Add `csra` analysis kind by mbg · Pull Request #3474 · github/codeql-action · GitHub

First stab at adding this new analysis kind. See the linked internal issues for more details. The new analysis kind largely mirrors code-scanning.

We do not plan this in combination with other analysis kinds, so I added some logic to prevent that.

The SARIF upload for this analysis kind is a bit different than the other two, so I added a transformPayload function to the AnalysisConfig interface that can change what's included in the payload. I preferred that over having a conditional block near the upload, since that's harder to see and less reusable.

I extended the existing tests for this new analysis kind.

Notes for reviewers

This is ready for an initial review to examine the high-level approach here. There's almost certainly room for polishing this and adding some more tests.

Best reviewed commit-by-commit.

Risk assessment

For internal use only. Please select the risk level of this change:

High risk: Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

Which use cases does this change impact?

This change should not directly impact any of the below, but it may indirectly as a result of changes to code paths that are also hit by those.

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, CCR, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
CCR - The changes impact analyses for Copilot Code Reviews.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

Special considerations - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

Adds a new csra analysis kind to the CodeQL Action, intended to largely mirror code-scanning while uploading SARIF to a different endpoint with a different payload shape. The change introduces analysis-kind compatibility enforcement and extends unit + PR-check coverage to include the new kind.

Changes:

Add AnalysisKind.CSRA plus a compatibility matrix that prevents unsupported combinations.
Introduce typed upload payload shapes and an AnalysisConfig.transformPayload hook to support analysis-specific upload payloads (CSRA adds assessment_id).
Extend unit tests and PR-checks to cover csra SARIF naming/grouping and matrix validation.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/upload-lib/types.ts	Introduces typed payload interfaces (BasePayload, UploadPayload, AssessmentPayload).
src/upload-lib.ts	Uses typed payloads; routes upload payload through transformPayload prior to request.
src/upload-lib.test.ts	Updates SARIF grouping tests to account for all analysis kinds; updates upload payload fixtures typing.
src/config-utils.ts	Updates “primary analysis config” selection to handle single-kind configs (incl. CSRA) via getAnalysisConfig.
src/config-utils.test.ts	Adds tests for getPrimaryAnalysisConfig with single kind and CS+CQ special-case.
src/analyze.ts	Simplifies category computation by always using analysis.fixCategory(...).
src/analyze.test.ts	Extends SARIF extension tests to include .csra.sarif.
src/analyses.ts	Adds csra kind, endpoint, payload transform, compatibility matrix, and SARIF scan order updates.
src/analyses.test.ts	Adds compatibility-matrix-driven tests and verifies Code Scanning predicate rejects other extensions.
pr-checks/checks/analysis-kinds.yml	Expands PR-check matrix to include csra and sets required env for assessment id; updates artifact handling.
.github/workflows/__analysis-kinds.yml	Generated workflow updated to match pr-checks definition (auto-generated).
lib/upload-sarif-action.js	Generated JS output (not reviewed).
lib/upload-sarif-action-post.js	Generated JS output (not reviewed).
lib/upload-lib.js	Generated JS output (not reviewed).
lib/start-proxy-action.js	Generated JS output (not reviewed).
lib/start-proxy-action-post.js	Generated JS output (not reviewed).
lib/setup-codeql-action.js	Generated JS output (not reviewed).
lib/resolve-environment-action.js	Generated JS output (not reviewed).
lib/init-action.js	Generated JS output (not reviewed).
lib/init-action-post.js	Generated JS output (not reviewed).
lib/autobuild-action.js	Generated JS output (not reviewed).
lib/analyze-action.js	Generated JS output (not reviewed).
lib/analyze-action-post.js	Generated JS output (not reviewed).

uploadPostProcessedFiles now routes the payload through uploadTarget.transformPayload(...) before calling uploadPayload, and CSRA relies on this to change the request shape. There isn’t a unit test asserting the transformed payload for CSRA (e.g., that assessment_id is included) or even that transformPayload is applied. Adding a focused test around this call site would help prevent regressions as more analysis kinds are added.

Re the risk assessment, I wonder whether it is worth us adding some explicit checks for upload-sarif that upload static SARIF files for each analysis and check the exact data that was sent to the API?

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/analyses.ts:1

transformPayload returning BasePayload is very permissive (it only guarantees sarif) and doesn’t encode analysis-specific required fields (e.g., CSRA requiring assessment_id). To make this safer for future edits, consider typing this as a discriminated union of allowed payloads (e.g., UploadPayload | AssessmentPayload) or making AnalysisConfig generic over its payload type (e.g., AnalysisConfig<TPayload extends BasePayload>), so CSRA can be declared as AnalysisConfig<AssessmentPayload> and callers keep type safety end-to-end.

import {

Overall looks good, just some minor comments. Thanks for improving the type safety of the upload paths.

Minor: is 0 OK?

I am not sure it matters too much. We don't expect this to ever be used other than with an automatically populated value, and the value is just passed back to the upload endpoint.

I'd suggest we leave it like this for now and only tighten the constraints later if we have a requirement for it.

Should this replace the implementation in getRecordingLogger?

Eventually perhaps, but adding this was already a tangential change in this PR since I wanted a way to track the log groups. I'll update the tests to use this new implementation in a follow-up PR as a low priority.

Technically this will truncate floats, but I think that's fine in practice.

Similar as with #3474 (comment), I don't think this is a practical concern for now.

mbg added 5 commits February 11, 2026 19:48

Add csra analysis kind

9267d8d

Enforce that only compatible kinds can be enabled concurrently

5b3261b

Fix CodeScanning config's sarifPredicate and add test

5132eb5

Update upload-lib tests for CSRA

406bbfc

Remove redundant analysis kind check

8cc4d25

mbg self-assigned this Feb 11, 2026

github-actions Bot added the size/M Should be of average difficulty to review label Feb 11, 2026

mbg added 2 commits February 11, 2026 22:46

Update getPrimaryAnalysis* and add test

6a17f4e

Update PR check for csra

2de76b6

mbg force-pushed the mbg/risk-assessment-analysis branch from deac236 to 29847d7 Compare February 11, 2026 23:24

Add csra case to addSarifExtension test

db93462

mbg force-pushed the mbg/risk-assessment-analysis branch from 29847d7 to 40e87b6 Compare February 11, 2026 23:51

github-actions Bot added size/L May be hard to review and removed size/M Should be of average difficulty to review labels Feb 11, 2026

mbg added 3 commits February 11, 2026 23:56

Type the upload payload object

cbb92e7

Add transformPayload to AnalysisConfig

0cfcceb

Add assessment_id to CSRA payload

c48cd24

mbg force-pushed the mbg/risk-assessment-analysis branch from 40e87b6 to c48cd24 Compare February 11, 2026 23:56

mbg added 2 commits February 12, 2026 00:10

Change assessment_id to be a number

da67096

Add BasePayload type and derive AssessmentPayload from it

2adcb64

mbg marked this pull request as ready for review February 12, 2026 13:29

mbg requested a review from a team as a code owner February 12, 2026 13:29

Copilot AI review requested due to automatic review settings February 12, 2026 13:29

Copilot started reviewing on behalf of mbg February 12, 2026 13:30 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

henrymercer reviewed Feb 12, 2026

View reviewed changes

Comment thread pr-checks/checks/analysis-kinds.yml Outdated

Comment thread src/analyses.ts Outdated

Comment thread src/analyses.ts Outdated

Comment thread src/analyses.ts Outdated

mbg added 4 commits February 12, 2026 20:15

Validate CODEQL_ACTION_CSRA_ASSESSMENT_ID value

0ce6420

CSRA category does not need to be adjusted

9835994

Extend uploadPayload tests to all analysis kinds

15a3d32

Add RecordingLogger that keeps track of groups

edf3609

mbg added 3 commits February 12, 2026 23:22

Find all missing messages in checkExpectedLogMessages

e1933c6

Rename csra to risk-assessment

f315d82

Remove unnecessary check

d6ea670

mbg requested a review from Copilot February 17, 2026 10:59

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Comment thread src/testing-utils.ts

mbg requested a review from henrymercer February 17, 2026 11:17

henrymercer reviewed Feb 17, 2026

View reviewed changes

mbg added 3 commits February 17, 2026 14:40

Add JSDoc comments to upload-lib types

5c96b6e

Reword error message

6d55dff

Replace most occurrences of CSRA

2abec3f

mbg requested a review from henrymercer February 17, 2026 14:56

henrymercer approved these changes Feb 17, 2026

View reviewed changes

mbg merged commit b1b1e44 into main Feb 17, 2026
253 checks passed

mbg deleted the mbg/risk-assessment-analysis branch February 17, 2026 15:39

This was referenced Feb 20, 2026

Merge main into releases/v4 #3494

Merged

Merge releases/v4 into releases/v3 #3496

Merged

+                const payload = uploadTarget.transformPayload(
+                  buildPayload(
+                    await gitUtils.getCommitOid(checkoutPath),
+                    await gitUtils.getRef(),
+                    postProcessingResults.analysisKey,
+                    util.getRequiredEnvParam("GITHUB_WORKFLOW"),
+                    zippedSarif,
+                    actionsUtil.getWorkflowRunID(),
+                    actionsUtil.getWorkflowRunAttempt(),
+                    checkoutURI,
+                    postProcessingResults.environment,
+                    toolNames,
+                    await gitUtils.determineBaseBranchHeadCommitOid(),
+                  ),
                 );

+               */
+              function addAssessmentId(payload: UploadPayload): AssessmentPayload {
+                const rawAssessmentId = getRequiredEnvParam(EnvVar.CSRA_ASSESSMENT_ID);
+                const assessmentId = parseInt(rawAssessmentId, 10);

+                t.deepEqual(expected, payload);
+              });
+              test("CSRA configuration throws for negative assessment IDs", (t) => {

                 message: string | Error;
               }
+              export class RecordingLogger implements Logger {

Add `csra` analysis kind by mbg · Pull Request #3474 · github/codeql-action · GitHub

Uh oh!

Add csra analysis kind - #3474

Add csra analysis kind#3474mbg merged 23 commits intomaingithub/codeql-action:mainfrom mbg/risk-assessment-analysisgithub/codeql-action:mbg/risk-assessment-analysisCopy head branch name to clipboard

Conversation

mbg commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henrymercer Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henrymercer Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henrymercer Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Add csra analysis kind#3474
mbg merged 23 commits into
mainfrom
mbg/risk-assessment-analysis

mbg commented Feb 11, 2026 •
edited
Loading