René's URL Explorer Experiment


Title: Run tar from its resolved path when extracting zstd bundles by henrymercer · Pull Request #4281 · github/codeql-action · GitHub

Open Graph Title: Run tar from its resolved path when extracting zstd bundles by henrymercer · Pull Request #4281 · github/codeql-action

X Title: Run tar from its resolved path when extracting zstd bundles by henrymercer · Pull Request #4281 · github/codeql-action

Description: extractTarZst ran tar by name. On Windows, child_process.spawn by default looks for a bare command name in the current directory before searching PATH, so this could run a different tar from the one that getTarVersion checked. In practice, this only affects Windows runners with a tools input that points to a .tar.zst bundle, since the Action otherwise uses gzip bundles on Windows. This PR records the path that getTarVersion resolves with io.which, which only searches PATH, and runs that path. The [command] log line and error messages now show this resolved path. On Linux and macOS, where zstd bundles are the default, this should otherwise run the same tar as before. It also fixes stdout and stderr being passed to CommandInvocationError the wrong way round, so when tar exits with an error, the error message now includes the last line of tar's stderr rather than its stdout. Risk assessment For internal use only. Please select the risk level of this change: Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only. Which use cases does this change impact? Workflow types: Advanced setup - Impacts users who have custom CodeQL workflows. Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...). Products: Code Scanning - The changes impact analyses when analysis-kinds: code-scanning. Code Quality - The changes impact analyses when analysis-kinds: code-quality. Other first-party - The changes impact other first-party analyses. Third-party analyses - The changes affect the upload-sarif action. Environments: Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency. GHES - Impacts CodeQL workflows on GitHub Enterprise Server. How did/will you validate this change? End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks). Other - I checked manually that when tar exits with an error, the error message includes the last line of tar's stderr. If something goes wrong after this change is released, what are the mitigation and rollback strategies? Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix. How will you know if something goes wrong after this change is released? Telemetry - I rely on existing telemetry or have made changes to the telemetry. Are there any special considerations for merging or releasing this change? No special considerations - This change can be merged at any time. Merge / deployment checklist Confirm this change is backwards compatible with existing workflows. Consider adding a changelog entry for this change. Confirm the readme and docs have been updated if necessary.

Open Graph Description: extractTarZst ran tar by name. On Windows, child_process.spawn by default looks for a bare command name in the current directory before searching PATH, so this could run a different tar from the on...

X Description: extractTarZst ran tar by name. On Windows, child_process.spawn by default looks for a bare command name in the current directory before searching PATH, so this could run a different tar from the on...

Opengraph URL: https://github.com/github/codeql-action/pull/4281

X: @github

direct link

Domain: github.com

react-profiling0
react-import-mapreact,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf
route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:cbf59aaa-bcb1-8682-71a7-e32e9d185921
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idA2A2:1E2715:6AF0EF:8A705E:6AED2DD7
html-safe-nonce61b3ca477a7e4f07d21aa7050d34dbd6c0773a1c845d5ad40e4ac274f3f9cc42
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBMkEyOjFFMjcxNTo2QUYwRUY6OEE3MDVFOjZBRUQyREQ3IiwidmlzaXRvcl9pZCI6IjY1MTU0NjEzODY5MTY0MDg3OTEiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmac2ce233a0f56e2fbb835f9ce1c00bbcbf55aadf2fac1e8a7eef5dc5d4c1717699
hovercard-subject-tagpull_request:5088323122
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql-action/pull/4281/files
twitter:imagehttps://avatars.githubusercontent.com/u/14129055?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/14129055?s=400&v=4
og:image:altextractTarZst ran tar by name. On Windows, child_process.spawn by default looks for a bare command name in the current directory before searching PATH, so this could run a different tar from the on...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
Nonee51d0b7b5ab34b1688c05b54c3ed17b8658b2fa9bca973a9c740683ccb12cf4a
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql-action git https://github.com/github/codeql-action.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id259445878
octolytics-dimension-repository_nwogithub/codeql-action
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id259445878
octolytics-dimension-repository_network_root_nwogithub/codeql-action
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release59ebb7b901cc154ecc179a44f266fcf69f343b30
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql-action/pull/4281/files#start-of-content
https://github.com/
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql-action%2Fpull%2F4281%2Ffiles
GitHubRepository hosting, code review, and collaborationhttps://github.com/platform
CopilotAI coding agent for tasks, projects, and automated workhttps://github.com/features/copilot
ActionsCI/CD and automationhttps://github.com/features/actions
Code QualityQuality analysis, fixes, and enforcementhttps://github.com/features/code-quality
CodespacesCloud development environmentshttps://github.com/features/codespaces
Code SecurityVulnerability detection and remediationhttps://github.com/security/advanced-security/code-security
Secret ProtectionSecret scanning and leak preventionhttps://github.com/security/advanced-security/secret-protection
All Featureshttps://github.com/features
Documentationhttps://docs.github.com/en
Traininghttps://learn.github.com/skills
Certificationshttps://learn.github.com/credentials
Build with Copilothttps://github.com/features/ai
Customize Copilothttps://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-copilot-overview
Integrationshttps://github.com/marketplace
Trending reposhttps://github.com/trending
GitHub Sponsorshttps://github.com/open-source/sponsors
Developer articleshttps://github.com/resources/articles
ChangelogYour source for the latest features, improvements, and fixes across GitHub products, all in one place.https://github.blog/changelog/
Enterpriseshttps://github.com/enterprise
Teamhttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
See all industrieshttps://github.com/solutions/industry
Why GitHubhttps://github.com/why-github
Customer Storieshttps://github.com/customer-stories
Business insightshttps://github.com/solutions/executive-insights
Trust Centerhttps://github.com/trust-center
GitHub Advanced SecurityEnterprise-grade code securityhttps://github.com/security/advanced-security
Copilot for businessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Documentationhttps://docs.github.com/en
Resource centerhttps://github.com/resources
Bloghttps://github.blog/
Events & webinarshttps://github.com/resources/events
Community Forumhttps://github.com/orgs/community/discussions
Customer Storieshttps://github.com/customer-stories
Integrationshttps://github.com/marketplace
Customer supporthttps://help.github.com/
Traininghttps://learn.github.com/skills
GitHub Statushttps://www.githubstatus.com/
Abouthttps://github.com/about
Partnershttps://github.com/partners
Changeloghttps://github.blog/changelog/
GitHub UniverseThe event for developers, by developers — talks, workshops, and what’s next for GitHub.https://githubuniverse.com/
Pricinghttps://github.com/pricing
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql-action%2Fpull%2F4281%2Ffiles
Sign uphttps://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql-action
Reloadhttps://github.com/github/codeql-action/pull/4281/files
Reloadhttps://github.com/github/codeql-action/pull/4281/files
Reloadhttps://github.com/github/codeql-action/pull/4281/files
githubhttps://github.com/github
codeql-actionhttps://github.com/github/codeql-action
Codehttps://github.com/github/codeql-action
Issues165 (165)https://github.com/github/codeql-action/issues
Pull requests41 (41)https://github.com/github/codeql-action/pulls
Actionshttps://github.com/github/codeql-action/actions
Security and quality2 (2)https://github.com/github/codeql-action/security
Insightshttps://github.com/github/codeql-action/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql-action%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql-action%2Fissues%2Fnew%2Fchoose
henrymercerhttps://github.com/henrymercer
mainhttps://github.com/github/codeql-action/tree/main
henrymercer/tar-path-in-extracttarzsthttps://github.com/github/codeql-action/tree/henrymercer/tar-path-in-extracttarzst
Conversation 6 https://github.com/github/codeql-action/pull/4281
Commits 2 https://github.com/github/codeql-action/pull/4281/commits
Checks 230 https://github.com/github/codeql-action/pull/4281/checks
Files changed https://github.com/github/codeql-action/pull/4281/files
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
Run tar from its resolved path when extracting zstd bundles https://github.com/github/codeql-action/pull/4281/files#top
Show all changes 2 commits https://github.com/github/codeql-action/pull/4281/files
0b97d53 Extract zstd bundles using the tar path found by getTarVersion henrymercer Oct 30, 2026 https://github.com/github/codeql-action/pull/4281/commits/0b97d537111f2ceccc660cfbdad7ce5be1b37f3a
8512f45 Fix stdout and stderr being swapped in tar extraction errors henrymercer Oct 30, 2026 https://github.com/github/codeql-action/pull/4281/commits/8512f45c1a3244f7f1f2c0f416734b06513a22ba
Clear filters https://github.com/github/codeql-action/pull/4281/files
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
entry-points.js https://github.com/github/codeql-action/pull/4281/files#diff-73697317a7dd14441dcfb24bc586f637ae2b815b5e503a05a81816be74fcd815
tar.test.ts https://github.com/github/codeql-action/pull/4281/files#diff-7c358723f47de66e2654a65dbf0b92c36a90823db3695e32c5c2f9922590ffd1
tar.ts https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
tools-download.test.ts https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
lib/entry-points.jshttps://github.com/github/codeql-action/pull/4281/files#diff-73697317a7dd14441dcfb24bc586f637ae2b815b5e503a05a81816be74fcd815
View file https://github.com/github/codeql-action/blob/8512f45c1a3244f7f1f2c0f416734b06513a22ba/lib/entry-points.js
Open in desktop https://desktop.github.com
how customized files appear on GitHubhttps://docs.github.com/github/administering-a-repository/customizing-how-changed-files-appear-on-github
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
src/tar.test.tshttps://github.com/github/codeql-action/pull/4281/files#diff-7c358723f47de66e2654a65dbf0b92c36a90823db3695e32c5c2f9922590ffd1
View file https://github.com/github/codeql-action/blob/8512f45c1a3244f7f1f2c0f416734b06513a22ba/src/tar.test.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/4281/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/4281/files#diff-7c358723f47de66e2654a65dbf0b92c36a90823db3695e32c5c2f9922590ffd1
https://github.com/github/codeql-action/pull/4281/files#diff-7c358723f47de66e2654a65dbf0b92c36a90823db3695e32c5c2f9922590ffd1
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
src/tar.tshttps://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
View file https://github.com/github/codeql-action/blob/8512f45c1a3244f7f1f2c0f416734b06513a22ba/src/tar.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/4281/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
henrymercerhttps://github.com/henrymercer
Oct 30, 2026https://github.com/github/codeql-action/pull/4281/files#r4426557297
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
mbghttps://github.com/mbg
Oct 30, 2026https://github.com/github/codeql-action/pull/4281/files#r4426646289
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
henrymercerhttps://github.com/henrymercer
Oct 30, 2026https://github.com/github/codeql-action/pull/4281/files#r4426713084
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
https://github.com/github/codeql-action/pull/4281/files#diff-2677181fcd0a39c1ac9a07cf9025c160d3cff5796931d88b9acccae8e6897a76
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
src/tools-download.test.tshttps://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
View file https://github.com/github/codeql-action/blob/8512f45c1a3244f7f1f2c0f416734b06513a22ba/src/tools-download.test.ts
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/4281/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
https://github.com/github/codeql-action/pull/4281/files#diff-ebadd2e3dcb51075cbd718340c3d85b2c75312b8849c4b7a23f3bb78a63925fe
Please reload this pagehttps://github.com/github/codeql-action/pull/4281/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.