Make PR template more concise

Co-authored-by: oscarsj <1410188+oscarsj@users.noreply.github.com>

.github/codeql/codeql-config-javascript.yml

@@ -1,6 +1,15 @@
 name: "CodeQL config"
 queries: 
-  - ./queries
+  - name: Run custom queries
+    uses: ./queries
+  # Run all extra query suites, both because we want to
+  # and because it'll act as extra testing. This is why
+  # we include both even though one is a superset of the
+  # other, because we're testing the parsing logic and
+  # that the suites exist in the codeql bundle.
+  - uses: security-and-quality
+  - uses: security-experimental
+  - uses: security-extended
 paths-ignore:
   - lib
   - tests

.github/pull_request_template.md

@@ -29,13 +29,14 @@ For internal use only. Please select the risk level of this change:
 
 #### How did/will you validate this change?
 
-<!-- Delete options that don't apply. -->
+<!-- Delete options that don't apply. Be explicit about test coverage. -->
 
 - **Test repository** - This change will be tested on a test repository before merging.
-- **Unit tests** - I am depending on unit test coverage (i.e. tests in `.test.ts` files).
+- **Unit tests** - I am depending on existing unit test coverage (i.e. tests in `.test.ts` files).
 - **End-to-end tests** - I am depending on PR checks (i.e. tests in `pr-checks`).
+- **New / updated tests** - I have added or updated tests (summarize below).
 - **Other** - Please provide details.
-- **None** - I am not validating these changes.
+- **None** - I am not validating these changes (provide justification below).
 
 #### If something goes wrong after this change is released, what are the mitigation and rollback strategies?
 
@@ -57,5 +58,6 @@ For internal use only. Please select the risk level of this change:
 ### Merge / deployment checklist
 
 - Confirm this change is backwards compatible with existing workflows.
+- Confirm that tests have been added/updated or are not needed.
 - Consider adding a [changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) entry for this change.
 - Confirm the [readme](https://github.com/github/codeql-action/blob/main/README.md) and docs have been updated if necessary.

.github/workflows/codeql.yml

@@ -2,6 +2,7 @@ name: "CodeQL action"
 
 on:
   push:
+    branches: [main, releases/v*]
   pull_request:
     branches: [main, releases/v*]
     # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened

lib/init-action-post.js

@@ -129786,6 +129786,9 @@ function appendExtraQueryExclusions(extraQueryExclusions, cliConfig) {
   }
   return augmentedConfig;
 }
+function isCodeScanningEnabled(config) {
+  return config.analysisKinds.includes("code-scanning" /* CodeScanning */);
+}
 
 // src/setup-codeql.ts
 var fs12 = __toESM(require("fs"));
@@ -133750,6 +133753,11 @@ async function tryUploadSarifIfRunFailed(config, repositoryNwo, features, logger
       "CODEQL_ACTION_JOB_STATUS" /* JOB_STATUS */,
       process.env["CODEQL_ACTION_JOB_STATUS" /* JOB_STATUS */] ?? "JOB_STATUS_CONFIGURATION_ERROR" /* ConfigErrorStatus */
     );
+    if (!isCodeScanningEnabled(config)) {
+      return {
+        upload_failed_run_skipped_because: "Code Scanning is not enabled."
+      };
+    }
     try {
       return await maybeUploadFailedSarif(
         config,

src/init-action-post-helper.test.ts

@@ -2,6 +2,7 @@ import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
 
 import * as actionsUtil from "./actions-util";
+import { AnalysisKind } from "./analyses";
 import * as codeql from "./codeql";
 import * as configUtils from "./config-utils";
 import { Feature } from "./feature-flags";
@@ -28,12 +29,13 @@ test("post: init action with debug mode off", async (t) => {
     const gitHubVersion: util.GitHubVersion = {
       type: util.GitHubVariant.DOTCOM,
     };
-    sinon.stub(configUtils, "getConfig").resolves({
-      debugMode: false,
-      gitHubVersion,
-      languages: [],
-      packs: [],
-    } as unknown as configUtils.Config);
+    sinon.stub(configUtils, "getConfig").resolves(
+      createTestConfig({
+        debugMode: false,
+        gitHubVersion,
+        languages: [],
+      }),
+    );
 
     const uploadAllAvailableDebugArtifactsSpy = sinon.spy();
     const printDebugLogsSpy = sinon.spy();
@@ -295,6 +297,17 @@ test("uploading failed SARIF run fails when workflow does not reference github/c
   t.truthy(result.upload_failed_run_stack_trace);
 });
 
+test("not uploading failed SARIF when `code-scanning` is not an enabled analysis kind", async (t) => {
+  const result = await testFailedSarifUpload(t, createTestWorkflow([]), {
+    analysisKinds: [AnalysisKind.CodeQuality],
+    expectUpload: false,
+  });
+  t.is(
+    result.upload_failed_run_skipped_because,
+    "Code Scanning is not enabled.",
+  );
+});
+
 function createTestWorkflow(
   steps: workflow.WorkflowJobStep[],
 ): workflow.Workflow {
@@ -327,20 +340,22 @@ async function testFailedSarifUpload(
     expectUpload = true,
     exportDiagnosticsEnabled = false,
     matrix = {},
+    analysisKinds = [AnalysisKind.CodeScanning],
   }: {
     category?: string;
     databaseExists?: boolean;
     expectUpload?: boolean;
     exportDiagnosticsEnabled?: boolean;
     matrix?: { [key: string]: string };
+    analysisKinds?: AnalysisKind[];
   } = {},
 ): Promise<initActionPostHelper.UploadFailedSarifResult> {
-  const config = {
+  const config = createTestConfig({
+    analysisKinds,
     codeQLCmd: "codeql",
     debugMode: true,
     languages: [],
-    packs: [],
-  } as unknown as configUtils.Config;
+  });
   if (databaseExists) {
     config.dbLocation = "path/to/database";
   }

src/init-action-post-helper.ts

@@ -7,7 +7,7 @@ import * as actionsUtil from "./actions-util";
 import { CodeScanning } from "./analyses";
 import { getApiClient } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
-import { Config } from "./config-utils";
+import { Config, isCodeScanningEnabled } from "./config-utils";
 import * as dependencyCaching from "./dependency-caching";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
@@ -139,6 +139,15 @@ export async function tryUploadSarifIfRunFailed(
       EnvVar.JOB_STATUS,
       process.env[EnvVar.JOB_STATUS] ?? JobStatus.ConfigErrorStatus,
     );
+
+    // If the only enabled analysis kind is `code-quality`, then we shouldn't
+    // upload the failed SARIF to Code Scanning.
+    if (!isCodeScanningEnabled(config)) {
+      return {
+        upload_failed_run_skipped_because: "Code Scanning is not enabled.",
+      };
+    }
+
     try {
       return await maybeUploadFailedSarif(
         config,