GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Separate CodeQL bundle resolution from installation by henrymercer · Pull Request #4145 · github/codeql-action

Conversation

henrymercer commented Sep 15, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Pass a resolved bundle source to the downloader instead of separate URL, compression, and version arguments. Keep version reporting in setup and move toolcache cleanup into download orchestration. Bundle selection, cache keys, and local installation behavior are unchanged.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Narrow refactor with no intended behavior changes. Unit tests cover bundle resolution, installation, and toolcache cleanup.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).

All 101 tests in the combined setup-codeql, codeql, and tools-download suites passed. TypeScript compilation, runtime generation, and scoped lint also passed.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Separate CodeQL bundle resolution from installation

1970c45

Co-authored-by: Copilot App <[email protected]>

henrymercer requested a balanced review from Copilot

September 15, 2026 14:26

github-actions Bot added the size/L May be hard to review label

Sep 15, 2026

Copilot started reviewing on behalf of henrymercer

September 15, 2026 14:27

View session

Copilot AI reviewed

Sep 15, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Copilot review overview

🟢 Approval recommended

The refactor preserves existing behavior and includes comprehensive focused tests.

Review tier: Balanced
Findings: None

What changed in this PR

Separates CodeQL bundle resolution from download and installation while preserving existing behavior.

Changes:

Introduces a resolved download-source model.
Moves toolcache cleanup into download orchestration.
Expands version, caching, cleanup, and failure tests.

File	Description
`src/setup-codeql.ts`	Refactors bundle resolution and download orchestration.
`src/setup-codeql.test.ts`	Adds focused orchestration and edge-case coverage.
`src/codeql.test.ts`	Tests version reporting and cache keys.
`lib/entry-points.js`	Excluded generated artifact; not reviewed.

Files excluded by content exclusion policy (1)

lib/entry-points.js

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

henrymercer mentioned this pull request

Sep 15, 2026

Use per-language CodeQL bundles #4146

Merged

henrymercer added this pull request to stack #4147

September 15, 2026 17:19

henrymercer marked this pull request as ready for review

September 15, 2026 18:57

henrymercer requested a review from a team as a code owner

September 15, 2026 18:57

mbg reviewed

Sep 16, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly minor comments on this, largely related to the documentation. At a high-level, I think this PR is a bit harder to review than it needs to be, because all of the changes are in one commit. There are several refactorings here that could have been split up or done in stages.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

henrymercer reacted with thumbs up emoji

All reactions

👍 1 reaction

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Clarify resolved bundle handling

f3e0c87

Co-authored-by: Copilot App <[email protected]>

mbg previously approved these changes

Sep 17, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for making those minor improvements and addressing all of my review comments! I spotted a couple of minor things in the changes in the last commit that could be improved further, but again nothing major or blocking.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/setup-codeql.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

henrymercer and others added 2 commits

September 17, 2026 14:34


          Isolate bundle cleanup test environments

06f4ce7

Co-authored-by: Copilot App <[email protected]>


          Use initAllState in bundle cleanup tests

41c04be

Co-authored-by: Copilot App <[email protected]>

henrymercer dismissed mbg’s stale review via

41c04be

September 17, 2026 13:53

github-actions Bot added size/XL May be very hard to review and removed size/L May be hard to review labels

Sep 17, 2026

mbg approved these changes

Sep 17, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/setup-codeql.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

henrymercer added this pull request to the merge queue

Sep 17, 2026

Merged via the queue into main with commit a0cc010

Sep 17, 2026

223 checks passed

Uh oh!

There was an error while loading. Please reload this page.

henrymercer deleted the henrymercer/bundle-resolution-pr branch

September 17, 2026 14:44

This was referenced Sep 18, 2026

Merge main into releases/v4 #4152

Merged

Merge releases/v4 into releases/v3 #4154

Merged

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

mbg

mbg approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

size/XL

May be very hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

henrymercer commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

henrymercer commented Sep 15, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.