Select CodeQL bundles from a release

[henrymercer]

Add codeql-release.ts, which selects a CodeQL bundle from a GitHub release, and use it for the default bundle and the latest nightly. This is preparation for accepting GitHub release URLs in the tools input in a follow-up PR.

getRelease looks up a release with one API request and uses its API asset URLs, so it works for private repositories. getPublicRelease constructs /releases/download/ URLs without an API request, so a missing asset shows up as a 404 when downloading. selectBundle tries the compression methods we can extract in order of preference and requires a combined bundle.

A job can use a per-language bundle if the per_language_bundles feature flag is enabled, the languages input lists exactly one language, the job runs on github.com using a GitHub-hosted runner, and tar supports zstd. A per-language bundle must also be published for that language and platform, and the CLI must be version 2.27.1 or newer, unless we're using the latest nightly. These are the existing rules in getPerLanguageBundleLanguage. When a job can use a per-language bundle, selectBundle only selects it if the release also has a combined bundle with the same compression, which it keeps for the existing download-time fallback. The restriction to the same compression method exists to avoid the need to track varying compression methods between the initial attempt and the fallback, and for the standard releases we publish, it should be dead code.

getCodeQLBundleDownloadURL becomes selectDefaultBundle, which tries the same sources in the same order: this Action's repository on this instance, github/codeql-action on this instance, then the public release on github.com. It moves on to the next source if a release can't be found or has no compatible bundle. The nightly path now uses the tarSupportsZstd value from getCodeQLSource rather than checking tar again.

This changes the default path when we look up a release, which we do unless we're running the canonical Action on github.com:

• When the job can use a per-language bundle, we find it and the combined bundle we'd fall back to with one release lookup, rather than one lookup each.
• If the job can use a per-language bundle but the release doesn't have it, we use the release's combined bundle, with the same warning and fallback telemetry as when a per-language download returns 404. Previously we fetched the per-language bundle from the next repository.
• If the release lacks the preferred compression method, we use the other compression method from the same release. Previously we moved on to the next repository.

Otherwise, tools inputs behave as before, and on github.com with the canonical Action the default path still makes no API requests.

This also renames logPerLanguageBundleFallback to logMissingPerLanguageBundle and rewords its warning to say that we expected a per-language bundle, following up on this review comment on #4167.

Commit-by-commit review recommended as the behaviour changes to bundle selection are all in the last commit.

Risk assessment

Low risk: On github.com with the canonical Action, we select the same bundles as before, and PR checks cover this. Elsewhere, the selected bundle only changes when a release we look up lacks the preferred bundle. Per-language bundles are still behind the per_language_bundles feature flag.

Which use cases does this change impact?

Workflow types:

• Advanced setup
• Managed

Products:

• Code Scanning
• Code Quality
• Other first-party - Analyses using the shared CodeQL setup path.

Environments:

• Dotcom
• GHES

How did/will you validate this change?

• Unit tests - New tests for codeql-release.ts. The setup-codeql.ts tests now expect one request per release, and gain cases for a fork release that lacks the per-language bundle, and for moving on to the public release when the fork's release has no compatible bundle or can't be found. The unit tests and lint pass locally at each commit.
• End-to-end tests - PR checks exercise the default path on github.com and the nightly path, including per-language bundle selection from the latest nightly. They don't cover looking up a release, so that path relies on the unit tests. These still need to run for this PR.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Rollback - Revert or release a fix. Bundle selection is not behind a feature flag.

How will you know if something goes wrong after this change is released?

• Telemetry - Existing telemetry for tools downloads and initialization failures, including tools_per_language_bundle_fallback, which now also covers releases that lack the per-language bundle.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Copilot review overview

🟡 Changes recommended

Release tags containing slashes are encoded incorrectly, producing potentially invalid release and download URLs.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Encode complete tag names to preserve slashes in GitHub URLs · New

What changed in this PR

Adds release-aware CodeQL bundle selection, including private releases, compression fallback, and per-language bundles.

Changes:

• Adds release lookup and bundle selection utilities.
• Integrates selection and fallback telemetry into setup.
• Expands tests and updates fallback messaging.

File	Description
src/​codeql-release.ts	Implements release and bundle selection.
src/​codeql-release.test.ts	Tests release selection behavior.
src/​setup-codeql.ts	Integrates the new selector.
src/​setup-codeql.test.ts	Updates integration and fallback tests.
src/​per-language-bundles.ts	Renames and rewords fallback logging.
src/​codeql-bundle.ts	Adds fallback state to download sources.
lib/​entry-points.js	Generated output; excluded from review.

Files excluded by content exclusion policy (1)

• lib/entry-points.js

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.