Revert "DO NOT MERGE: test enabling cpp_dependency_installation_enabled"

This reverts commit d3b21d60fd.

.github/workflows/rebuild.yml

@@ -1,60 +0,0 @@
-name: Rebuild Action
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  rebuild:
-    name: Rebuild Action
-    runs-on: ubuntu-latest
-    if: github.event.label.name == 'Rebuild'
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-
-      - name: Remove label
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh pr edit --repo github/codeql-action "$PR_NUMBER" \
-            --remove-label "Rebuild"
-
-      - name: Compile TypeScript
-        run: |
-          npm install
-          npm run lint -- --fix
-          npm run build
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: 3.11
-
-      - name: Generate workflows
-        run: |
-          cd pr-checks
-          python -m pip install --upgrade pip
-          pip install ruamel.yaml==0.17.31
-          python3 sync.py
-
-      - name: Check for changes and push
-        env:
-          BRANCH: ${{ github.event.pull_request.head.ref }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          if [ ! -z "$(git status --porcelain)" ]; then
-            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git config --global user.name "github-actions[bot]"
-            git commit -am "Rebuild"
-            git push origin "HEAD:$BRANCH"
-            echo "Pushed a commit to rebuild the Action." \
-              "Please mark the PR as ready for review to trigger PR checks." |
-              gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
-            gh pr ready --undo --repo github/codeql-action "$PR_NUMBER"
-          fi

.pre-commit-config.yaml

@@ -1,20 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: compile-ts
-        name: Compile typescript
-        files: \.[tj]s$
-        language: system
-        entry: npm run build
-        pass_filenames: false
-      - id: lint-ts
-        name: Lint typescript code
-        files: \.ts$
-        language: system
-        entry: npm run lint -- --fix
-      - id: pr-checks-sync
-        name: Synchronize PR check workflows
-        files: ^.github/workflows/__.*\.yml$|^pr-checks
-        language: system
-        entry: python3 pr-checks/sync.py
-        pass_filenames: false

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## 2.22.5 - 27 Oct 2023
+## [UNRELEASED]
 
 No user facing changes.
 

lib/analyze.js

@@ -232,7 +232,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 }
                 statusReport["event_reports"].push(perQueryAlertCountEventReport);
             }
-            if (!(await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_ANALYSIS_SUMMARY_V2))) {
+            if (!(await features.getValue(feature_flags_1.Feature.AnalysisSummaryV2Enabled, codeql))) {
                 await runPrintLinesOfCode(language);
             }
         }

