This PR adds an additional validity check for overlay-base databases before uploading an overlay-base to the actions cache or using an overlay-base for overlay analysis. The additional check consists of runningcodeql resolve database and checking for the existence of anoverlayBaseSpecifier key.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users withdynamic workflows (Default Setup, CCR, ...).

Products:

Code Scanning - The changes impact analyses whenanalysis-kinds: code-scanning.
Code Quality - The changes impact analyses whenanalysis-kinds: code-quality.

Environments:

Dotcom - Impacts CodeQL workflows ongithub.com.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in.test.ts files).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.
Special considerations - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding achangelog entry for this change.
Confirm thereadme and docs have been updated if necessary.

github-actionsbot added the size/SShould be easy to review label

Dec 3, 2025

kaspersv force-pushed thekaspersv/check-for-overlayBaseSpecifier branch from35d5d53 to6391bd0Compare

December 3, 2025 08:28

kaspersv changed the title~~Kaspersv/check for overlay base specifier~~Overlay: Check database metadata for overlayBaseSpecifier

Dec 3, 2025

kaspersv force-pushed thekaspersv/check-for-overlayBaseSpecifier branch 4 times, most recently fromfd0d09f toaff036bCompare

December 3, 2025 09:15

Copy link

ContributorAuthor

kaspersv commentedDec 3, 2025

The failingCode-Scanning config CLI tests appear to be unrelated to this PR and the same failure has been observed on an unrelateddependabot PR.

kaspersv requested a review frommbg

December 3, 2025 09:53

kaspersv assignedmbg

Dec 3, 2025

kaspersv marked this pull request as ready for review

December 3, 2025 09:53

CopilotAI review requested due to automatic review settings

December 3, 2025 09:53

kaspersv requested a review froma team as acode owner

December 3, 2025 09:53

Copilotstarted reviewing on behalf ofkaspersv

December 3, 2025 09:54

View session

Copilotfinished reviewing on behalf ofkaspersv

December 3, 2025 09:57

CopilotAI reviewed

Dec 3, 2025

View reviewed changes

Copy link

Contributor

CopilotAI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Pull request overview

This PR adds an additional validation check for overlay-base databases by runningcodeql resolve database and verifying the presence of anoverlayBaseSpecifier key in the database metadata. This check helps ensure that only valid overlay-base databases are uploaded to the cache or used for overlay analysis.

Key changes:

NewresolveDatabase method added to the CodeQL CLI interface that runscodeql resolve database --format=json
EnhancedcheckOverlayBaseDatabase function to validate theoverlayBaseSpecifier metadata for each language
Test coverage added for the new validation scenario whereoverlayBaseSpecifier is missing

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/codeql.ts	Added`resolveDatabase` method and`ResolveDatabaseOutput` interface to support querying database metadata
src/overlay-database-utils.ts	Enhanced overlay-base database validation to check for`overlayBaseSpecifier` using`codeql resolve database`
src/overlay-database-utils.test.ts	Added test case for missing`overlayBaseSpecifier` and updated test infrastructure to mock`resolveDatabase`
src/testing-utils.ts	Changed default language in`createTestConfig` from empty array to`[KnownLanguage.java]` to support tests that iterate over languages
lib/*.js	Auto-generated JavaScript files reflecting the TypeScript changes

src/overlay-database-utils.tsShow resolvedHide resolved

src/overlay-database-utils.ts Outdated

		resolveDatabaseOutput===undefined\|\|
		!("overlayBaseSpecifier"inresolveDatabaseOutput)
		){
		logger.info(`${warningPrefix}: no overlayBaseSpecifier defined`);

Copy link

CopilotAIDec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The logging level here should belogger.warning instead oflogger.info to be consistent with line 189 where a similar validation failure is logged as a warning. Validation failures that cause the function to return false should be warnings so they're visible in the logs.

Suggested change

	logger.info(`${warningPrefix}: no overlayBaseSpecifier defined`);
	logger.warning(`${warningPrefix}: no overlayBaseSpecifier defined`);

Copilot uses AI. Check for mistakes.

Copy link

ContributorAuthor

kaspersvDec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The info log-level is intentional. The extractor is allowed to decide not to produce an overlay-base. This will for instance happen for Go if the extractor is asked to produce an overlay-base for a traced build. In that case the Go extractor will decide not to produce an overlay-base and we shouldn't generate a warning for that case.

src/overlay-database-utils.test.tsShow resolvedHide resolved

src/testing-utils.tsShow resolvedHide resolved

kaspersv force-pushed thekaspersv/check-for-overlayBaseSpecifier branch fromc96efdb to505fdd0Compare

December 3, 2025 10:25

kaspersv added2 commits

December 3, 2025 13:40

CodeQL: Add resolveDatabase method

dd89143

Overlay: Check database metadata for overlayBaseSpecifier

c4efbda

kaspersv force-pushed thekaspersv/check-for-overlayBaseSpecifier branch from505fdd0 toc4efbdaCompare

December 3, 2025 12:40

Copy link

ContributorAuthor

kaspersv commentedDec 3, 2025

Rebased on top of#3341.

kaspersv requested review fromhenrymercer and removed request formbg

December 4, 2025 12:43

kaspersv assignedhenrymercer and unassignedmbg

Dec 4, 2025

henrymercer reviewed

Dec 8, 2025

View reviewed changes

Copy link

Contributor

henrymercer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

A couple of suggestions otherwise this looks good 👍

src/codeql.ts OutdatedShow resolvedHide resolved

src/overlay-database-utils.ts Outdated

		logger.info(`${warningPrefix}: no overlayBaseSpecifier defined`);
		returnfalse;
		}else{
		logger.info(

Copy link

Contributor

henrymercerDec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Should this be a debug level log? I had a quick look and it looks like this is not within a log group.

Copy link

ContributorAuthor

kaspersvDec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Yes, it makes sense to log at debug log-level in the else branch, to avoid logging unnecessarily in the default case where anoverlayBaseSpecifier is present. I would still like to keep the log that nooverlayBaseSpecifier was present at info level.

kaspersvand others added2 commits

December 9, 2025 09:41

Update src/codeql.ts

5b7e7fc

Co-authored-by: Henry Mercer <henrymercer@github.com>

Overlay: log overlayBaseSpecifier at debug log-level

002a7f2

kaspersv requested a review fromhenrymercer

December 9, 2025 09:02

henrymercer approved these changes

Dec 9, 2025

View reviewed changes

kaspersv merged commitc43362b intomain

Dec 9, 2025

241 checks passed

kaspersv deleted the kaspersv/check-for-overlayBaseSpecifier branch

December 9, 2025 10:37

This was referencedDec 11, 2025

Merge main into releases/v4#3355

Merged

Merge releases/v4 into releases/v3#3357

Merged

Labels

size/S

Should be easy to review

4 participants

Movatterモバイル変換

Overlay: Check database metadata for overlayBaseSpecifier#3340

Overlay: Check database metadata for overlayBaseSpecifier#3340

Uh oh!

Conversation

kaspersv commentedDec 3, 2025

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

kaspersv commentedDec 3, 2025

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

CopilotAIDec 3, 2025

Choose a reason for hiding this comment

Uh oh!

kaspersvDec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kaspersv commentedDec 3, 2025

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henrymercerDec 8, 2025

Choose a reason for hiding this comment

Uh oh!

kaspersvDec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants