GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Use per-language CodeQL bundles by default by henrymercer · Pull Request #4244 · github/codeql-action

Conversation

henrymercer commented Oct 16, 2026

Copy link

Copy Markdown

Contributor

Per-language CodeQL bundles are already supported and have been rolled out behind per_language_bundles_v2. This change removes that rollout feature and makes automatic selection the default for eligible single-language analyses on GitHub-hosted runners on GitHub.com.

The baseline-information check uses a no-op custom configuration to continue validating the combined bundle.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

henrymercer and others added 3 commits

October 16, 2026 13:59


          Prepare per-language bundle graduation checks

64e5c62

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d9f196d4-6d15-44ca-bd01-cd022d57d2cc


          Use per-language bundles by default

9bf78d1

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d9f196d4-6d15-44ca-bd01-cd022d57d2cc


          Remove per-language bundle rollout flag

2d68850

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d9f196d4-6d15-44ca-bd01-cd022d57d2cc

Copilot AI max review requested due to automatic review settings

October 16, 2026 13:04

github-actions Bot added the size/M Should be of average difficulty to review label

Oct 16, 2026

Copilot started reviewing on behalf of henrymercer

October 16, 2026 13:05

View session

Copilot AI reviewed

Oct 16, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

🔵 Needs a closer look

The broader default rollout removes the feature-flag override, leaving release-based rollback and warranting human sign-off.

1 open finding

Add change note for default per-language bundle selection · New

What changed in this PR

Makes per-language CodeQL bundles the default for eligible single-language analyses on GitHub-hosted runners on GitHub.com.

Changes:

Removes the rollout flag and makes bundle selection synchronous.
Updates tests for the new default and retained eligibility safeguards.
Updates validation checks while preserving combined-bundle baseline coverage.

File	Description
src/setup-codeql.ts	Uses synchronous bundle selection.
src/setup-codeql.test.ts	Updates default-selection and fallback tests.
src/per-language-bundles.ts	Removes feature-flag gating.
src/per-language-bundles.test.ts	Removes flag-dependent eligibility tests.
src/feature-flags.ts	Removes the rollout flag and environment override.
pr-checks/checks/per-language-bundle-validation.yml	Validates linked bundles after clearing the toolcache.
pr-checks/checks/export-file-baseline-information.yml	Uses custom configuration to select the combined bundle.

Files excluded by content exclusion policy (3)

.github/workflows/__export-file-baseline-information.yml
.github/workflows/__per-language-bundle-validation.yml
lib/entry-points.js

🧠 Review effort: Max

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/per-language-bundles.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

henrymercer marked this pull request as ready for review

October 16, 2026 14:09

henrymercer requested a review from a team as a code owner

October 16, 2026 14:09

mbg mentioned this pull request

Oct 16, 2026

Add Copilot instructions for FFs, and update documentation more generally #4247

Merged

mbg previously approved these changes

Oct 16, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a few minor points, otherwise this looks good I think.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

pr-checks/checks/per-language-bundle-validation.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/per-language-bundles.ts Outdated

		logger,
		}: ActionState<["Logger", "ReadOnlyEnv", "FeatureFlags"]>,
		export function getPerLanguageBundleLanguage(
		{ env, logger }: ActionState<["Logger", "ReadOnlyEnv"]>,

mbg Oct 16, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: To avoid diff noise when the required state features of a function change (since I have seen that in a few recent PRs), here's what I generally do / how I intended this to be used:

Prefer using a single parameter for the ActionState (e.g. action: ActionState<...>) rather than deconstructing it with an object pattern.
When refactoring an existing function to use ActionState rather than discrete parameters and updating the entire body to use e.g. action.logger. instead of logger. would be a lot of noise, then add const logger = action.logger; etc. early on in the function body.
When passing ActionState to another function, use the single action object, rather than constructing an ActionState value with only the required features.
If the initial action object in a function (the caller) isn't sufficient and it needs to be augmented with another feature before calling a function (the callee), widen the set of features required by the caller if possible. If that requires too much refactoring up the call hierarchy and the extra state is available locally, then prefer naming the resulting ActionState object with e.g. const actionWithFeatures = extendActionState(action, { features }); and then passing actionWithFeatures to the function.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

henrymercer reacted with thumbs up emoji

All reactions

👍 1 reaction

Comment thread

pr-checks/checks/export-file-baseline-information.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

henrymercer and others added 4 commits

October 22, 2026 11:43


          Merge remote-tracking branch 'origin/main' into henrymercer/graduate-…

922e2ff

…per-language-bundles

Co-authored-by: Copilot App <[email protected]>


          Use toolcache.ts in per-language-bundle-validation.yml

626d8b9

Co-authored-by: Copilot App <[email protected]>


          Take a single ActionState parameter in getPerLanguageBundleLanguage

0171a2b

Co-authored-by: Copilot App <[email protected]>


          Clarify why the file baseline check uses a custom configuration

f033e23

Co-authored-by: Copilot App <[email protected]>

henrymercer dismissed mbg’s stale review via

f033e23

October 22, 2026 11:25

henrymercer requested a review from mbg

October 22, 2026 12:48

mbg approved these changes

Oct 22, 2026

View reviewed changes

henrymercer added this pull request to the merge queue

Oct 22, 2026

Merged via the queue into main with commit c2293b3

Oct 22, 2026

226 checks passed

Uh oh!

There was an error while loading. Please reload this page.

henrymercer deleted the henrymercer/graduate-per-language-bundles branch

October 22, 2026 14:22

This was referenced Nov 3, 2026

Merge main into releases/v4 #4286

Merged

Merge releases/v4 into releases/v3 #4291

Merged

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

mbg

mbg approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

size/M

Should be of average difficulty to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.