Remove obsolete CodeQL setup diagnostics by henrymercer · Pull Request #4036 · github/codeql-action

henrymercer · 2026-07-22T12:03:20Z

Several CodeQL setup diagnostics were introduced to monitor rollouts that are now established, but they continue to add substantial SARIF and telemetry volume on every workflow run. Remove these obsolete diagnostics while preserving the setup behavior and the remaining download-duration status field.

This removes the Zstandard availability, bundle download, and Git version diagnostics and their unused payload plumbing. Operational Zstandard detection, bundle selection, streaming extraction, fallback behavior, Git discovery, and overlay compatibility checks remain unchanged. The redundant dedicated Zstandard PR check is removed; linked bundle selection is covered directly across Linux, macOS, Windows, and gzip fallback, while the existing toolcache check continues to exercise downloading and extraction.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: The removed code only emits telemetry, and the retained operational paths are covered by focused unit and end-to-end tests.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Unit tests - Focused setup, CodeQL download, and streaming extraction tests cover the retained behavior.
End-to-end tests - The bundle toolcache PR check continues to exercise linked bundle download, extraction, initialization, and analysis across Linux, macOS, and Windows.
Other - TypeScript build, targeted lint, workflow regeneration, and the relevant test suites pass locally.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Restore the diagnostics and removed plumbing in a follow-up release.

How will you know if something goes wrong after this change is released?

Telemetry - Existing setup status reporting, including download duration where available, remains in place.
Other - Bundle download, extraction, initialization, or analysis regressions surface as workflow failures and existing PR check failures.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change. No entry is needed because this only removes internal diagnostics.
Confirm the readme and docs have been updated if necessary. No documentation changes are needed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Removes obsolete setup diagnostics while preserving operational behavior and download-duration reporting.

Changes:

Removes Zstandard, bundle-download, and Git-version diagnostics.
Simplifies telemetry payload plumbing.
Adds focused bundle-selection and download tests; removes the redundant Zstandard check.

Show a summary per file

File	Description
`src/tools-download.ts`	Retains only download-duration status data.
`src/tools-download.test.ts`	Tests streamed and non-streamed reporting.
`src/setup-codeql.ts`	Removes Zstandard telemetry plumbing.
`src/setup-codeql.test.ts`	Expands cross-platform bundle-selection coverage.
`src/init.ts`	Removes Zstandard availability propagation.
`src/init-action.ts`	Stops emitting obsolete setup diagnostics.
`src/config-utils.ts`	Removes Git-version telemetry.
`src/codeql.ts`	Simplifies setup result propagation.
`src/codeql.test.ts`	Updates download-status assertions.
`pr-checks/checks/bundle-zstd.yml`	Removes the redundant Zstandard PR check.
`.github/workflows/__bundle-zstd.yml`	Generated, content-excluded workflow; not reviewed.
`lib/entry-points.js`	Generated, content-excluded JavaScript; not reviewed.

Review details

Files excluded by content exclusion policy (2)

.github/workflows/__bundle-zstd.yml
lib/entry-points.js

Files reviewed: 10/12 changed files
Comments generated: 0
Review effort level: Medium

mbg

Thanks! Removing these diagnostics makes sense and I am happy to approve this as-is.

I am wondering if it would still make sense for us to include some of this in our regular status reports? I have commented on the git version bit specifically, since that might be useful to understand long-term usage there.

mbg · 2026-07-22T13:48:15Z

-async function logGitVersionTelemetry(
-  config: Config,
-  gitVersion: GitVersionInfo,
-): Promise<void> {
-  if (config.languages.length > 0) {
-    addNoLanguageDiagnostic(
-      config,
-      makeTelemetryDiagnostic(
-        "codeql-action/git-version-telemetry",
-        "Git version telemetry",
-        {
-          fullVersion: gitVersion.fullVersion,
-          truncatedVersion: gitVersion.truncatedVersion,
-        },
-      ),
-    );
-  }
-}


Rather than removing this entirely, would it make sense to include this in ordinary status reports?

I don't think we have a need for it today, and it's easy to re-add. So I suggest we only add it when needed. Most repos scan frequently enough that we'll get good data after only a week.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Review details

Files excluded by content exclusion policy (2)

.github/workflows/__bundle-zstd.yml
lib/entry-points.js

Files reviewed: 11/13 changed files
Comments generated: 1
Review effort level: Medium

henrymercer and others added 7 commits July 20, 2026 17:57

Remove Zstandard availability diagnostic

d57cc91

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove bundle download diagnostic

3f208c9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove Git version diagnostic

14e8bf9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Format CodeQL initialization

1040e2a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove unused bundle download fields

3c20a74

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Preserve bundle compression coverage

f342ca9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Strengthen download status report tests

90ea144

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

henrymercer requested a review from Copilot July 22, 2026 12:03

Copilot started reviewing on behalf of henrymercer July 22, 2026 12:04 View session

github-actions Bot added the size/XL May be very hard to review label Jul 22, 2026

Copilot AI reviewed Jul 22, 2026

View reviewed changes

henrymercer marked this pull request as ready for review July 22, 2026 13:00

henrymercer requested a review from a team as a code owner July 22, 2026 13:00

mbg previously approved these changes Jul 22, 2026

View reviewed changes

Exclude Copilot review from required checks

60339ed

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 22, 2026 14:45

henrymercer dismissed mbg’s stale review via 60339ed July 22, 2026 14:45

Copilot started reviewing on behalf of henrymercer July 22, 2026 14:45 View session

henrymercer requested a review from mbg July 22, 2026 14:45

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread pr-checks/excluded.yml

mbg approved these changes Jul 22, 2026

View reviewed changes

henrymercer added this pull request to the merge queue Jul 22, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Remove obsolete CodeQL setup diagnostics#4036

Remove obsolete CodeQL setup diagnostics#4036
henrymercer wants to merge 8 commits into
mainfrom
henrymercer/remove-legacy-diagnostics

henrymercer commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mbg left a comment

Uh oh!

mbg Jul 22, 2026

Uh oh!

henrymercer Jul 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

henrymercer commented Jul 22, 2026

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

mbg Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

henrymercer Jul 22, 2026 •

edited

Loading