Skip to content
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
0ffebf7
Bump the npm-minor group with 5 updates
dependabot[bot] Dec 8, 2025
b73d396
Rebuild
github-actions[bot] Dec 8, 2025
44570be
Bump the actions-minor group across 1 directory with 2 updates
dependabot[bot] Dec 8, 2025
cd48547
Rebuild
github-actions[bot] Dec 8, 2025
7a55ffe
Determine CodeQL version from feature flags on GHEC-DR
henrymercer Dec 10, 2025
1fc7d37
Rename GHE_DOTCOM to GHEC_DR
henrymercer Dec 10, 2025
da50124
Update PR template to include GHEC-DR
henrymercer Dec 10, 2025
805b7e1
Clean up JavaMinimizeDependencyJars feature flag
nickrolfe Dec 11, 2025
4564f5e
Update changelog and version after v4.31.8
github-actions[bot] Dec 12, 2025
65bad62
Rebuild
github-actions[bot] Dec 12, 2025
4b675e4
Merge pull request #3356 from github/mergeback/v4.31.8-to-main-1b168cd3
oscarsj Dec 12, 2025
8e921c3
Return status report from `cleanupAndUploadDatabases`
henrymercer Dec 11, 2025
5d063dd
Populate database upload results telemetry
henrymercer Dec 11, 2025
2ac846d
Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-38a2a793c5
henrymercer Dec 15, 2025
0264b51
Merge pull request #3348 from github/dependabot/npm_and_yarn/npm-mino…
henrymercer Dec 15, 2025
7e0b77e
Merge pull request #3349 from github/dependabot/github_actions/dot-gi…
henrymercer Dec 15, 2025
b1dea65
Make `postProcessAndUploadSarif` the default
mbg Nov 17, 2025
009fe6b
Remove `AnalyzeUseNewUpload` FF
mbg Nov 17, 2025
b30cb9a
Merge branch 'main' into mbg/ff/make-new-upload-default
mbg Dec 15, 2025
a539068
Bump ruby/setup-ruby
dependabot[bot] Dec 15, 2025
6dbc22c
Bump actions/download-artifact from 6 to 7 in /.github/workflows
dependabot[bot] Dec 15, 2025
034374e
Bump actions/upload-artifact from 5 to 6 in /.github/workflows
dependabot[bot] Dec 15, 2025
d6c1a79
Rebuild
github-actions[bot] Dec 15, 2025
7fd7db3
Rebuild
github-actions[bot] Dec 15, 2025
a682bbe
Merge pull request #3309 from github/mbg/ff/make-new-upload-default
mbg Dec 15, 2025
07cd437
Merge pull request #3366 from github/dependabot/github_actions/dot-gi…
mbg Dec 15, 2025
d0ad1da
Merge pull request #3364 from github/dependabot/github_actions/dot-gi…
mbg Dec 15, 2025
c2d4383
Merge branch 'main' into dependabot/github_actions/dot-github/workflo…
mbg Dec 15, 2025
b5e1a28
Merge pull request #3365 from github/dependabot/github_actions/dot-gi…
mbg Dec 16, 2025
a2ee53c
Use full names for GitHub variants
henrymercer Dec 16, 2025
c07cc0d
Merge pull request #3351 from github/henrymercer/ghec-dr-determine-to…
henrymercer Dec 16, 2025
0cb8633
Prefer `performance.now()`
henrymercer Dec 16, 2025
ae5de9a
Use `getErrorMessage` in log too
henrymercer Dec 16, 2025
19c7f96
Rename `isOverlayBase`
henrymercer Dec 16, 2025
e962687
Merge branch 'main' into henrymercer/database-upload-telemetry
henrymercer Dec 16, 2025
d29eddb
Extract version number to constant
nickrolfe Dec 16, 2025
5eb7519
Merge pull request #3358 from github/henrymercer/database-upload-tele…
henrymercer Dec 16, 2025
998798e
Merge pull request #3352 from github/nickrolfe/jar-min-ff-cleanup
nickrolfe Dec 16, 2025
1dc115f
Update changelog for v4.31.9
github-actions[bot] Dec 16, 2025
5d4e8d1
Merge pull request #3371 from github/update-v4.31.9-998798e34
henrymercer Dec 16, 2025
e7c7a2d
Revert "Update version and changelog for v3.31.8"
github-actions[bot] Dec 16, 2025
4f34645
Revert "Rebuild"
github-actions[bot] Dec 16, 2025
7348876
Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31…
github-actions[bot] Dec 16, 2025
d300581
Update version and changelog for v3.31.9
github-actions[bot] Dec 16, 2025
311b632
Rebuild
github-actions[bot] Dec 16, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions lib/analyze-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

21 changes: 2 additions & 19 deletions lib/analyze-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/autobuild-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/init-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 13 additions & 20 deletions lib/init-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/resolve-environment-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/setup-codeql-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/start-proxy-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/start-proxy-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/upload-lib.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/upload-sarif-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions lib/upload-sarif-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

