Allow merging Default Setup `config` with config file by mbg · Pull Request #3994 · github/codeql-action · GitHub

This PR introduces support for merging the config inputs that are provided by Default Setup with custom configuration files. That can be the case if, for example, a configuration file is configured by the corresponding repository property. With the change in this PR, a supported scenario is that e.g.:

A CodeQL workflow runs in Default Setup on a repository where the github-codeql-config-file is set.
getConfigFileInput returns the value from the repository property.
getOptionalInput("config") returns the configuration provided by Default Setup.
In determineUserConfig, the two configurations are merged if the corresponding FF is enabled.

Notes for reviewers / deliberate implementation aspects

determineUserConfig is refactored out of initConfig. This PR does not make any changes to the refactored code that aren't required for the objective of this PR.
inputs.configFile is mutated to the resulting configuration file path as in initConfig before. No change in behaviour. The new tests for determineUserConfig check that this behaves as expected in relevant cases.
No new validation of the inputs properties is performed. Just like initConfig before, determineUserConfig assumes that the necessary validation before this step has taken place. Further validation may occur in e.g. loadUserConfig.
The new tests do not cover Feature.ValidateDbConfig. This is deliberate because there are already tests exercising loadUserConfig's behaviour if that FF is enabled. In any case, Feature.ValidateDbConfig needs more work to work correctly that is not in the scope of this PR.
The tests make use of the framework merged in Allow abstracting over process.env #3993 to allow the tests to run in parallel.
The tests do not cover cases with remote files, because whether a file is or is not remote does not matter to determineUserConfig. That's for the existing loadUserConfig function and its tests.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR adds feature-flagged support for merging Default Setup’s config input with a repository-provided config-file, enabling both sources to contribute supported configuration fields in Default Setup runs. It also refactors config loading logic to make this behavior testable and expands the environment abstraction used for parallelizable tests.

Changes:

Introduces Feature.AllowMergeConfigFiles and refactors config initialization by extracting determineUserConfig.
Adds mergeUserConfigs to combine supported config properties (notably threat-models and reserved default-setup) and adds unit tests for the merge behavior.
Extends the Env abstraction (entries, set) and threads optional Env through several actions util helpers.

Show a summary per file

File	Description
src/util.ts	Extends getEnv to support listing and mutating env entries (entries, set).
src/testing-utils.ts	Allows setting base Actions env vars into a provided Env for tests.
src/feature-flags.ts	Adds the AllowMergeConfigFiles feature flag configuration.
src/environment.ts	Adds CODEQL_ACTION_TEMP and expands the Env interface.
src/config/db-config.ts	Adds config types for Default Setup and implements mergeUserConfigs.
src/config/db-config.test.ts	Adds unit tests for mergeUserConfigs.
src/config-utils.ts	Extracts determineUserConfig and implements merge logic under FF + Default Setup.
src/config-utils.test.ts	Adds targeted tests for determineUserConfig behavior (including merge cases).
src/actions-util.ts	Threads optional Env through several helpers and uses EnvVar.TEMP for temp dir selection.
lib/entry-points.js	Not reviewed (excluded by policy; also generated output).

Review details

Files excluded by content exclusion policy (1)

lib/entry-points.js

Files reviewed: 9/10 changed files
Comments generated: 5
Review effort level: Low

This makes the implementations more consistent for now, and less error-prone

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Review details

Files excluded by content exclusion policy (1)

lib/entry-points.js

Files reviewed: 9/10 changed files
Comments generated: 1
Review effort level: Low

It is probably worth logging a warning that is sent to telemetry if we find any other properties in fromConfigInput. If we format this as a telemetry diagnostic, we can set the internal-error tag on the reporting descriptor to send exceptions to Sentry.

I have added diagnostics for unrecognised and invalid keys in 7c961fa and f630f8f

Should this act on a copy of DEFAULT_ACTIONS_VARS, to avoid potential calls to Env.set mutating DEFAULT_ACTIONS_VARS? I know that determineUserConfig is read only, but this could be confusing if behaviour changes.

I have pushed some improvements to the TestEnv implementation in #4005, which will help address this here once those changes are merged.

That PR was merged and I have updated this branch with the merged changes, which has allowed me to update the tests to make use of the new withDefaultActionsEnv(). See 2773684 and f181d70

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Review details

Files excluded by content exclusion policy (1)

lib/entry-points.js

Files reviewed: 7/8 changed files
Comments generated: 2
Review effort level: Low

A couple of minor suggestions that can be ignored, and some food for thought. But otherwise, looks good 👍

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Review details

Files excluded by content exclusion policy (1)

lib/entry-points.js

Files reviewed: 8/9 changed files
Comments generated: 4
Review effort level: Low

I'm happy merging this as is, but consider making use of the internal-error tag on the telemetry diagnostics to report exceptions to Sentry.