lib/codeql.js

@@ -23,13 +23,12 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGeneratedCodeScanningConfigPath = exports.getTrapCachingExtractorConfigArgsForLang = exports.getTrapCachingExtractorConfigArgs = exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = exports.CODEQL_VERSION_LANGUAGE_ALIASING = exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED = exports.CODEQL_VERSION_BETTER_NO_CODE_ERROR_MESSAGE = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_EXPORT_FAILED_SARIF = exports.CommandInvocationError = void 0;
+exports.getGeneratedCodeScanningConfigPath = exports.getTrapCachingExtractorConfigArgsForLang = exports.getTrapCachingExtractorConfigArgs = exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_LANGUAGE_ALIASING = exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED = exports.CODEQL_VERSION_BETTER_NO_CODE_ERROR_MESSAGE = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CommandInvocationError = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const yaml = __importStar(require("js-yaml"));
-const semver = __importStar(require("semver"));
 const actions_util_1 = require("./actions-util");
 const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
@@ -91,11 +90,6 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2023-09-12";
  * For convenience, please keep these in descending order. Once a version
  * flag is older than the oldest supported version above, it may be removed.
  */
-/**
- * Versions 2.11.3+ of the CodeQL CLI support exporting a failed SARIF file via
- * `codeql database export-diagnostics` or `codeql diagnostics export`.
- */
-exports.CODEQL_VERSION_EXPORT_FAILED_SARIF = "2.11.3";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 /**
  * Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for
@@ -132,14 +126,6 @@ exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = "2.14.2";
  * Versions 2.14.4+ of the CodeQL CLI support language aliasing.
  */
 exports.CODEQL_VERSION_LANGUAGE_ALIASING = "2.14.4";
-/**
- * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
- */
-exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
-/**
- * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
- */
-exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
 /**
  * Set up CodeQL CLI access.
  *
@@ -310,10 +296,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG)) {
                 extraArgs.push("--calculate-language-specific-baseline");
             }
-            if (await isSublanguageFileCoverageEnabled(config, this)) {
+            if (await features.getValue(feature_flags_1.Feature.SublanguageFileCoverageEnabled, this)) {
                 extraArgs.push("--sublanguage-file-coverage");
             }
-            else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
+            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
                 extraArgs.push("--no-sublanguage-file-coverage");
             }
             await runTool(cmd, [
@@ -484,10 +470,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (querySuitePath) {
                 codeqlArgs.push(querySuitePath);
             }
-            if (await features.getValue(feature_flags_1.Feature.EvaluatorFineGrainedParallelismEnabled, this)) {
+            if (await features.getValue(feature_flags_1.Feature.EvaluatorIntraLayerParallelismEnabled, this)) {
                 codeqlArgs.push("--intra-layer-parallelism");
             }
-            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_FINE_GRAINED_PARALLELISM)) {
+            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_INTRA_LAYER_PARALLELISM)) {
                 codeqlArgs.push("--no-intra-layer-parallelism");
             }
             await runTool(cmd, codeqlArgs);
@@ -520,10 +506,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (await util.codeQlVersionAbove(this, CODEQL_VERSION_FILE_BASELINE_INFORMATION)) {
                 codeqlArgs.push("--sarif-add-baseline-file-info");
             }
-            if (await isSublanguageFileCoverageEnabled(config, this)) {
+            if (await features.getValue(feature_flags_1.Feature.SublanguageFileCoverageEnabled, this)) {
                 codeqlArgs.push("--sublanguage-file-coverage");
             }
-            else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
+            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
                 codeqlArgs.push("--no-sublanguage-file-coverage");
             }
             if (shouldExportDiagnostics) {
@@ -532,15 +518,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             else if (await util.codeQlVersionAbove(this, "2.12.4")) {
                 codeqlArgs.push("--no-sarif-include-diagnostics");
             }
-            if (
-            // Analysis summary v2 links to the status page, so check the GHES version we're running on
-            // supports the status page.
-            (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
-                semver.gte(config.gitHubVersion.version, "3.9.0")) &&
-                (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2))) {
+            if (await features.getValue(feature_flags_1.Feature.AnalysisSummaryV2Enabled, this)) {
                 codeqlArgs.push("--new-analysis-summary");
             }
-            else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2)) {
+            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_ANALYSIS_SUMMARY_V2)) {
                 codeqlArgs.push("--no-new-analysis-summary");
             }
             codeqlArgs.push(databasePath);
@@ -1001,11 +982,4 @@ async function getLanguageAliasingArguments(codeql) {
     }
     return [];
 }
-async function isSublanguageFileCoverageEnabled(config, codeql) {
-    return (
-    // Sub-language file coverage is first supported in GHES 3.12.
-    (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
-        semver.gte(config.gitHubVersion.version, "3.12.0")) &&
-        (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)));
-}
 //# sourceMappingURL=codeql.js.map

