Include base database OIDs when bundling database by henrymercer · Pull Request #3404 · github/codeql-action · GitHub

Include the base database OIDs file when bundling the database since this file is required to compute the set of changed files and perform an overlay analysis.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, CCR, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

This pull request adds support for including the base database OIDs file when bundling databases, which is required for computing changed files and performing overlay analysis.

Changes:

Moved getBaseDatabaseOidsFilePath function from overlay-database-utils.ts to util.ts and made it exported to allow reuse across multiple modules
Added BundleSupportsIncludeOption feature flag to conditionally enable the new --include option for the codeql database bundle command
Extended the databaseBundle method signature to accept additional files to include in the bundle, with backward compatibility via feature flag checking

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/util.ts	Added constant for base database OIDs filename, exported getBaseDatabaseOidsFilePath function, and updated bundleDb to copy and include the base database OIDs file in the bundle
src/tools-features.ts	Added BundleSupportsIncludeOption feature flag enum value
src/overlay-database-utils.ts	Removed local getBaseDatabaseOidsFilePath function and imported it from util.ts
src/codeql.ts	Updated databaseBundle method signature to accept tryAlsoIncludeRelativePaths parameter and conditionally pass --include flags to the CLI
package-lock.json	Automated npm lock file updates adding peer dependency markers
lib/*.js	Auto-generated JavaScript files from TypeScript compilation

for reference: we also do this elsewhere

Just a few minor questions, otherwise this looks reasonable.

Does the name start with try because of the feature check? If so, we should probably just call this includeRelativePaths (or extraPathsToInclude).

We could do that, and perform the feature check in the caller. I don't have a strong opinion.

No, keep the feature check here. My point was that the feature check is essentially a FF check to stop us from trying to use a feature that is not yet supported by the CLI. Our expectation would be that eventually this will always happen. In general, we don't name things try[...] if they are only used if a FF is enabled that we eventually expect to always be true.

I think this comment could be improved: right now, it is not super obvious what the difference between databasePath here and config.dbLocation is, and why the file has to be copied from the latter to the former.

Thanks! The changes made in response to my comments look good 👍🏻

henrymercer added 4 commits January 9, 2026 18:50

Add tools feature for codeql database bundle --include

d6efb85

Include base database OIDs when bundling database

d32cd4d

Copy OIDs from DB cluster to individual DBs

79939d8

Merge branch 'main' into henrymercer/include-oids-in-bundle

75716ab

henrymercer requested a review from a team as a code owner January 19, 2026 18:14

Copilot AI review requested due to automatic review settings January 19, 2026 18:14

github-actions Bot added the size/S Should be easy to review label Jan 19, 2026

Copilot started reviewing on behalf of henrymercer January 19, 2026 18:15 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

esbena reviewed Jan 19, 2026

View reviewed changes

esbena previously approved these changes Jan 19, 2026

View reviewed changes

mbg previously approved these changes Jan 20, 2026

View reviewed changes

henrymercer added 2 commits January 20, 2026 13:39

Rename argument

5ac0476

Improve comment

b880a1a

henrymercer dismissed stale reviews from mbg and esbena via b880a1a January 20, 2026 13:45

henrymercer requested a review from mbg January 20, 2026 13:54

mbg approved these changes Jan 20, 2026

View reviewed changes

henrymercer enabled auto-merge January 20, 2026 14:06

henrymercer merged commit 93a99bf into main Jan 20, 2026
241 checks passed

henrymercer deleted the henrymercer/include-oids-in-bundle branch January 20, 2026 14:13

This was referenced Jan 23, 2026

Merge main into releases/v4 #3417

Merged

Merge releases/v4 into releases/v3 #3419

Merged

+                    baseDatabaseOidsFilePath,
+                    path.join(databasePath, BASE_DATABASE_OIDS_FILE_NAME),
+                  );
+                  additionalFiles.push(BASE_DATABASE_OIDS_FILE_NAME);

                   databasePath: string,
                   outputFilePath: string,
                   dbName: string,
+                  tryAlsoIncludeRelativePaths: string[],

Include base database OIDs when bundling database by henrymercer · Pull Request #3404 · github/codeql-action · GitHub

Uh oh!

Include base database OIDs when bundling database - #3404

Include base database OIDs when bundling database#3404
henrymercer merged 6 commits into
mainfrom
henrymercer/include-oids-in-bundle

henrymercer commented Jan 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

esbena Jan 19, 2026 •
edited by mbg
Loading

Uh oh!

Uh oh!

mbg left a comment

Uh oh!

mbg Jan 20, 2026

Uh oh!

henrymercer Jan 20, 2026

Uh oh!

mbg Jan 20, 2026

Uh oh!

Uh oh!

mbg Jan 20, 2026

Uh oh!

mbg left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

                   await fs.promises.rm(databaseBundlePath, { force: true });
                 }
-                await codeql.databaseBundle(databasePath, databaseBundlePath, dbName);
+                // Copy the base database OIDs file into the database location if it exists

Include base database OIDs when bundling database by henrymercer · Pull Request #3404 · github/codeql-action · GitHub

Uh oh!

Include base database OIDs when bundling database - #3404

Include base database OIDs when bundling database#3404henrymercer merged 6 commits intomaingithub/codeql-action:mainfrom henrymercer/include-oids-in-bundlegithub/codeql-action:henrymercer/include-oids-in-bundleCopy head branch name to clipboard

Conversation

henrymercer commented Jan 19, 2026

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

esbena Jan 19, 2026 • edited by mbg Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

mbg Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mbg Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Include base database OIDs when bundling database#3404
henrymercer merged 6 commits into
mainfrom
henrymercer/include-oids-in-bundle

esbena Jan 19, 2026 •
edited by mbg
Loading