mbg added 14 commits July 6, 2026 13:50

Extend UserConfig type to be aware of Default Setup properties

c512861

Refactor determineUserConfig out of initConfig

cd604f8

Add mergeUserConfigs with tests

a52a966

Add FF for configuration merging

132634d

Add JSDoc for loadUserConfig

53a488c

Move validateConfig FF query

6860cc1

Add unit tests for existing behaviour of determineUserConfig

0188f39

Allow env input for relevant functions in actions-util.ts

d1db924

Allow setting environment variables

18d20b7

Give determineUserConfig access to the environment

3157774

Allow merging Default Setup config with config file

42c0c6a

Document that inputs might be mutated

3707b44

Return mergedConfig instead of loading it again

d149f93

Test inputs.configFile mutation in tests

764f470

mbg self-assigned this Jul 6, 2026

mbg requested a review from a team as a code owner July 6, 2026 13:03

Copilot AI review requested due to automatic review settings July 6, 2026 13:03

Copilot started reviewing on behalf of mbg July 6, 2026 13:04 View session

github-actions Bot added the size/XL May be very hard to review label Jul 6, 2026

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread src/actions-util.ts Outdated

Comment thread src/actions-util.ts Outdated

Comment thread src/actions-util.ts Outdated

Comment thread src/config-utils.ts Outdated

Comment thread src/config-utils.ts Outdated

mbg added 4 commits July 6, 2026 14:10

Set the required workspacePath input

9a06fa6

Initialise env in actions-util when not provided

44d6b3b

This makes the implementations more consistent for now, and less error-prone

Fix JSDoc for determineUserConfig

4509fb3

Make lazy FF check less ambiguous

8476401

mbg requested a review from Copilot July 6, 2026 13:46

Copilot started reviewing on behalf of mbg July 6, 2026 13:47 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread src/config/db-config.test.ts

Merge remote-tracking branch 'origin/main' into mbg/config/merge

8be707b

henrymercer reviewed Jul 6, 2026

View reviewed changes

Merge branch 'main' into mbg/config/merge

7ccd988

mbg requested a review from Copilot July 9, 2026 23:46

Copilot started reviewing on behalf of mbg July 9, 2026 23:46 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread src/json/index.ts

Comment thread src/json/index.ts

mbg added 7 commits July 10, 2026 13:10

Remove keys from unrecognised set as soon as found

e4752e7

Add convenience functions to produce CheckSchemaResult values

8d8f054

Track invalid keys, and use more standard JSON path notation

512bf6f

Propagate CheckSchemaOptions to allow failFast to work as intended

0b10dee

fixup! Track invalid keys, and use more standard JSON path notation

e26215c

Don't include nested keys that are unknown

26cbf9f

Report invalid keys separately

f630f8f

mario-campos previously approved these changes Jul 10, 2026

View reviewed changes

Comment thread src/json/index.test.ts

Comment thread src/json/index.test.ts

Comment thread src/config/db-config.ts

Comment thread src/config/db-config.test.ts

mbg added 3 commits July 13, 2026 09:25

Merge remote-tracking branch 'origin/main' into mbg/config/merge

66c15f4

Update test for changed test API

2773684

Update determineUserConfig tests to use new framework

f181d70

mbg dismissed mario-campos’s stale review via a3fc063 July 13, 2026 09:08

mbg requested a review from Copilot July 13, 2026 09:11

Copilot started reviewing on behalf of mbg July 13, 2026 09:12 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread src/testing-utils.ts

Comment thread src/json/index.ts

Comment thread src/json/index.test.ts Outdated

Comment thread src/json/index.test.ts Outdated

mbg mentioned this pull request Jul 13, 2026

Add schema checker to json module #4006

Merged

Return function result from passes alongside assertion result

7577328

mbg force-pushed the mbg/config/merge branch from a3fc063 to 7577328 Compare July 13, 2026 09:27

Merge remote-tracking branch 'origin/main' into mbg/config/merge

3d2713f

henrymercer approved these changes Jul 14, 2026

View reviewed changes

mbg added this pull request to the merge queue Jul 14, 2026

Merged via the queue into main with commit 29d5e4c Jul 14, 2026
225 checks passed

mbg deleted the mbg/config/merge branch July 14, 2026 14:38

mbg mentioned this pull request Jul 14, 2026

Add support for diagnostic tags, and use them for mergeDefaultSetupAndUserConfigs #4011

Merged

This was referenced Jul 16, 2026

Merge main into releases/v4 #4020

Merged

Merge releases/v4 into releases/v3 #4022

Merged

+              test("determineUserConfig - empty config when neither input is specified", async (t) => {
+                await withTmpDir(async (tmpDir) => {
+                  const logger = new RecordingLogger();
+                  const env = util.getEnv(DEFAULT_ACTIONS_VARS);

+                  result["threat-models"] = Array.from(threatModels);
+                }
+                return result;

Allow merging Default Setup `config` with config file by mbg · Pull Request #3994 · github/codeql-action · GitHub

Uh oh!

Allow merging Default Setup config with config file - #3994

Allow merging Default Setup config with config file#3994mbg merged 43 commits intomaingithub/codeql-action:mainfrom mbg/config/mergegithub/codeql-action:mbg/config/mergeCopy head branch name to clipboard

Conversation

mbg commented Jul 6, 2026

Notes for reviewers / deliberate implementation aspects

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

henrymercer Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

mario-campos left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Allow merging Default Setup config with config file#3994
mbg merged 43 commits into
mainfrom
mbg/config/merge