lib/codeql.test.js

@@ -624,46 +624,30 @@ const injectedConfigMacro = ava_1.default.macro({
 });
 const NEW_ANALYSIS_SUMMARY_TEST_CASES = [
     {
+        featureEnabled: true,
         codeqlVersion: "2.15.0",
-        githubVersion: {
-            type: util.GitHubVariant.DOTCOM,
-        },
         flagPassed: true,
         negativeFlagPassed: false,
     },
     {
+        featureEnabled: false,
         codeqlVersion: "2.15.0",
-        githubVersion: {
-            type: util.GitHubVariant.GHES,
-            version: "3.9.0",
-        },
-        flagPassed: true,
-        negativeFlagPassed: false,
-    },
-    {
-        codeqlVersion: "2.15.0",
-        githubVersion: {
-            type: util.GitHubVariant.GHES,
-            version: "3.8.6",
-        },
         flagPassed: false,
         negativeFlagPassed: true,
     },
     {
+        featureEnabled: false,
         codeqlVersion: "2.14.6",
-        githubVersion: {
-            type: util.GitHubVariant.DOTCOM,
-        },
         flagPassed: false,
         negativeFlagPassed: false,
     },
 ];
-for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
+for (const { featureEnabled, codeqlVersion, flagPassed, negativeFlagPassed, } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
     (0, ava_1.default)(`database interpret-results passes ${flagPassed
         ? "--new-analysis-summary"
         : negativeFlagPassed
             ? "--no-new-analysis-summary"
-            : "nothing"} for CodeQL CLI v${codeqlVersion} and ${util.GitHubVariant[githubVersion.type]} ${githubVersion.version ? ` ${githubVersion.version}` : ""}`, async (t) => {
+            : "nothing"} for CodeQL CLI v${codeqlVersion} when the new analysis summary feature is ${featureEnabled ? "enabled" : "disabled"}`, async (t) => {
         const runnerConstructorStub = stubToolRunnerConstructor();
         const codeqlObject = await codeql.getCodeQLForTesting();
         sinon
@@ -671,7 +655,7 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
             .resolves((0, testing_utils_1.makeVersionInfo)(codeqlVersion));
         // safeWhich throws because of the test CodeQL object.
         sinon.stub(safeWhich, "safeWhich").resolves("");
-        await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", Object.assign({}, stubConfig, { gitHubVersion: githubVersion }), (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", stubConfig, (0, testing_utils_1.createFeatures)(featureEnabled ? [feature_flags_1.Feature.AnalysisSummaryV2Enabled] : []), (0, logging_1.getRunnerLogger)(true));
         t.is(runnerConstructorStub.firstCall.args[1].includes("--new-analysis-summary"), flagPassed, `--new-analysis-summary should${flagPassed ? "" : "n't"} be passed`);
         t.is(runnerConstructorStub.firstCall.args[1].includes("--no-new-analysis-summary"), negativeFlagPassed, `--no-new-analysis-summary should${negativeFlagPassed ? "" : "n't"} be passed`);
     });

lib/feature-flags.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.logCodeScanningConfigInCli = exports.useCodeScanningConfigInCli = exports.Features = exports.FEATURE_FLAGS_FILE_NAME = exports.featureConfig = exports.Feature = exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = void 0;
+exports.logCodeScanningConfigInCli = exports.useCodeScanningConfigInCli = exports.Features = exports.FEATURE_FLAGS_FILE_NAME = exports.featureConfig = exports.Feature = exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = exports.CODEQL_VERSION_INTRA_LAYER_PARALLELISM = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const semver = __importStar(require("semver"));
@@ -37,10 +37,18 @@ const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
  */
 exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = "2.13.4";
 /**
- * Evaluator fine-grained parallelism (aka intra-layer parallelism) is only safe to enable in 2.15.1 onwards.
- * (Some earlier versions recognize the command-line flag, but they contain a bug which makes it unsafe to use).
+ * Versions 2.14.0+ of the CodeQL CLI support intra-layer parallelism (aka fine-grained parallelism) options, but we
+ * limit to 2.14.6 onwards, since that's the version that has mitigations against OOM failures.
  */
-exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM = "2.15.1";
+exports.CODEQL_VERSION_INTRA_LAYER_PARALLELISM = "2.14.6";
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
+ */
+exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
+ */
+exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
 /**
  * Feature enablement as returned by the GitHub API endpoint.
  *
@@ -48,16 +56,24 @@ exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM = "2.15.1";
  */
 var Feature;
 (function (Feature) {
+    Feature["AnalysisSummaryV2Enabled"] = "analysis_summary_v2_enabled";
     Feature["CliConfigFileEnabled"] = "cli_config_file_enabled";
     Feature["CodeqlJavaLombokEnabled"] = "codeql_java_lombok_enabled";
     Feature["CppDependencyInstallation"] = "cpp_dependency_installation_enabled";
     Feature["DisableKotlinAnalysisEnabled"] = "disable_kotlin_analysis_enabled";
     Feature["DisablePythonDependencyInstallationEnabled"] = "disable_python_dependency_installation_enabled";
-    Feature["EvaluatorFineGrainedParallelismEnabled"] = "evaluator_fine_grained_parallelism_enabled";
+    Feature["EvaluatorIntraLayerParallelismEnabled"] = "evaluator_intra_layer_parallelism_enabled";
     Feature["ExportDiagnosticsEnabled"] = "export_diagnostics_enabled";
     Feature["QaTelemetryEnabled"] = "qa_telemetry_enabled";
+    Feature["SublanguageFileCoverageEnabled"] = "sublanguage_file_coverage_enabled";
+    Feature["UploadFailedSarifEnabled"] = "upload_failed_sarif_enabled";
 })(Feature || (exports.Feature = Feature = {}));
 exports.featureConfig = {
+    [Feature.AnalysisSummaryV2Enabled]: {
+        envVar: "CODEQL_ACTION_ANALYSIS_SUMMARY_V2",
+        minimumVersion: exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
+        defaultValue: false,
+    },
     [Feature.CodeqlJavaLombokEnabled]: {
         envVar: "CODEQL_JAVA_LOMBOK",
         minimumVersion: "2.14.0",
@@ -78,9 +94,9 @@ exports.featureConfig = {
         minimumVersion: "2.11.6",
         defaultValue: true,
     },
-    [Feature.EvaluatorFineGrainedParallelismEnabled]: {
-        envVar: "CODEQL_EVALUATOR_FINE_GRAINED_PARALLELISM",
-        minimumVersion: exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
+    [Feature.EvaluatorIntraLayerParallelismEnabled]: {
+        envVar: "CODEQL_EVALUATOR_INTRA_LAYER_PARALLELISM",
+        minimumVersion: exports.CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
         defaultValue: false,
     },
     [Feature.ExportDiagnosticsEnabled]: {
@@ -93,6 +109,16 @@ exports.featureConfig = {
         minimumVersion: undefined,
         defaultValue: false,
     },
+    [Feature.SublanguageFileCoverageEnabled]: {
+        envVar: "CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE",
+        minimumVersion: exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
+        defaultValue: false,
+    },
+    [Feature.UploadFailedSarifEnabled]: {
+        envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
+        minimumVersion: "2.11.3",
+        defaultValue: true,
+    },
     [Feature.DisablePythonDependencyInstallationEnabled]: {
         envVar: "CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION",
         // Although the python extractor only started supporting not extracting installed

