
+export { Feature } from "./feature-flags/features";
+
 const DEFAULT_VERSION_FEATURE_FLAG_PREFIX = "default_codeql_version_";
 const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
 
@@ -61,107 +64,6 @@ export interface CodeQLDefaultVersionInfo {
   toolsFeatureFlagsValid?: boolean;
 }
 
-/**
- * Features as named by the GitHub API endpoint.
- *
- * Do not include the `codeql_action_` prefix as this is stripped by the API
- * endpoint.
- *
- * Legacy features should end with `_enabled`.
- */
-export enum Feature {
-  /** Allows supported properties of configuration files to be merged. */
-  AllowMergeConfigFiles = "allow_merge_config_files",
-  /** Controls whether we allow multiple values for the `analysis-kinds` input. */
-  AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
-  /**
-   * Whether to check for unsupported traced analysis. Primarily intended as an override to disable
-   * the check if it causes problems somehow.
-   */
-  CheckUnsupportedTracedAnalysis = "check_unsupported_traced_analysis",
-  /** Whether to allow the `config-file` input to be specified via a repository property. */
-  ConfigFileRepositoryProperty = "config_file_repository_property",
-  CppDependencyInstallation = "cpp_dependency_installation_enabled",
-  CsharpCacheBuildModeNone = "csharp_cache_bmn",
-  CsharpNewCacheKey = "csharp_new_cache_key",
-  DiffInformedQueries = "diff_informed_queries",
-  DisableCsharpBuildless = "disable_csharp_buildless",
-  DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
-  DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
-  ExportDiagnosticsEnabled = "export_diagnostics_enabled",
-  /**
-   * Emergency override that forces the CodeQL CLI to use the JGit-based Git backend instead of its
-   * default backend selection.
-   */
-  ForceJGit = "force_jgit",
-  ForceNightly = "force_nightly",
-  IgnoreGeneratedFiles = "ignore_generated_files",
-  JavaNetworkDebugging = "java_network_debugging",
-  OverlayAnalysis = "overlay_analysis",
-  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
-  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
-  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
-  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
-  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
-  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
-  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
-  OverlayAnalysisCpp = "overlay_analysis_cpp",
-  OverlayAnalysisCsharp = "overlay_analysis_csharp",
-  OverlayAnalysisGo = "overlay_analysis_go",
-  OverlayAnalysisJava = "overlay_analysis_java",
-  OverlayAnalysisJavascript = "overlay_analysis_javascript",
-  /**
-   * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb",
-  OverlayAnalysisPython = "overlay_analysis_python",
-  OverlayAnalysisRuby = "overlay_analysis_ruby",
-  /** Controls whether hardware checks are skipped for overlay analysis. */
-  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
-  /** Controls whether the Actions cache is checked for overlay build outcomes. */
-  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
-  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
-  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
-  QaTelemetryEnabled = "qa_telemetry_enabled",
-  /** Whether we should fail early if we detect that traced analysis is unsupported. */
-  AbortUnsupportedTracedAnalysis = "abort_unsupported_traced_analysis",
-  /** Routes (some) API requests through the registry proxy. */
-  ProxyApiRequests = "proxy_api_requests",
-  /** Note that this currently only disables baseline file coverage information. */
-  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
-  StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
-  /** Whether to allow the `tools` input to be specified via a repository property. */
-  ToolsRepositoryProperty = "tools_repository_property",
-  UploadOverlayDbToApi = "upload_overlay_db_to_api",
-  ValidateDbConfig = "validate_db_config",
-}
-
 export type FeatureConfig = {
   /**
    * Default value in environments where the feature flags API is not available,

src/feature-flags/features.ts

@@ -0,0 +1,100 @@
+/**
+ * Features as named by the GitHub API endpoint.
+ *
+ * Do not include the `codeql_action_` prefix as this is stripped by the API
+ * endpoint.
+ *
+ * Legacy features should end with `_enabled`.
+ */
+export enum Feature {
+  /** Allows supported properties of configuration files to be merged. */
+  AllowMergeConfigFiles = "allow_merge_config_files",
+  /** Controls whether we allow multiple values for the `analysis-kinds` input. */
+  AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
+  /**
+   * Whether to check for unsupported traced analysis. Primarily intended as an override to disable
+   * the check if it causes problems somehow.
+   */
+  CheckUnsupportedTracedAnalysis = "check_unsupported_traced_analysis",
+  /** Whether to allow the `config-file` input to be specified via a repository property. */
+  ConfigFileRepositoryProperty = "config_file_repository_property",
+  CppDependencyInstallation = "cpp_dependency_installation_enabled",
+  CsharpCacheBuildModeNone = "csharp_cache_bmn",
+  CsharpNewCacheKey = "csharp_new_cache_key",
+  DiffInformedQueries = "diff_informed_queries",
+  DisableCsharpBuildless = "disable_csharp_buildless",
+  DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
+  DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
+  ExportDiagnosticsEnabled = "export_diagnostics_enabled",
+  /**
+   * Emergency override that forces the CodeQL CLI to use the JGit-based Git backend instead of its
+   * default backend selection.
+   */
+  ForceJGit = "force_jgit",
+  ForceNightly = "force_nightly",
+  IgnoreGeneratedFiles = "ignore_generated_files",
+  JavaNetworkDebugging = "java_network_debugging",
+  OverlayAnalysis = "overlay_analysis",
+  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
+  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
+  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
+  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
+  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
+  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
+  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
+  OverlayAnalysisCpp = "overlay_analysis_cpp",
+  OverlayAnalysisCsharp = "overlay_analysis_csharp",
+  OverlayAnalysisGo = "overlay_analysis_go",
+  OverlayAnalysisJava = "overlay_analysis_java",
+  OverlayAnalysisJavascript = "overlay_analysis_javascript",
+  /**
+   * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb",
+  OverlayAnalysisPython = "overlay_analysis_python",
+  OverlayAnalysisRuby = "overlay_analysis_ruby",
+  /** Controls whether hardware checks are skipped for overlay analysis. */
+  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
+  /** Controls whether the Actions cache is checked for overlay build outcomes. */
+  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
+  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
+  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
+  QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Whether we should fail early if we detect that traced analysis is unsupported. */
+  AbortUnsupportedTracedAnalysis = "abort_unsupported_traced_analysis",
+  /** Routes (some) API requests through the registry proxy. */
+  ProxyApiRequests = "proxy_api_requests",
+  /** Note that this currently only disables baseline file coverage information. */
+  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
+  StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
+  /** Whether to allow the `tools` input to be specified via a repository property. */
+  ToolsRepositoryProperty = "tools_repository_property",
+  UploadOverlayDbToApi = "upload_overlay_db_to_api",
+  ValidateDbConfig = "validate_db_config",
+}

