GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Use per-language CodeQL bundles by henrymercer · Pull Request #4146 · github/codeql-action

Conversation

henrymercer commented Sep 15, 2026

Copy link

Copy Markdown

Contributor

Download self-contained per-language bundles for eligible analyses on GitHub.com. Selection requires one explicitly configured language, a GitHub-hosted runner, zstd, and a supported language/platform combination. Release bundles require CodeQL 2.27.1 or newer; nightlies use the same eligibility rules without the release-version check. The per_language_bundles feature flag remains off by default.

Extract per-language bundles into the runner's temporary directory rather than the toolcache. If an automatically selected asset returns 404, fall back to the combined bundle from the same release. Explicit per-language tools URLs are not substituted.

Add bundle-language and fallback telemetry, plus generated nightly PR checks for all ten languages covering extractor contents, toolcache isolation, database creation and analysis. Update existing cache-dependent checks to request multiple languages so they continue to use the combined bundle.

Risk assessment

Low risk: Automatic per-language bundle selection is feature-flagged and off by default. The unflagged behavior is limited to rare, explicitly supplied per-language bundle URLs and prevents those partial installs from entering the toolcache.

Which use cases does this change impact?

Workflow types:

Advanced setup
Managed

Products:

Code Scanning
Code Quality
Other first-party - Analyses using the shared CodeQL setup path.

Environments:

Dotcom - Automatic per-language selection on GitHub.com; explicit bundle URL handling also applies to data-residency environments.
GHES - Explicit per-language bundle URL handling only. Automatic selection remains disabled.

How did/will you validate this change?

Unit tests - Eligibility, bundle selection, version reporting, fallback, and toolcache isolation.
End-to-end tests - Generated nightly PR checks cover all ten languages. These still need to run for this PR.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - Disable automatic selection with per_language_bundles.
Rollback - Release a fix or revert if explicit bundle URL handling regresses; that path is not controlled by the flag.

How will you know if something goes wrong after this change is released?

Telemetry - Monitor per-language downloads, observed combined-bundle fallbacks, download timings and initialization failures through the rollout dashboard.

Are there any special considerations for merging or releasing this change?

Special considerations - Merge the bundle-resolution prerequisite, #4145, first. Keep the feature flag disabled until the end-to-end checks pass, matching assets are available, and telemetry consumer support is deployed.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Use per-language CodeQL bundles

ec5eecb

Co-authored-by: Copilot App <[email protected]>

henrymercer requested a balanced review from Copilot

September 15, 2026 17:18

github-actions Bot added the size/XXL May be extremely hard to review label

Sep 15, 2026

Copilot started reviewing on behalf of henrymercer

September 15, 2026 17:19

View session

henrymercer added this pull request to stack #4147

September 15, 2026 17:19

Copilot AI reviewed

Sep 15, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Copilot review overview

🟡 Changes recommended

Fallback telemetry underreports total setup duration by excluding the failed per-language request.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 1

Open (1)

Include the failed attempt in total download duration · New

What changed in this PR

Adds feature-gated per-language CodeQL bundle selection, extraction, fallback, telemetry, and validation.

Changes:

Selects eligible release/nightly per-language bundles with 404 fallback.
Keeps partial bundles out of the toolcache and reports telemetry.
Adds unit and generated end-to-end validation across ten languages.

File	Description
`src/per-language-bundles.ts`	Implements bundle eligibility and URL recognition.
`src/per-language-bundles.test.ts`	Tests eligibility and recognition.
`src/setup-codeql.ts`	Resolves, downloads, caches, and falls back between bundles.
`src/setup-codeql.test.ts`	Tests selection, fallback, versions, and caching.
`src/tools-download.ts`	Extends download telemetry.
`src/status-report.ts`	Defines telemetry fields.
`src/init-action.ts`	Reports init telemetry.
`src/setup-codeql-action.ts`	Reports setup telemetry.
`src/feature-flags.ts`	Adds the disabled-by-default feature flag.
`pr-checks/sync.ts`	Supports custom generated matrices.
`pr-checks/checks/per-language-bundle-validation.yml`	Validates all supported language bundles.
`pr-checks/checks/bundle-toolcache.yml`	Preserves combined-bundle cache testing.
`.github/workflows/codescanning-config-cli.yml`	Ensures reusable combined-bundle caching.
`lib/entry-points.js`	Generated artifact; content excluded.
`.github/workflows/__bundle-toolcache.yml`	Generated workflow; content excluded.
`.github/workflows/__per-language-bundle-validation.yml`	Generated workflow; content excluded.