lib/init-action-post-helper.js

@@ -49,8 +49,8 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
         return { upload_failed_run_skipped_because: "CodeQL command not found" };
     }
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-    if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_EXPORT_FAILED_SARIF))) {
-        return { upload_failed_run_skipped_because: "Unsupported by CodeQL CLI" };
+    if (!(await features.getValue(feature_flags_1.Feature.UploadFailedSarifEnabled, codeql))) {
+        return { upload_failed_run_skipped_because: "Feature disabled" };
     }
     const workflow = await (0, workflow_1.getWorkflow)(logger);
     const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");

lib/init-action-post-helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAyE;AACzE,iDAAmD;AACnD,+CAAuC;AACvC,mDAA6D;AAG7D,wDAA0C;AAC1C,iCAMgB;AAChB,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,6BAA6B,EAAE,YAAY,CAAC,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,2CAAkC,CAAC,CAAC,EAAE;QAC3E,OAAO,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAC;KAC3E;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAClC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CACzC;QACD,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IAEvC,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,kFAAkF;IAClF,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EACpE;QACA,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC7D;SAAM;QACL,8EAA8E;QAC9E,MAAM,MAAM,CAAC,yBAAyB,CACpC,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;KACH;IAED,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAC3C,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,YAAY,EAAE,YAAY,IAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,iCAAiC,CAAC,KAAK,MAAM,EAAE;QACpE,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,KAAK,GAAG,CACzC,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAtDD,kBAsDC"}
+{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAqC;AACrC,iDAAmD;AACnD,+CAAuC;AACvC,mDAA6D;AAG7D,wDAA0C;AAC1C,iCAKgB;AAChB,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,6BAA6B,EAAE,YAAY,CAAC,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EAAE;QACxE,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,CAAC;KAClE;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAClC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CACzC;QACD,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IAEvC,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,kFAAkF;IAClF,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EACpE;QACA,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC7D;SAAM;QACL,8EAA8E;QAC9E,MAAM,MAAM,CAAC,yBAAyB,CACpC,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;KACH;IAED,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAC3C,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,YAAY,EAAE,YAAY,IAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,iCAAiC,CAAC,KAAK,MAAM,EAAE;QACpE,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,KAAK,GAAG,CACzC,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAtDD,kBAsDC"}

lib/init-action-post-helper.test.js

@@ -324,7 +324,6 @@ async function testFailedSarifUpload(t, actionsWorkflow, { category, databaseExi
         .returns(JSON.stringify(matrix));
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.12.0"));
     const databaseExportDiagnosticsStub = sinon.stub(codeqlObject, "databaseExportDiagnostics");
     const diagnosticsExportStub = sinon.stub(codeqlObject, "diagnosticsExport");
     sinon.stub(workflow, "getWorkflow").resolves(actionsWorkflow);
@@ -334,7 +333,7 @@ async function testFailedSarifUpload(t, actionsWorkflow, { category, databaseExi
         statusReport: { raw_upload_size_bytes: 20, zipped_upload_size_bytes: 10 },
     });
     const waitForProcessing = sinon.stub(uploadLib, "waitForProcessing");
-    const features = [];
+    const features = [feature_flags_1.Feature.UploadFailedSarifEnabled];
     if (exportDiagnosticsEnabled) {
         features.push(feature_flags_1.Feature.ExportDiagnosticsEnabled);
     }

lib/init-action.js

@@ -132,11 +132,7 @@ async function run() {
         toolsDownloadDurationMs = initCodeQLResult.toolsDownloadDurationMs;
         toolsVersion = initCodeQLResult.toolsVersion;
         toolsSource = initCodeQLResult.toolsSource;
-        core.startGroup("Validating workflow");
-        if ((await (0, workflow_1.validateWorkflow)(codeql, logger)) === undefined) {
-            logger.info("Detected no issues with the code scanning workflow.");
-        }
-        core.endGroup();
+        await (0, workflow_1.validateWorkflow)(codeql, logger);
         config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), registriesInput, (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), (0, actions_util_1.getOptionalInput)("config"), getTrapCachingEnabled(), 
         // Debug mode is enabled if:
         // - The `init` Action is passed `debug: true`.

pr-checks/sync.py

@@ -1,8 +1,6 @@
-#!/usr/bin/env python
-
 import ruamel.yaml
 from ruamel.yaml.scalarstring import FoldedScalarString
-import pathlib
+import os
 import textwrap
 
 # The default set of CodeQL Bundle versions to use for the PR checks.
@@ -49,11 +47,9 @@ def writeHeader(checkStream):
 yaml = ruamel.yaml.YAML()
 yaml.Representer = NonAliasingRTRepresenter
 
-this_dir = pathlib.Path(__file__).resolve().parent
-
 allJobs = {}
-for file in (this_dir / 'checks').glob('*.yml'):
-    with open(file, 'r') as checkStream:
+for file in os.listdir('checks'):
+    with open(f"checks/{file}", 'r') as checkStream:
         checkSpecification = yaml.load(checkStream)
 
     matrix = []
@@ -130,9 +126,9 @@ for file in (this_dir / 'checks').glob('*.yml'):
     checkJob['env'] = checkJob.get('env', {})
     if 'CODEQL_ACTION_TEST_MODE' not in checkJob['env']:
         checkJob['env']['CODEQL_ACTION_TEST_MODE'] = True
-    checkName = file.stem
+    checkName = file[:len(file) - 4]
 
-    with open(this_dir.parent / ".github" / "workflows" / f"__{checkName}.yml", 'w') as output_stream:
+    with open(f"../.github/workflows/__{checkName}.yml", 'w') as output_stream:
         writeHeader(output_stream)
         yaml.dump({
             'name': f"PR Check - {checkSpecification['name']}",

src/analyze.ts

@@ -7,11 +7,7 @@ import del from "del";
 import * as yaml from "js-yaml";
 
 import * as analysisPaths from "./analysis-paths";
-import {
-  CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
-  CodeQL,
-  getCodeQL,
-} from "./codeql";
+import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import {
   FeatureEnablement,
@@ -393,10 +389,7 @@ export async function runQueries(
       }
 
       if (
-        !(await util.codeQlVersionAbove(
-          codeql,
-          CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
-        ))
+        !(await features.getValue(Feature.AnalysisSummaryV2Enabled, codeql))
       ) {
         await runPrintLinesOfCode(language);
       }

src/codeql.test.ts

@@ -1005,45 +1005,29 @@ test("databaseInterpretResults() does not set --sarif-add-baseline-file-info for
 
 const NEW_ANALYSIS_SUMMARY_TEST_CASES = [
   {
+    featureEnabled: true,
     codeqlVersion: "2.15.0",
-    githubVersion: {
-      type: util.GitHubVariant.DOTCOM,
-    },
     flagPassed: true,
     negativeFlagPassed: false,
   },
   {
+    featureEnabled: false,
     codeqlVersion: "2.15.0",
-    githubVersion: {
-      type: util.GitHubVariant.GHES,
-      version: "3.9.0",
-    },
-    flagPassed: true,
-    negativeFlagPassed: false,
-  },
-  {
-    codeqlVersion: "2.15.0",
-    githubVersion: {
-      type: util.GitHubVariant.GHES,
-      version: "3.8.6",
-    },
     flagPassed: false,
     negativeFlagPassed: true,
   },
   {
+    featureEnabled: false,
     codeqlVersion: "2.14.6",
-    githubVersion: {
-      type: util.GitHubVariant.DOTCOM,
-    },
     flagPassed: false,
     negativeFlagPassed: false,
   },
 ];
 
 for (const {
+  featureEnabled,
   codeqlVersion,
   flagPassed,
-  githubVersion,
   negativeFlagPassed,
 } of NEW_ANALYSIS_SUMMARY_TEST_CASES) {
   test(`database interpret-results passes ${
@@ -1052,9 +1036,9 @@ for (const {
       : negativeFlagPassed
       ? "--no-new-analysis-summary"
       : "nothing"
-  } for CodeQL CLI v${codeqlVersion} and ${
-    util.GitHubVariant[githubVersion.type]
-  } ${githubVersion.version ? ` ${githubVersion.version}` : ""}`, async (t) => {
+  } for CodeQL CLI v${codeqlVersion} when the new analysis summary feature is ${
+    featureEnabled ? "enabled" : "disabled"
+  }`, async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon
@@ -1070,8 +1054,8 @@ for (const {
       "",
       "-v",
       "",
-      Object.assign({}, stubConfig, { gitHubVersion: githubVersion }),
-      createFeatures([]),
+      stubConfig,
+      createFeatures(featureEnabled ? [Feature.AnalysisSummaryV2Enabled] : []),
       getRunnerLogger(true),
     );
     t.is(

src/codeql.ts

@@ -4,7 +4,6 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as yaml from "js-yaml";
-import * as semver from "semver";
 
 import {
   getActionVersion,
@@ -15,11 +14,13 @@ import * as api from "./api-client";
 import type { Config } from "./config-utils";
 import { EnvVar } from "./environment";
 import {
-  CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
+  CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
+  CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
   CodeQLDefaultVersionInfo,
   Feature,
   FeatureEnablement,
   useCodeScanningConfigInCli,
+  CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
 } from "./feature-flags";
 import { isTracedLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -316,12 +317,6 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2023-09-12";
  * flag is older than the oldest supported version above, it may be removed.
  */
 
-/**
- * Versions 2.11.3+ of the CodeQL CLI support exporting a failed SARIF file via
- * `codeql database export-diagnostics` or `codeql diagnostics export`.
- */
-export const CODEQL_VERSION_EXPORT_FAILED_SARIF = "2.11.3";
-
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 
 /**
@@ -367,16 +362,6 @@ export const CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = "2.14.2";
  */
 export const CODEQL_VERSION_LANGUAGE_ALIASING = "2.14.4";
 
-/**
- * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
- */
-export const CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
-
-/**
- * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
- */
-export const CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
-
 /**
  * Set up CodeQL CLI access.
  *
@@ -630,7 +615,9 @@ export async function getCodeQLForCmd(
         extraArgs.push("--calculate-language-specific-baseline");
       }
 
