Refactor offline bits out of `Features` class and use for CCR by mbg · Pull Request #3477 · github/codeql-action · GitHub

This PR accomplishes two things:

A refactoring of Features into OfflineFeatures and Features:
- OfflineFeatures implements the FeatureEnablement interface and handles all feature checking that does not involve the GitHub API.
- Features extends OfflineFeatures and combines the logic from OfflineFeatures with a GitHubFeatureFlags instance to query the GitHub API.
Abstracting over the concrete FeatureEnablement implementation with initFeatures:
- OfflineFeatures and Features are no longer exported and instead initFeatures must be used.
- By default, initFeatures instantiates a Features instance.
- For GHES and CCR, it instantiates an OfflineFeatures instance instead.

Risk assessment

For internal use only. Please select the risk level of this change:

High risk: Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, CCR, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
CCR - The changes impact analyses for Copilot Code Reviews.
Third-party analyses - The changes affect the upload-sarif action.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

This PR refactors feature-flag evaluation to support CCR by splitting feature checks into an offline-only implementation and an API-backed implementation, and updating actions/tests to initialize feature flags via a new initFeatures factory.

Changes:

Refactor Features into OfflineFeatures (local checks only) and Features (local + GitHub API), and introduce initFeatures to select the implementation at runtime (CCR vs non-CCR).
Update action entrypoints to call initFeatures instead of directly constructing Features, and type some usages against FeatureEnablement.
Add unit tests covering initFeatures selection behavior and update existing tests to use the factory.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/feature-flags.ts	Introduces OfflineFeatures, changes Features to extend it, and adds initFeatures factory for CCR-aware initialization.
src/upload-sarif-action.ts	Switches feature-flag initialization from new Features(...) to initFeatures(...).
src/start-proxy-action.ts	Switches to initFeatures(...) and types features as FeatureEnablement.
src/setup-codeql-action.ts	Switches feature-flag initialization to initFeatures(...).
src/init-action.ts	Switches to initFeatures(...) and types features as FeatureEnablement.
src/init-action-post.ts	Switches feature-flag initialization to initFeatures(...).
src/analyze-action.ts	Switches feature-flag initialization to initFeatures(...).
src/autobuild.ts	Switches feature-flag initialization to initFeatures(...) for the C++ autobuild feature check.
src/feature-flags.test.ts	Adds tests for initFeatures and updates setup helper to use the factory.
src/diff-informed-analysis-utils.test.ts	Updates test to construct features via initFeatures(...).
lib/upload-sarif-action.js	Generated JS updated to reflect TS refactor and new initFeatures.
lib/start-proxy-action.js	Generated JS updated to reflect TS refactor and new initFeatures.
lib/setup-codeql-action.js	Generated JS updated to reflect TS refactor and new initFeatures.
lib/init-action.js	Generated JS updated to reflect TS refactor and new initFeatures.
lib/init-action-post.js	Generated JS updated to reflect TS refactor and new initFeatures.
lib/autobuild-action.js	Generated JS updated to reflect TS refactor and new initFeatures.
lib/analyze-action.js	Generated JS updated to reflect TS refactor and new initFeatures.

…rrors" This reverts commit 9658e23, reversing changes made to 2d6b98c.

It doesn't need to be in there since it doesn't depend on the API itself and call `getDefaultCliVersionFromFlags` directly

…features

Only minor suggestions, otherwise looks good to me, so leaving the approval here

…features

With the big, CLI-attached release out of the way, I'll merge this now for the next release.

mbg requested a review from henrymercer February 12, 2026 18:07

mbg self-assigned this Feb 12, 2026

mbg requested a review from a team as a code owner February 12, 2026 18:07

Copilot AI review requested due to automatic review settings February 12, 2026 18:07

github-actions Bot added the size/M Should be of average difficulty to review label Feb 12, 2026

Copilot started reviewing on behalf of mbg February 12, 2026 18:08 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

Comment thread src/feature-flags.ts

Comment thread src/feature-flags.ts

mbg mentioned this pull request Feb 12, 2026

Avoid requesting features in CCR #3476

Merged

github-actions Bot added size/L May be hard to review and removed size/M Should be of average difficulty to review labels Feb 12, 2026

mbg force-pushed the mbg/features/offline-features branch 2 times, most recently from ff5f7af to 7c91acf Compare February 12, 2026 20:01

mbg added 12 commits February 15, 2026 15:39

Revert "Merge pull request #3476 from github/henrymercer/retry-auth-e…

ea1a400

…rrors" This reverts commit 9658e23, reversing changes made to 2d6b98c.

Move getDefaultCliVersion out of GitHubFeatureFlags

5283c3b

It doesn't need to be in there since it doesn't depend on the API itself and call `getDefaultCliVersionFromFlags` directly

Add OfflineFeatures class

368f322

Abstract over FeatureEnablement implementations with initFeatures

2c9bc45

Return OfflineFeatures for CCR

9dcfdf2

Move FF test utils out of main file

ee8360d

Add mockCCR helper to testing-utils

377300b

Add test to check that OfflineFeatures doesn't use the API client

bc76cea

Change FFs not supported log message

0874cf9

Log when using OfflineFeatures for CCR

60dee3d

Restore test improvements from previous PR

7af50a4

Use OfflineFeatures when !supportsFeatureFlags as well

db834c9

mbg force-pushed the mbg/features/offline-features branch from 7c91acf to db834c9 Compare February 15, 2026 16:04

Merge remote-tracking branch 'origin/main' into mbg/features/offline-…

ab25800

…features

oscarsj previously approved these changes Feb 17, 2026

View reviewed changes

Comment thread src/feature-flags.ts Outdated

Comment thread src/feature-flags.ts

mbg added 2 commits February 17, 2026 17:14

Merge remote-tracking branch 'origin/main' into mbg/features/offline-…

b927a69

…features

Fix typos in comments

09bd46d

mbg dismissed oscarsj’s stale review via 09bd46d February 17, 2026 17:19

oscarsj approved these changes Feb 17, 2026

View reviewed changes

mbg merged commit 559d85d into main Feb 20, 2026
259 of 260 checks passed

mbg deleted the mbg/features/offline-features branch February 20, 2026 15:36

This was referenced Feb 27, 2026

Merge main into releases/v4 #3523

Merged

Merge releases/v4 into releases/v3 #3533

Merged

Refactor offline bits out of `Features` class and use for CCR by mbg · Pull Request #3477 · github/codeql-action · GitHub

Uh oh!

Refactor offline bits out of Features class and use for CCR - #3477

Refactor offline bits out of Features class and use for CCR#3477
mbg merged 15 commits into
mainfrom
mbg/features/offline-features

mbg commented Feb 12, 2026 •
edited
Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

oscarsj left a comment

Uh oh!

Uh oh!

Uh oh!

mbg commented Feb 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Refactor offline bits out of `Features` class and use for CCR by mbg · Pull Request #3477 · github/codeql-action · GitHub

Uh oh!

Refactor offline bits out of Features class and use for CCR - #3477

Refactor offline bits out of Features class and use for CCR#3477mbg merged 15 commits intomaingithub/codeql-action:mainfrom mbg/features/offline-featuresgithub/codeql-action:mbg/features/offline-featuresCopy head branch name to clipboard

Conversation

mbg commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

oscarsj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mbg commented Feb 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Refactor offline bits out of Features class and use for CCR#3477
mbg merged 15 commits into
mainfrom
mbg/features/offline-features

mbg commented Feb 12, 2026 •
edited
Loading