22 changes: 0 additions & 22 deletions src/dependency-caching.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -603,28 +603,6 @@ test("getFeaturePrefix - returns empty string if no features are enabled", async
}
});

test("getFeaturePrefix - Java - returns 'minify-' if JavaMinimizeDependencyJars is enabled", async (t) => {
const codeql = createStubCodeQL({});
const features = createFeatures([Feature.JavaMinimizeDependencyJars]);

const result = await getFeaturePrefix(codeql, features, KnownLanguage.java);
t.deepEqual(result, "minify-");
});

test("getFeaturePrefix - non-Java - returns '' if JavaMinimizeDependencyJars is enabled", async (t) => {
const codeql = createStubCodeQL({});
const features = createFeatures([Feature.JavaMinimizeDependencyJars]);

for (const knownLanguage of Object.values(KnownLanguage)) {
// Skip Java since we expect a result for it, which is tested in the previous test.
if (knownLanguage === KnownLanguage.java) {
continue;
}
const result = await getFeaturePrefix(codeql, features, knownLanguage);
t.deepEqual(result, "", `Expected no feature prefix for ${knownLanguage}`);
}
});

test("getFeaturePrefix - C# - returns prefix if CsharpNewCacheKey is enabled", async (t) => {
const codeql = createStubCodeQL({});
const features = createFeatures([Feature.CsharpNewCacheKey]);
Expand Down
23 changes: 3 additions & 20 deletions src/dependency-caching.ts
Original file line number Diff line number Diff line change
Expand Up @@ -541,18 +541,7 @@ export async function getFeaturePrefix(
}
};

if (language === KnownLanguage.java) {
// To ensure a safe rollout of JAR minimization, we change the key when the feature is enabled.
const minimizeJavaJars = await features.getValue(
Feature.JavaMinimizeDependencyJars,
codeql,
);

// To maintain backwards compatibility with this, we return "minify-" instead of a hash.
if (minimizeJavaJars) {
return "minify-";
}
} else if (language === KnownLanguage.csharp) {
if (language === KnownLanguage.csharp) {
await addFeatureIfEnabled(Feature.CsharpNewCacheKey);
await addFeatureIfEnabled(Feature.CsharpCacheBuildModeNone);
}
Expand Down Expand Up @@ -593,14 +582,8 @@ async function cachePrefix(
// experimental features that affect the cache contents.
const featurePrefix = await getFeaturePrefix(codeql, features, language);

// Assemble the cache key. For backwards compatibility with the JAR minification experiment's existing
// feature prefix usage, we add that feature prefix at the start. Other feature prefixes are inserted
// after the general CodeQL dependency cache prefix.
if (featurePrefix === "minify-") {
return `${featurePrefix}${prefix}-${CODEQL_DEPENDENCY_CACHE_VERSION}-${runnerOs}-${language}-`;
} else {
return `${prefix}-${featurePrefix}${CODEQL_DEPENDENCY_CACHE_VERSION}-${runnerOs}-${language}-`;
}
// Assemble the cache key.
return `${prefix}-${featurePrefix}${CODEQL_DEPENDENCY_CACHE_VERSION}-${runnerOs}-${language}-`;
}

/** Represents information about our overall cache usage for CodeQL dependency caches. */
Expand Down
6 changes: 0 additions & 6 deletions src/feature-flags.ts
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ export enum Feature {
DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
ExportDiagnosticsEnabled = "export_diagnostics_enabled",
JavaMinimizeDependencyJars = "java_minimize_dependency_jars",
OverlayAnalysis = "overlay_analysis",
OverlayAnalysisActions = "overlay_analysis_actions",
OverlayAnalysisCodeScanningActions = "overlay_analysis_code_scanning_actions",
Expand Down Expand Up @@ -168,11 +167,6 @@ export const featureConfig: Record<
legacyApi: true,
minimumVersion: undefined,
},
[Feature.JavaMinimizeDependencyJars]: {
defaultValue: false,
envVar: "CODEQL_ACTION_JAVA_MINIMIZE_DEPENDENCY_JARS",
minimumVersion: "2.23.0",
},
[Feature.OverlayAnalysis]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
Expand Down
23 changes: 16 additions & 7 deletions src/init-action.ts
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,13 @@ import {
} from "./util";
import { checkWorkflow } from "./workflow";

/**
* First version of CodeQL where the Java extractor safely supports the option to minimize
* dependency jars. Note: some earlier versions of the extractor will respond to the corresponding
* option, but may rewrite jars in ways that lead to extraction errors.
*/
export const CODEQL_VERSION_JAR_MINIMIZATION = "2.23.0";

/**
* Sends a status report indicating that the `init` Action is starting.
*
Expand Down Expand Up @@ -638,18 +645,20 @@ async function run() {
}
}

// If the feature flag to minimize Java dependency jars is enabled, and we are doing a Java
// `build-mode: none` analysis (i.e. the flag is relevant), then set the environment variable
// that enables the corresponding option in the Java extractor. We also only do this if
// dependency caching is enabled, since the option is intended to reduce the size of
// dependency caches, but the jar-rewriting does have a performance cost that we'd like to avoid
// when caching is not being used.
// If we are doing a Java `build-mode: none` analysis, then set the environment variable that
// enables the option in the Java extractor to minimize dependency jars. We also only do this if
// dependency caching is enabled, since the option is intended to reduce the size of dependency
// caches, but the jar-rewriting does have a performance cost that we'd like to avoid when
// caching is not being used.
// TODO: Remove this language-specific mechanism and replace it with a more general one that
// tells extractors when dependency caching is enabled, and then the Java extractor can make its
// own decision about whether to rewrite jars.
if (process.env[EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS]) {
logger.debug(
`${EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS} is already set to '${process.env[EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS]}', so the Action will not override it.`,
);
} else if (
(await features.getValue(Feature.JavaMinimizeDependencyJars, codeql)) &&
(await codeQlVersionAtLeast(codeql, CODEQL_VERSION_JAR_MINIMIZATION)) &&
config.dependencyCachingEnabled &&
config.buildMode === BuildMode.None &&
config.languages.includes(KnownLanguage.java)
Expand Down
Loading