-      if (await isSublanguageFileCoverageEnabled(config, this)) {
+      if (
+        await features.getValue(Feature.SublanguageFileCoverageEnabled, this)
+      ) {
         extraArgs.push("--sublanguage-file-coverage");
       } else if (
         await util.codeQlVersionAbove(
@@ -858,7 +845,7 @@ export async function getCodeQLForCmd(
       }
       if (
         await features.getValue(
-          Feature.EvaluatorFineGrainedParallelismEnabled,
+          Feature.EvaluatorIntraLayerParallelismEnabled,
           this,
         )
       ) {
@@ -866,7 +853,7 @@ export async function getCodeQLForCmd(
       } else if (
         await util.codeQlVersionAbove(
           this,
-          CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
+          CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
         )
       ) {
         codeqlArgs.push("--no-intra-layer-parallelism");
@@ -921,7 +908,9 @@ export async function getCodeQLForCmd(
       ) {
         codeqlArgs.push("--sarif-add-baseline-file-info");
       }
-      if (await isSublanguageFileCoverageEnabled(config, this)) {
+      if (
+        await features.getValue(Feature.SublanguageFileCoverageEnabled, this)
+      ) {
         codeqlArgs.push("--sublanguage-file-coverage");
       } else if (
         await util.codeQlVersionAbove(
@@ -936,16 +925,7 @@ export async function getCodeQLForCmd(
       } else if (await util.codeQlVersionAbove(this, "2.12.4")) {
         codeqlArgs.push("--no-sarif-include-diagnostics");
       }
-      if (
-        // Analysis summary v2 links to the status page, so check the GHES version we're running on
-        // supports the status page.
-        (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
-          semver.gte(config.gitHubVersion.version, "3.9.0")) &&
-        (await util.codeQlVersionAbove(
-          this,
-          CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
-        ))
-      ) {
+      if (await features.getValue(Feature.AnalysisSummaryV2Enabled, this)) {
         codeqlArgs.push("--new-analysis-summary");
       } else if (
         await util.codeQlVersionAbove(this, CODEQL_VERSION_ANALYSIS_SUMMARY_V2)
@@ -1515,18 +1495,3 @@ async function getLanguageAliasingArguments(codeql: CodeQL): Promise<string[]> {
   }
   return [];
 }
-
-async function isSublanguageFileCoverageEnabled(
-  config: Config,
-  codeql: CodeQL,
-) {
-  return (
-    // Sub-language file coverage is first supported in GHES 3.12.
-    (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
-      semver.gte(config.gitHubVersion.version, "3.12.0")) &&
-    (await util.codeQlVersionAbove(
-      codeql,
-      CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
-    ))
-  );
-}

src/feature-flags.ts

@@ -19,10 +19,20 @@ const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
 export const CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = "2.13.4";
 
 /**
- * Evaluator fine-grained parallelism (aka intra-layer parallelism) is only safe to enable in 2.15.1 onwards.
- * (Some earlier versions recognize the command-line flag, but they contain a bug which makes it unsafe to use).
+ * Versions 2.14.0+ of the CodeQL CLI support intra-layer parallelism (aka fine-grained parallelism) options, but we
+ * limit to 2.14.6 onwards, since that's the version that has mitigations against OOM failures.
  */
-export const CODEQL_VERSION_FINE_GRAINED_PARALLELISM = "2.15.1";
+export const CODEQL_VERSION_INTRA_LAYER_PARALLELISM = "2.14.6";
+
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support new analysis summaries.
+ */
+export const CODEQL_VERSION_ANALYSIS_SUMMARY_V2 = "2.15.0";
+
+/**
+ * Versions 2.15.0+ of the CodeQL CLI support sub-language file coverage information.
+ */
+export const CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE = "2.15.0";
 
 export interface CodeQLDefaultVersionInfo {
   cliVersion: string;
@@ -44,20 +54,28 @@ export interface FeatureEnablement {
  * Each value of this enum should end with `_enabled`.
  */
 export enum Feature {
+  AnalysisSummaryV2Enabled = "analysis_summary_v2_enabled",
   CliConfigFileEnabled = "cli_config_file_enabled",
   CodeqlJavaLombokEnabled = "codeql_java_lombok_enabled",
   CppDependencyInstallation = "cpp_dependency_installation_enabled",
   DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
   DisablePythonDependencyInstallationEnabled = "disable_python_dependency_installation_enabled",
-  EvaluatorFineGrainedParallelismEnabled = "evaluator_fine_grained_parallelism_enabled",
+  EvaluatorIntraLayerParallelismEnabled = "evaluator_intra_layer_parallelism_enabled",
   ExportDiagnosticsEnabled = "export_diagnostics_enabled",
   QaTelemetryEnabled = "qa_telemetry_enabled",
+  SublanguageFileCoverageEnabled = "sublanguage_file_coverage_enabled",
+  UploadFailedSarifEnabled = "upload_failed_sarif_enabled",
 }
 