Files excluded by content exclusion policy (3)

.github/workflows/__bundle-toolcache.yml
.github/workflows/__per-language-bundle-validation.yml
lib/entry-points.js

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Include failed bundle attempts in fallback timing

eb76062

Co-authored-by: Copilot App <[email protected]>

henrymercer marked this pull request as ready for review

September 15, 2026 18:57

henrymercer requested a review from a team as a code owner

September 15, 2026 18:57

mbg reviewed

Sep 16, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have had a look through the changes here and added quite a few detailed comments. Additionally, some high-level ones:

Like with the other PR this is stacked on, this was a lot more difficult (and time-consuming) to review than it needed to be, because all of the changes were contained in one commit (except the follow-up to Copilot's review comment). There were clear opportunities for breaking the changes up and structuring them to be more incremental.
Quite a few of the function-level comments and test names make sense in the context of this PR where it's obvious that they relate to per-language vs combined bundles, but wouldn't make sense outside of this context. Some of my review comments highlight specific cases of this, but I didn't comment on all of them.
Try and remember to make use of the new ActionState infrastructure whenever possible in new or changed code. In particular, the getPerLanguageBundleLanguage function would benefit from this since the tests would not need to be serial.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/status-report.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/per-language-bundles.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/per-language-bundles.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/per-language-bundles.ts Outdated

Comment on lines +106 to +110

		if (!isGitHubHostedRunner()) {
		// Per-language installs stay out of the toolcache; self-hosted runners should retain
		// the reusable combined bundle instead.
		return explain("the job is not running on a GitHub-hosted runner");
		}

mbg Sep 16, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am wondering if this is the correct choice. Self-hosted runners could use custom images / persistent storage to pre-install the desired CLI bundle in the toolcache. If that's not available, wouldn't it be more desirable to download the language-specific bundle for improved performance like on GH-hosted runners?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

henrymercer Sep 16, 2026

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Self-hosted runner can indeed preinstall CodeQL, but I don't think we should assume it. I would prefer to have a better way to determine whether the toolcache is persistent or not before rolling out to self-hosted runners to avoid a situation where we install many per-language bundles and use an unnecessary amount of disk space.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

mbg reacted with thumbs up emoji

All reactions

👍 1 reaction

Comment thread

src/per-language-bundles.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.test.ts Outdated

Comment on lines +67 to +74

		const client = github.getOctokit("123", {
		request: {
		fetch: async () =>
		new Response(JSON.stringify([{ tag_name: tagName }]), {
		headers: { "content-type": "application/json" },
		}),
		},
		});

mbg Sep 16, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is less precise than the stubbing that stubHostedNightly replaces. Consider whether to stub sinon.stub(client.rest.repos, "listReleases"); instead of request.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

henrymercer reacted with thumbs up emoji

All reactions

👍 1 reaction

mbg Sep 18, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell, this hasn't been addressed, but that's not blocking.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/setup-codeql.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/setup-codeql.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

henrymercer and others added 10 commits

September 16, 2026 16:56


          Use per-language CodeQL bundles

289376d

Co-authored-by: Copilot App <[email protected]>


          Include failed bundle attempts in fallback timing

59ce3a2

Co-authored-by: Copilot App <[email protected]>


          Isolate per-language bundle eligibility state

2d47caf

Co-authored-by: Copilot App <[email protected]>


          Share CodeQL bundle platform definitions

dfb9bf5

Co-authored-by: Copilot App <[email protected]>


          Centralize CodeQL download telemetry fields

f536ef4

Co-authored-by: Copilot App <[email protected]>


          Clarify bundle resolution and latest-nightly selection

2f552a9

Co-authored-by: Copilot App <[email protected]>


          Extract explicit CodeQL bundle URL classification

bd2ddba

Co-authored-by: Copilot App <[email protected]>


          Return toolcache rejection reasons with Result

89606bb

Co-authored-by: Copilot App <[email protected]>


          Share elapsed-time rounding for bundle downloads

f4fa111

Co-authored-by: Copilot App <[email protected]>


          Use Result.orElse for bundle extraction paths

69f4715

Co-authored-by: Copilot App <[email protected]>

henrymercer commented Sep 16, 2026

Copy link

Copy Markdown

Contributor Author

Lots of good ideas, thank you for the detailed review!

mbg reacted with heart emoji

All reactions

❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Merge published per-language bundle history

5a2f29e

Co-authored-by: Copilot App <[email protected]>

Base automatically changed from henrymercer/bundle-resolution-pr to main

September 17, 2026 14:43

mbg reviewed

Sep 17, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for tackling all the review comments I left during the previous round! I have reviewed the new commits up to and including 2f552a9. I'll look at the remaining ones later this evening, but figured it would be good to post what I have so far now in the interest of time.

Most of the comments I added so far are minor, but there are a couple where I think the changes haven't quite been what I intended with my comments.

