Allow merging Default Setup `config` with config file by mbg · Pull Request #3994 · github/codeql-action

mbg · 2026-07-06T13:03:45Z

This PR introduces support for merging the config inputs that are provided by Default Setup with custom configuration files. That can be the case if, for example, a configuration file is configured by the corresponding repository property. With the change in this PR, a supported scenario is that e.g.:

A CodeQL workflow runs in Default Setup on a repository where the github-codeql-config-file is set.
getConfigFileInput returns the value from the repository property.
getOptionalInput("config") returns the configuration provided by Default Setup.
In determineUserConfig, the two configurations are merged if the corresponding FF is enabled.

Notes for reviewers / deliberate implementation aspects

determineUserConfig is refactored out of initConfig. This PR does not make any changes to the refactored code that aren't required for the objective of this PR.
inputs.configFile is mutated to the resulting configuration file path as in initConfig before. No change in behaviour. The new tests for determineUserConfig check that this behaves as expected in relevant cases.
No new validation of the inputs properties is performed. Just like initConfig before, determineUserConfig assumes that the necessary validation before this step has taken place. Further validation may occur in e.g. loadUserConfig.
The new tests do not cover Feature.ValidateDbConfig. This is deliberate because there are already tests exercising loadUserConfig's behaviour if that FF is enabled. In any case, Feature.ValidateDbConfig needs more work to work correctly that is not in the scope of this PR.
The tests make use of the framework merged in Allow abstracting over process.env #3993 to allow the tests to run in parallel.
The tests do not cover cases with remote files, because whether a file is or is not remote does not matter to determineUserConfig. That's for the existing loadUserConfig function and its tests.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Copilot

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR adds feature-flagged support for merging Default Setup’s config input with a repository-provided config-file, enabling both sources to contribute supported configuration fields in Default Setup runs. It also refactors config loading logic to make this behavior testable and expands the environment abstraction used for parallelizable tests.

Changes:

Introduces Feature.AllowMergeConfigFiles and refactors config initialization by extracting determineUserConfig.
Adds mergeUserConfigs to combine supported config properties (notably threat-models and reserved default-setup) and adds unit tests for the merge behavior.
Extends the Env abstraction (entries, set) and threads optional Env through several actions util helpers.

Show a summary per file

File	Description
src/util.ts	Extends `getEnv` to support listing and mutating env entries (`entries`, `set`).
src/testing-utils.ts	Allows setting base Actions env vars into a provided `Env` for tests.
src/feature-flags.ts	Adds the `AllowMergeConfigFiles` feature flag configuration.
src/environment.ts	Adds `CODEQL_ACTION_TEMP` and expands the `Env` interface.
src/config/db-config.ts	Adds config types for Default Setup and implements `mergeUserConfigs`.
src/config/db-config.test.ts	Adds unit tests for `mergeUserConfigs`.
src/config-utils.ts	Extracts `determineUserConfig` and implements merge logic under FF + Default Setup.
src/config-utils.test.ts	Adds targeted tests for `determineUserConfig` behavior (including merge cases).
src/actions-util.ts	Threads optional `Env` through several helpers and uses `EnvVar.TEMP` for temp dir selection.
lib/entry-points.js	Not reviewed (excluded by policy; also generated output).

Review details

Files excluded by content exclusion policy (1)

lib/entry-points.js

Files reviewed: 9/10 changed files
Comments generated: 5
Review effort level: Low

This makes the implementations more consistent for now, and less error-prone

Copilot

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Review details

Files excluded by content exclusion policy (1)

lib/entry-points.js

Files reviewed: 9/10 changed files
Comments generated: 1
Review effort level: Low

henrymercer · 2026-07-06T16:28:35Z

+ * @param fromConfigFile The user-supplied configuration.
+ * @returns The combination of both configuration files.
+ */
+export function mergeUserConfigs(


Can we indicate in the function name that this is about merging a user config with a default setup config?

henrymercer · 2026-07-06T16:30:27Z

+    result["threat-models"] = Array.from(threatModels);
+  }
+
+  return result;


It is probably worth logging a warning that is sent to telemetry if we find any other properties in fromConfigInput. If we format this as a telemetry diagnostic, we can set the internal-error tag on the reporting descriptor to send exceptions to Sentry.

henrymercer · 2026-07-06T16:36:30Z

+test("determineUserConfig - empty config when neither input is specified", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = util.getEnv(DEFAULT_ACTIONS_VARS);


Should this act on a copy of DEFAULT_ACTIONS_VARS, to avoid potential calls to Env.set mutating DEFAULT_ACTIONS_VARS? I know that determineUserConfig is read only, but this could be confusing if behaviour changes.

henrymercer · 2026-07-06T16:52:01Z

+    // The loaded configuration should match the result of merging
+    // `defaultSetupConfigInput` and `simpleConfigFileContents`.


Let's also check that inputs.configFile was mutated and that the contents on disk match the returned config

mbg added 14 commits July 6, 2026 13:50

Extend UserConfig type to be aware of Default Setup properties

c512861

Refactor determineUserConfig out of initConfig

cd604f8

Add mergeUserConfigs with tests

a52a966

Add FF for configuration merging

132634d

Add JSDoc for loadUserConfig

53a488c

Move validateConfig FF query

6860cc1

Add unit tests for existing behaviour of determineUserConfig

0188f39

Allow env input for relevant functions in actions-util.ts

d1db924

Allow setting environment variables

18d20b7

Give determineUserConfig access to the environment

3157774

Allow merging Default Setup config with config file

42c0c6a

Document that inputs might be mutated

3707b44

Return mergedConfig instead of loading it again

d149f93

Test inputs.configFile mutation in tests

764f470

mbg self-assigned this Jul 6, 2026

mbg requested a review from a team as a code owner July 6, 2026 13:03

Copilot AI review requested due to automatic review settings July 6, 2026 13:03

Copilot started reviewing on behalf of mbg July 6, 2026 13:04 View session

github-actions Bot added the size/XL May be very hard to review label Jul 6, 2026

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread src/actions-util.ts Outdated

Comment thread src/actions-util.ts Outdated

Comment thread src/actions-util.ts Outdated

Comment thread src/config-utils.ts Outdated

Comment thread src/config-utils.ts Outdated

mbg added 4 commits July 6, 2026 14:10

Set the required workspacePath input

9a06fa6

Initialise env in actions-util when not provided

44d6b3b

This makes the implementations more consistent for now, and less error-prone

Fix JSDoc for determineUserConfig

4509fb3

Make lazy FF check less ambiguous

8476401

mbg requested a review from Copilot July 6, 2026 13:46

Copilot started reviewing on behalf of mbg July 6, 2026 13:47 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread src/config/db-config.test.ts

Merge remote-tracking branch 'origin/main' into mbg/config/merge

8be707b

henrymercer reviewed Jul 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow merging Default Setup `config` with config file#3994

Allow merging Default Setup `config` with config file#3994
mbg wants to merge 19 commits into
mainfrom
mbg/config/merge

mbg commented Jul 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

henrymercer Jul 6, 2026

Uh oh!

henrymercer Jul 6, 2026

Uh oh!

henrymercer Jul 6, 2026

Uh oh!

henrymercer Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// The loaded configuration should match the result of merging
		// `defaultSetupConfigInput` and `simpleConfigFileContents`.

Uh oh!

Conversation

mbg commented Jul 6, 2026

Notes for reviewers / deliberate implementation aspects

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

henrymercer Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants