René's URL Explorer Experiment

Title: Add feature for forcing the `nightly` bundle in `dynamic` workflows by mbg · Pull Request #3484 · github/codeql-action · GitHub

Open Graph Title: Add feature for forcing the `nightly` bundle in `dynamic` workflows by mbg · Pull Request #3484 · github/codeql-action

X Title: Add feature for forcing the `nightly` bundle in `dynamic` workflows by mbg · Pull Request #3484 · github/codeql-action

Description: Adds a Feature which, when enabled, and the workflow was triggered by a dynamic event forces getCodeQLSource to pick the latest, nightly release. Some drive-by improvements and observations: I added a couple of comments to better document getCodeQLSource. While writing those, I noticed that the !toolsInput.startsWith("http") check would probably cause problems if a file happened to have a path that starts with http. Probably not a very likely problem, but could be tricky to troubleshoot if it happens. We could improve this by performing more explicit checks for http:// and https:// or whether the suspected file exists locally or not. Outside of the scope of this PR though. I added a unit test for tools: nightly which didn't seem to exist. While doing that, I noticed that getNightlyToolsUrl seems to assume that the nightly tag is codeql-bundle- followed by a semver, but this is no longer the case for nightly releases. There's a fallback logic which handles this fine, but we should probably update this to expect the date-based tags. Risk assessment For internal use only. Please select the risk level of this change: Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only. Which use cases does this change impact? Workflow types: Managed - Impacts users with dynamic workflows (Default Setup, CCR, ...). Products: Code Scanning - The changes impact analyses when analysis-kinds: code-scanning. Code Quality - The changes impact analyses when analysis-kinds: code-quality. CCR - The changes impact analyses for Copilot Code Reviews. Environments: Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency. How did/will you validate this change? Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files). End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks). If something goes wrong after this change is released, what are the mitigation and rollback strategies? Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags. How will you know if something goes wrong after this change is released? Telemetry - I rely on existing telemetry or have made changes to the telemetry. Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release. Alerts - New or existing monitors will trip if something goes wrong with this change. Are there any special considerations for merging or releasing this change? No special considerations - This change can be merged at any time. Merge / deployment checklist Confirm this change is backwards compatible with existing workflows. Consider adding a changelog entry for this change. Confirm the readme and docs have been updated if necessary.

Open Graph Description: Adds a Feature which, when enabled, and the workflow was triggered by a dynamic event forces getCodeQLSource to pick the latest, nightly release. Some drive-by improvements and observations: I add...

X Description: Adds a Feature which, when enabled, and the workflow was triggered by a dynamic event forces getCodeQLSource to pick the latest, nightly release. Some drive-by improvements and observations: I add...

Opengraph URL: https://github.com/github/codeql-action/pull/3484

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width