 export const featureConfig: Record<
   Feature,
   { envVar: string; minimumVersion: string | undefined; defaultValue: boolean }
 > = {
+  [Feature.AnalysisSummaryV2Enabled]: {
+    envVar: "CODEQL_ACTION_ANALYSIS_SUMMARY_V2",
+    minimumVersion: CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
+    defaultValue: false,
+  },
   [Feature.CodeqlJavaLombokEnabled]: {
     envVar: "CODEQL_JAVA_LOMBOK",
     minimumVersion: "2.14.0",
@@ -78,9 +96,9 @@ export const featureConfig: Record<
     minimumVersion: "2.11.6",
     defaultValue: true,
   },
-  [Feature.EvaluatorFineGrainedParallelismEnabled]: {
-    envVar: "CODEQL_EVALUATOR_FINE_GRAINED_PARALLELISM",
-    minimumVersion: CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
+  [Feature.EvaluatorIntraLayerParallelismEnabled]: {
+    envVar: "CODEQL_EVALUATOR_INTRA_LAYER_PARALLELISM",
+    minimumVersion: CODEQL_VERSION_INTRA_LAYER_PARALLELISM,
     defaultValue: false,
   },
   [Feature.ExportDiagnosticsEnabled]: {
@@ -93,6 +111,16 @@ export const featureConfig: Record<
     minimumVersion: undefined,
     defaultValue: false,
   },
+  [Feature.SublanguageFileCoverageEnabled]: {
+    envVar: "CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE",
+    minimumVersion: CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
+    defaultValue: false,
+  },
+  [Feature.UploadFailedSarifEnabled]: {
+    envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
+    minimumVersion: "2.11.3",
+    defaultValue: true,
+  },
   [Feature.DisablePythonDependencyInstallationEnabled]: {
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION",
     // Although the python extractor only started supporting not extracting installed

src/init-action-post-helper.test.ts

@@ -8,7 +8,7 @@ import { Feature } from "./feature-flags";
 import * as initActionPostHelper from "./init-action-post-helper";
 import { getRunnerLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
-import { createFeatures, makeVersionInfo, setupTests } from "./testing-utils";
+import { createFeatures, setupTests } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
 import * as util from "./util";
 import * as workflow from "./workflow";
@@ -362,7 +362,6 @@ async function testFailedSarifUpload(
 
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
-  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.12.0"));
   const databaseExportDiagnosticsStub = sinon.stub(
     codeqlObject,
     "databaseExportDiagnostics",
@@ -378,7 +377,7 @@ async function testFailedSarifUpload(
   } as uploadLib.UploadResult);
   const waitForProcessing = sinon.stub(uploadLib, "waitForProcessing");
 
-  const features = [] as Feature[];
+  const features = [Feature.UploadFailedSarifEnabled];
   if (exportDiagnosticsEnabled) {
     features.push(Feature.ExportDiagnosticsEnabled);
   }

src/init-action-post-helper.ts

@@ -1,7 +1,7 @@
 import * as core from "@actions/core";
 
 import * as actionsUtil from "./actions-util";
-import { CODEQL_VERSION_EXPORT_FAILED_SARIF, getCodeQL } from "./codeql";
+import { getCodeQL } from "./codeql";
 import { Config, getConfig } from "./config-utils";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
@@ -9,7 +9,6 @@ import { Logger } from "./logging";
 import { RepositoryNwo } from "./repository";
 import * as uploadLib from "./upload-lib";
 import {
-  codeQlVersionAbove,
   getRequiredEnvParam,
   isInTestMode,
   parseMatrixInput,
@@ -55,8 +54,8 @@ async function maybeUploadFailedSarif(
     return { upload_failed_run_skipped_because: "CodeQL command not found" };
   }
   const codeql = await getCodeQL(config.codeQLCmd);
-  if (!(await codeQlVersionAbove(codeql, CODEQL_VERSION_EXPORT_FAILED_SARIF))) {
-    return { upload_failed_run_skipped_because: "Unsupported by CodeQL CLI" };
+  if (!(await features.getValue(Feature.UploadFailedSarifEnabled, codeql))) {
+    return { upload_failed_run_skipped_because: "Feature disabled" };
   }
   const workflow = await getWorkflow(logger);
   const jobName = getRequiredEnvParam("GITHUB_JOB");

src/init-action.ts

@@ -255,11 +255,7 @@ async function run() {
     toolsVersion = initCodeQLResult.toolsVersion;
     toolsSource = initCodeQLResult.toolsSource;
 
-    core.startGroup("Validating workflow");
-    if ((await validateWorkflow(codeql, logger)) === undefined) {
-      logger.info("Detected no issues with the code scanning workflow.");
-    }
-    core.endGroup();
+    await validateWorkflow(codeql, logger);
 
     config = await initConfig(
       getOptionalInput("languages"),