As a high-level point, I appreciate that the feedback is addressed across multiple commits, but the breakdown is still not ideal. Most of the new commits I have reviewed so far have a description that suggests they address one point of feedback, but actually mix in other smaller changes as well (some of which address other feedback and some of which are unrelated to the previous review). That makes it harder to verify whether a particular piece of feedback was addressed because more context switching is required while reviewing the individual commits and it takes a bit more effort to identify whether a given change relates to the main point of feedback or is unrelated.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

There was an error while loading. Please reload this page.

henrymercer and others added 6 commits

September 17, 2026 19:00


          Use shared test state for bundle eligibility

28b8f59

Co-authored-by: Copilot App <[email protected]>


          Group bundle eligibility test state overrides

ed3a24c

Co-authored-by: Copilot App <[email protected]>


          Simplify per-language platform eligibility checks

549d498

Co-authored-by: Copilot App <[email protected]>


          Rename the platform module

ead1f7d

Co-authored-by: Copilot App <[email protected]>


          Move download telemetry into the status-report directory

79fe3a1

Co-authored-by: Copilot App <[email protected]>


          Share per-language telemetry fields without renaming

ecec9b5

Co-authored-by: Copilot App <[email protected]>

henrymercer and others added 2 commits

September 17, 2026 19:07


          Describe the bundle URL resolver

f18f353

Co-authored-by: Copilot App <[email protected]>


          Clarify the latest-nightly eligibility exception

07fa87d

Co-authored-by: Copilot App <[email protected]>

mbg approved these changes

Sep 18, 2026

View reviewed changes

mbg left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have now reviewed the remaining commits from before my last review, as well as the ones in which you addressed my feedback from yesterday. Thanks for taking care of all that!

There are a few very minor points that are left, none of which are blocking / all of which can be followed-up on later. I am happy to approve this PR in this state and I'll go ahead and merge it.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/util.ts

		return databaseBundlePath;
		}

		/** Returns the elapsed milliseconds, rounded, since a `performance.now()` timestamp. */

mbg Sep 18, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: "since a performance.now() timestamp" is incomplete

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/per-language-bundles.test.ts

		const language = await getPerLanguageBundleLanguage(
		{
		initAllState({
		env: getTestEnv(),

mbg Sep 18, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: not required if it's not customised. initAllState will automatically call getTestEnv() to initialise env.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/per-language-bundles.test.ts

		initAllState({
		env,
		features: createFeatures(enabledFeatures),
		logger: getRecordingLogger([], { logToConsole: false }),

mbg Sep 18, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: Not needed if you don't inspect the log output. initAllState will automatically initialise a logger.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/per-language-bundles.ts


		// Check whether per-language bundles are published for the requested CLI version.
		// Skip this for the latest nightly, whose tag contains a date rather than a CLI version.
		// Latest-nightly selection skips this release-version check, but not the other eligibility checks.

mbg Sep 18, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: The comment now again doesn't explain why it's OK to skip.

Suggested change

	// Latest-nightly selection skips this release-version check, but not the other eligibility checks.
	// If `nightly` tools were requested, skip the version check since we don't have one at this point.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/setup-codeql.test.ts Outdated

Comment on lines +67 to +74

		const client = github.getOctokit("123", {
		request: {
		fetch: async () =>
		new Response(JSON.stringify([{ tag_name: tagName }]), {
		headers: { "content-type": "application/json" },
		}),
		},
		});

mbg Sep 18, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell, this hasn't been addressed, but that's not blocking.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mbg added this pull request to the merge queue

Sep 18, 2026

Merged via the queue into main with commit a65b83a

Sep 18, 2026

233 checks passed

Uh oh!

There was an error while loading. Please reload this page.

mbg deleted the henrymercer/per-language-bundles-pr branch

September 18, 2026 12:43

github-actions Bot mentioned this pull request

Sep 18, 2026

Merge main into releases/v4 #4152

Merged

5 of 8 tasks

mbg added a commit that referenced this pull request

Sep 18, 2026


          Add changelog entry for #4146

a97cdca

github-actions Bot mentioned this pull request

Sep 18, 2026

Merge releases/v4 into releases/v3 #4154

Merged

4 of 6 tasks

cursor Bot mentioned this pull request

Sep 21, 2026

ci: bump the actions group with 2 updates chhoumann/MetaEdit#210

Merged

claude Bot mentioned this pull request

Sep 22, 2026

build(deps): bump the github-actions-dependencies group with 2 updates kosli-dev/terraform-provider-kosli#269

Merged

henrymercer mentioned this pull request

Sep 22, 2026

Address per-language bundle review follow-ups #4159

Merged

mikkelchokolate mentioned this pull request

Sep 24, 2026

chore(deps): bump the github-actions-updates group with 2 updates mikkelchokolate/Veil#991

Merged

coderabbitai Bot mentioned this pull request

Sep 25, 2026

Bump github/codeql-action/analyze from 4.38.0 to 4.38.1 MichaelKinsy/PiG#24

Closed

johnny4young mentioned this pull request

Oct 6, 2026

build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 johnny4young/gos#41

Merged

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

mbg

mbg approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

size/XXL

May be extremely hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.