GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fix additive packs for the selected language by theinfosecguy · Pull Request #4314 · github/codeql-action

Conversation

@theinfosecguy

@theinfosecguy theinfosecguy commented Nov 11, 2026

Copy link
Copy Markdown

Merge +packs into the job’s selected language instead of the first key in a shared config. This prevents added queries from being silently skipped. Includes regression tests.

Verified with 1,232 tests and CodeQL 2.20.7/2.27.4 runs. The bundled command-injection repro on 2.27.4 reports 0 findings before the fix and 1 afterward.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@theinfosecguy
Fix +packs language selection
bc1ea4d
@theinfosecguy
theinfosecguy requested a review from a team as a code owner November 11, 2026 11:40
Copilot AI auto review requested due to automatic review settings November 11, 2026 11:40
Copilot started reviewing on behalf of theinfosecguy November 11, 2026 11:41
View session
Copilot AI reviewed Nov 11, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are recorded for the fix that applies additive query packs to the job’s selected language.

No open issues 🎉

What changed in this PR

Fixes CodeQL Action’s additive packs handling so extra query packs apply to the job’s selected language, rather than the first language in a shared configuration.

Changes:

  • Passes selected languages into configuration generation and handles missing language entries.
  • Adds regression coverage for shared configurations, key ordering, and array-form packs.
  • Updates the generated bundle and adds a release note.
File Description
unreleased-change-notes/​fix-pack-language-merge.md Documents the additive packs fix.
tests/​multi-language-repo/​.github/​codeql/​codeql-config-packaging3.yml Adds Ruby packs before JavaScript to exercise language selection.
src/​config/​db-config.ts Merges additive packs into the selected language’s entry.
src/​config-utils.ts Passes selected languages to configuration generation.
src/​config-utils.test.ts Tests shared-config merging through initialization.
src/​codeql.test.ts Covers key ordering, missing or empty entries, and array-form packs.
lib/​entry-points.js Updates the generated JavaScript bundle.

Review effort: Balanced (auto)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@theinfosecguy
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.