Use `getDefaultCliVersion` for `start-proxy` by mbg · Pull Request #3512 · github/codeql-action · GitHub

Changes the start-proxy action to use getDefaultCliVersion rather than having defaults.bundleVersion hard-coded. Conveniently, this adds a permanent consumer of feature flags to start-proxy.

I have put this behind a new FF to gate the new behaviour to make this a less risky change.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

This pull request updates the start-proxy action to use getDefaultCliVersion from feature flags instead of hard-coding defaults.bundleVersion. This change allows the start-proxy action to dynamically determine the CodeQL CLI version to use, either from feature flags on GitHub.com or from defaults on GHES, making the behavior consistent with other actions in the codebase.

Changes:

Modified getDownloadUrl and getProxyBinaryPath functions to accept a FeatureEnablement parameter
Updated start-proxy-action.ts to initialize and pass feature flags to proxy-related functions
Added comprehensive test coverage with proper feature flag mocking
Removed unused Feature import from start-proxy-action.ts

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/start-proxy.ts	Updated function signatures to accept FeatureEnablement; changed to use getDefaultCliVersion for dynamic version selection; added getGitHubVersion import
src/start-proxy.test.ts	Updated test mocking to properly handle feature flags; added mockOfflineFeatures helper; modified tests to pass features parameter
src/start-proxy-action.ts	Removed unused Feature import; updated getProxyBinaryPath call to pass features parameter
lib/start-proxy-action.js	Generated JavaScript reflecting TypeScript changes

Comments suppressed due to low confidence (1)

src/start-proxy.ts:558

The JSDoc comment for getProxyBinaryPath is missing documentation for the new features parameter. Please add a @param features entry to document this parameter.

/**
 * Gets a path to the proxy binary. If possible, this function will find the proxy in the
 * runner's tool cache. Otherwise, it downloads and extracts the proxy binary,
 * and stores it in the tool cache.
 *
 * @param logger The logger to use.
 * @returns The path to the proxy binary.
 */

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Just a little nit, otherwise lgtm!

To save an API call, could we thread githubVersion through from

codeql-action/src/start-proxy-action.ts

Line 49 in bce0deb

const gitHubVersion = await getGitHubVersion();

?

We could thread it through, but getGitHubVersion should also cache the result from the API on the first call, so that the second call to getGitHubVersion here shouldn't result in an additional API call.

👍🏻 I see. Well I'll leave that as a judgment call to you, happy to approve.

Let's get this merged to unblock other PRs, thanks 👍🏻

Use getDefaultCliVersion for start-proxy

f657c4e

mbg requested a review from henrymercer February 25, 2026 17:47

mbg self-assigned this Feb 25, 2026

mbg requested a review from a team as a code owner February 25, 2026 17:47

Copilot AI review requested due to automatic review settings February 25, 2026 17:47

github-actions Bot added the size/M Should be of average difficulty to review label Feb 25, 2026

Copilot started reviewing on behalf of mbg February 25, 2026 17:48 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

Comment thread src/start-proxy.test.ts

Comment thread src/start-proxy.ts

henrymercer requested review from sam-robson and removed request for henrymercer February 25, 2026 19:13

This was referenced Feb 26, 2026

Add a repository property for disabling overlay #3507

Merged

Reduce log levels for registry connection checks #3516

Merged

mbg added 2 commits February 26, 2026 13:07

Address Copilot's review comments

3c91148

Put change behind a FF

db33d20

mbg requested a review from Copilot February 26, 2026 13:35

Copilot started reviewing on behalf of mbg February 26, 2026 13:36 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Comment thread src/start-proxy.ts

Fix log message / returned version

bce0deb

sam-robson reviewed Feb 26, 2026

View reviewed changes

sam-robson approved these changes Feb 26, 2026

View reviewed changes

mbg merged commit a577f70 into main Feb 26, 2026
252 of 254 checks passed

mbg deleted the mbg/start-proxy/use-default-cli branch February 26, 2026 15:11

This was referenced Feb 27, 2026

Merge main into releases/v4 #3523

Merged

Merge releases/v4 into releases/v3 #3533

Merged

+              async function getCliVersionFromFeatures(
+                features: FeatureEnablement,
+              ): Promise<CodeQLDefaultVersionInfo> {
+                const gitHubVersion = await getGitHubVersion();

Use `getDefaultCliVersion` for `start-proxy` by mbg · Pull Request #3512 · github/codeql-action · GitHub

Uh oh!

Use getDefaultCliVersion for start-proxy - #3512

Use getDefaultCliVersion for start-proxy#3512
mbg merged 4 commits into
mainfrom
mbg/start-proxy/use-default-cli

mbg commented Feb 25, 2026 •
edited
Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sam-robson left a comment

Uh oh!

sam-robson Feb 26, 2026

Uh oh!

mbg Feb 26, 2026

Uh oh!

sam-robson Feb 26, 2026

Uh oh!

mbg Feb 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Use `getDefaultCliVersion` for `start-proxy` by mbg · Pull Request #3512 · github/codeql-action · GitHub

Uh oh!

Use getDefaultCliVersion for start-proxy - #3512

Use getDefaultCliVersion for start-proxy#3512mbg merged 4 commits intomaingithub/codeql-action:mainfrom mbg/start-proxy/use-default-cligithub/codeql-action:mbg/start-proxy/use-default-cliCopy head branch name to clipboard

Conversation

mbg commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

sam-robson left a comment

Choose a reason for hiding this comment

Uh oh!

sam-robson Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

sam-robson Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Use getDefaultCliVersion for start-proxy#3512
mbg merged 4 commits into
mainfrom
mbg/start-proxy/use-default-cli

mbg commented Feb 25, 2026 •
edited
Loading