codeql-action
codeql-action copied to clipboard
Compute PR diff-ranges during init
When diff-informed analysis is performed, PR diff-ranges are currently computed by the analyze action. This PR moves computation and persistence of PR diff-ranges to the init action instead. The motivation for moving the PR diff-range computation to the init action is to make it available for overlay analysis and include all files within the PR diff-range in the overlay-changes.json file generated for overlay analysis during the init action.
The commits have been cherry-picked from https://github.com/github/codeql-action/pull/3192 and modified.
Risk assessment
For internal use only. Please select the risk level of this change:
- Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
Which use cases does this change impact?
- Advanced setup - Impacts users who have custom workflows.
- Default setup - Impacts users who use default setup.
- Code Scanning - Impacts Code Scanning (i.e.
analysis-kinds: code-scanning). - Code Quality - Impacts Code Quality (i.e.
analysis-kinds: code-quality). - GHES - Impacts GitHub Enterprise Server.
How did/will you validate this change?
- Test repository - This change will be tested on a test repository before merging.
- Unit tests - I am depending on unit test coverage (i.e. tests in
.test.tsfiles).
If something goes wrong after this change is released, what are the mitigation and rollback strategies?
- Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
- Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.
How will you know if something goes wrong after this change is released?
- Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.