src/setup-codeql.test.ts

@@ -1821,7 +1821,8 @@ function createToolcacheEntry(
 /**
  * Stubs out the download and the diagnostic sink, then downloads the CodeQL tools.
  *
- * @returns the extraction directory and the toolcache cleanup diagnostic, if emitted.
+ * @returns the extraction directory and, if the toolcache cleanup diagnostic was emitted, the
+ * cleanup duration it reports and its other attributes.
  */
 async function runDownloadCodeQL(
   toolcacheRoot: string,
@@ -1837,6 +1838,7 @@ async function runDownloadCodeQL(
 ): Promise<{
   codeqlFolder: string;
   cleanupDiagnostic: toolsDownload.ToolcacheCleanupResult | undefined;
+  cleanupDurationMs: number | undefined;
 }> {
   stubDownloadAndExtract();
   const addDiagnostic = sinon.stub(diagnostics, "addNoLanguageDiagnostic");
@@ -1866,11 +1868,21 @@ async function runDownloadCodeQL(
     .map((call) => call.args[1])
     .find((d) => d.source?.id === "codeql-action/toolcache-bundle-cleanup");
 
-  return {
-    codeqlFolder,
-    cleanupDiagnostic: diagnostic?.attributes as
-      toolsDownload.ToolcacheCleanupResult | undefined,
-  };
+  if (diagnostic === undefined) {
+    return {
+      codeqlFolder,
+      cleanupDiagnostic: undefined,
+      cleanupDurationMs: undefined,
+    };
+  }
+
+  // The duration varies between runs, so split it out to let tests compare the other attributes
+  // exactly.
+  const { durationMs, ...cleanupDiagnostic } =
+    diagnostic.attributes as toolsDownload.ToolcacheCleanupResult & {
+      durationMs: number;
+    };
+  return { codeqlFolder, cleanupDiagnostic, cleanupDurationMs: durationMs };
 }
 
 /**
@@ -1991,6 +2003,35 @@ test.serial(
   },
 );
 
+test.serial(
+  "downloadCodeQLBundle reports the total time taken to clean up the toolcache",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+
+      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_CLI_VERSION);
+      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_STALE_VERSION);
+
+      // Advance the clock by 1.5s each time a path is deleted, so that deleting both versions
+      // takes 3s.
+      let elapsedMs = 1000;
+      sinon.stub(performance, "now").callsFake(() => elapsedMs);
+      const rm = fs.promises.rm;
+      sinon.stub(fs.promises, "rm").callsFake(async (...args) => {
+        elapsedMs += 1500;
+        await rm(...args);
+      });
+
+      const { cleanupDurationMs } = await runDownloadCodeQL(
+        tmpDir,
+        CLEANUP_BUNDLE_VERSION,
+      );
+
+      t.is(cleanupDurationMs, 3000);
+    });
+  },
+);
+
 test.serial(
   "downloadCodeQLBundle reports no deleted versions when the toolcache has no CodeQL bundles",
   async (t) => {

src/setup-codeql.ts

@@ -814,6 +814,7 @@ async function tryDeleteToolcacheBundles({
     return;
   }
 
+  const startTime = performance.now();
   const result = await deleteToolcacheBundles({ env, logger });
 
   addNoLanguageDiagnostic(
@@ -821,7 +822,7 @@ async function tryDeleteToolcacheBundles({
     makeTelemetryDiagnostic(
       "codeql-action/toolcache-bundle-cleanup",
       "Toolcache CodeQL bundle cleanup",
-      { ...result },
+      { ...result, durationMs: util.durationMsSince(startTime) },
     ),
   );
 }

src/tools-download.ts

@@ -342,13 +342,16 @@ export async function deleteToolcacheBundles({
       const versionDirectory = path.join(toolDirectory, entry.name);
 
       try {
+        const deletionStart = performance.now();
         await fs.promises.rm(versionDirectory, {
           force: true,
           recursive: true,
         });
         deletedVersions.push(entry.name);
         logger.info(
-          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space.`,
+          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space (${formatDuration(
+            durationMsSince(deletionStart),
+          )}).`,
         );
       } catch (e) {
         failed = true;