Fix handling of non-`string` values from repository properties API by mbg · Pull Request #3557 · github/codeql-action · GitHub

Fixes #3555.

The repository property API will return repository property objects where the value field is either string or string[]. We do not currently handle the latter.

This PR makes the following changes:

The first commit updates our type representation of the API responses to account for string[] values.
The second changes the validation logic to only validate the type of value if it is for a property we care about. This also protects us against future changes to what types of value may be returned by the API.

These two commits are enough to fix the bug. The third commit goes beyond this to enable us to use array-typed properties in the future by:

Introducing a mapping from known repository properties to the expected API value types (RepositoryPropertyApiType).
Changing repositoryPropertyParsers to return an object for each known property that contains both a validator function and a parser (PropertyInfo).
The validator function (.validate) accepts any RepositoryPropertyValue (i.e. string | string[]), checks that it is the expected type, and narrows the type of value if successful.
The value type validation is now in setProperty, which retrieves the PropertyInfo object for the repository property, calls validate, and then is either able to call parse if the check was successful (and the type narrowed) or throws the validation error.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

The repository properties feature is already FF-ed. If something goes wrong with this change, we can either disable the existing FF or perform a rollback.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

Updates repository property handling to support API responses where value can be a string or string[], and validates/parses only properties that this action recognizes to avoid failing on unrelated properties.

Changes:

Expand API response typing to allow string | string[] for repository property value.
Refactor parsing to use per-property validate + parse (PropertyInfo) and validate only for known properties.
Add/adjust unit tests to cover unknown properties with unexpected value types and updated error behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
src/feature-flags/properties.ts	Introduces RepositoryPropertyValue and PropertyInfo-based validation/parsing to avoid throwing on unknown properties and to support future typed properties.
src/feature-flags/properties.test.ts	Updates existing tests and adds coverage ensuring unknown properties with unexpected value types don’t throw.
lib/init-action.js	Regenerated compiled bundle reflecting the TS changes.

Looks good! Consider adding a changelog note.

mbg added 3 commits March 9, 2026 12:03

Update GitHubRepositoryProperty to match schema

8e70ae2

Only validate property value type if we care about the property

9c75a5f

Validate value types returned by API against expectations

5899159

mbg requested a review from henrymercer March 9, 2026 12:56

mbg self-assigned this Mar 9, 2026

mbg requested a review from a team as a code owner March 9, 2026 12:56

Copilot AI review requested due to automatic review settings March 9, 2026 12:56

github-actions Bot added the size/S Should be easy to review label Mar 9, 2026

Copilot AI reviewed Mar 9, 2026

View reviewed changes

mbg added 3 commits March 9, 2026 13:03

Export types that weren't already

58314dc

Include type in error message

5311ed4

Add unknown property with string[] value

149fd14

henrymercer previously approved these changes Mar 9, 2026

View reviewed changes

Add changelog entry

6f90eb6

mbg dismissed henrymercer’s stale review via 6f90eb6 March 9, 2026 14:24

mbg requested a review from henrymercer March 9, 2026 14:29

henrymercer approved these changes Mar 9, 2026

View reviewed changes

mbg added this pull request to the merge queue Mar 9, 2026

Merged via the queue into main with commit b39251f Mar 9, 2026
244 checks passed

mbg deleted the mbg/repo-props/multi-select branch March 9, 2026 15:11

mbg mentioned this pull request Mar 9, 2026

CodeQL Action fails to handle multi_select repository properties (expects string, gets array) #3555

Closed

This was referenced Mar 16, 2026

Merge main into releases/v4 #3574

Merged

Merge releases/v4 into releases/v3 #3577

Merged

mahammadabdurahman497-arch reviewed Mar 19, 2026

View reviewed changes

github-actions Bot mentioned this pull request May 18, 2026

chore(ci)(deps): bump github/codeql-action from 3.35.4 to 4.35.5 ag-ui-protocol/ag-ui#1711

Closed

@@ @@ -86,14 +126,6 @@ export async function loadPropertiesFromApi( @@
                     }
                     if (isKnownPropertyName(property.property_name)) {
-                      // Only validate the type of `value` if this is a property we care about, to avoid throwing
-                      // on unrelated properties that may use representations we do not support.
-                      if (typeof property.value !== "string") {
-                        throw new Error(
-                          `Expected repository property '${property.property_name}' to have a string value, but got: ${JSON.stringify(property)}`,
-                        );
-                      }
                       setProperty(properties, property.property_name, property.value, logger);
                     }
                   }
@@ @@ -119,14 +151,30 @@ export async function loadPropertiesFromApi( @@
                 }
               }
-              /** Update the partial set of repository properties with the parsed value of the specified property. */
+              /**
+               * Validate that `value` has the correct type for `K` and, if so, update the partial set of repository
+               * properties with the parsed value of the specified property.
+               */
               function setProperty<K extends RepositoryPropertyName>(
                 properties: RepositoryProperties,
                 name: K,
-                value: string,
+                value: RepositoryPropertyValue,
                 logger: Logger,
               ): void {
-                properties[name] = repositoryPropertyParsers[name](name, value, logger);
+                const propertyOptions = repositoryPropertyParsers[name];
+                // We perform the validation here for two reasons:
+                // 1. This function is only called if `name` is a property we care about, to avoid throwing
+                //    on unrelated properties that may use representations we do not support.
+                // 2. The `propertyOptions.validate` function checks that the type of `value` we received from
+                //    the API is what expect and narrows the type accordingly, allowing us to call `parse`.
+                if (propertyOptions.validate(value)) {
+                  properties[name] = propertyOptions.parse(name, value, logger);
+                } else {
+                  throw new Error(
+                    `Unexpected value for repository property '${name}', got: ${JSON.stringify(value)}`,
+                  );
+                }
               }
               /** Parse a boolean repository property. */

Fix handling of non-`string` values from repository properties API by mbg · Pull Request #3557 · github/codeql-action · GitHub

Uh oh!

Fix handling of non-string values from repository properties API - #3557

Fix handling of non-string values from repository properties API#3557
mbg merged 7 commits into
mainfrom
mbg/repo-props/multi-select

mbg commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Uh oh!

Uh oh!

This comment was marked as spam.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Fix handling of non-`string` values from repository properties API by mbg · Pull Request #3557 · github/codeql-action · GitHub

Uh oh!

Fix handling of non-string values from repository properties API - #3557

Fix handling of non-string values from repository properties API#3557mbg merged 7 commits intomaingithub/codeql-action:mainfrom mbg/repo-props/multi-selectgithub/codeql-action:mbg/repo-props/multi-selectCopy head branch name to clipboard

Conversation

mbg commented Mar 9, 2026

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as spam.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Fix handling of non-string values from repository properties API#3557
mbg merged 7 commits into
mainfrom
mbg/repo-props/multi-select