Move getDiffRangesJsonFilePath to diff-informed/index.ts

Make jsonFilePath an explicit input to functions in diff-informed/index.ts
Improve JSDocs in diff-informed/index.ts
2026-11-12 00:02:14 +03:00 · 2026-11-04 15:00:19 +00:00 · 2026-11-04 14:34:23 +00:00 · 2026-11-04 13:24:10 +00:00 · 2026-11-04 13:24:10 +00:00
25 changed files with 2711 additions and 3123 deletions
@@ -1,5 +0,0 @@
-paths-ignore:
-  - lib
-  - tests
-queries:
-  - uses: security-and-quality
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.

-name: PR Check - Runner images
+name: PR Check - Linux Arm64
 env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GO111MODULE: auto
@@ -47,38 +47,16 @@ defaults:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: runner-images-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
-  runner-images:
+  linux-arm64:
    strategy:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-22.04
-            version: linked
-          - os: ubuntu-22.04-arm
-            version: linked
-          - os: ubuntu-24.04
-            version: linked
          - os: ubuntu-24.04-arm
-            version: linked
-          - os: ubuntu-26.04
-            version: linked
-          - os: ubuntu-26.04-arm
-            version: linked
-          - os: windows-2022
-            version: linked
-          - os: windows-2025
-            version: linked
-          - os: macos-15-large
-            version: linked
-          - os: macos-15-xlarge
-            version: linked
-          - os: macos-26-large
-            version: linked
-          - os: macos-26-xlarge
-            version: linked
-    name: Runner images
+            version: nightly-latest
+    name: Linux Arm64
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
@@ -124,5 +102,5 @@ jobs:
            echo "Found database for $lang"
          done
    env:
-      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}
+      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
      CODEQL_ACTION_TEST_MODE: true
@@ -19,16 +19,70 @@ env:
  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks

 jobs:
-  analyze:
+  # Identify the CodeQL tool versions to use in the analysis job.
+  check-codeql-versions:
    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-26.04
+    outputs:
+      versions: ${{ steps.compare.outputs.versions }}

+    permissions:
+      contents: read
+      # We currently need `security-events: read` to access feature flags.
+      security-events: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up default CodeQL bundle
+        id: setup-default
+        uses: ./setup-codeql
+      - name: Set up linked CodeQL bundle
+        id: setup-linked
+        uses: ./setup-codeql
+        with:
+          tools: linked
+      - name: Compare default and linked CodeQL bundle versions
+        id: compare
+        env:
+          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+        run: |
+          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+
+          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+          # required status check.
+          #
+          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+          # the same as running with `tools: null`.
+          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+            VERSIONS_JSON='[null]'
+          else
+            VERSIONS_JSON='[null, "linked"]'
+          fi
+
+          # Output a JSON-encoded list with the distinct versions to test against.
+          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+
+  analyze-javascript:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs: [check-codeql-versions]
    strategy:
      fail-fast: false
      matrix:
-        language:
-          - actions
-          - javascript
+        os:
+          - ubuntu-22.04
+          - ubuntu-24.04
+          - windows-2022
+          - windows-2025
+          - macos-14-xlarge
+          - macos-15-xlarge
+        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
+    runs-on: ${{ matrix.os }}

    permissions:
      contents: read
@@ -41,15 +95,49 @@ jobs:
        uses: ./init
        id: init
        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config-javascript.yml
+          tools: ${{ matrix.tools }}
      # confirm steps.init.outputs.codeql-path points to the codeql binary
      - name: Print CodeQL Version
        run: >
          "$CODEQL" version --format=json
        env:
          CODEQL: ${{steps.init.outputs.codeql-path}}
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:javascript"
+          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+
+  analyze-other:
+    if: github.triggering_actor != 'dependabot[bot]'
+    runs-on: ubuntu-26.04
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config: >
+            paths-ignore:
+              - lib
+              - tests
+            queries:
+              - uses: security-and-quality
      - name: Perform CodeQL Analysis
        uses: ./analyze
        with:
@@ -61,7 +61,6 @@ on:
      - "PR Check - Remote config file"
      - "PR Check - Resolve environment"
      - "PR Check - Ruby analysis"
-      - "PR Check - Runner images"
      - "PR Check - Rust analysis"
      - "PR Check - Split workflow"
      - "PR Check - Start proxy"
@@ -6,10 +6,6 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

 No user facing changes.

-## 4.39.3 - 04 Nov 2026
-
- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
-
 ## 4.39.2 - 03 Nov 2026

 - Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.39.4",
+  "version": "4.39.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.39.4",
+      "version": "4.39.3",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
@@ -59,7 +59,7 @@
        "eslint-plugin-import-x": "^4.17.1",
        "eslint-plugin-jsdoc": "^65.4.0",
        "eslint-plugin-no-async-foreach": "^0.1.1",
-        "glob": "^14.0.3",
+        "glob": "^13.0.6",
        "globals": "^17.13.0",
        "nock": "^14.0.17",
        "prettier": "^3.9.10",
@@ -1811,12 +1811,6 @@
        "node": ">=18.0.0"
      }
    },
-    "node_modules/@isaacs/nonrecursive-glob-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
-      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
-      "license": "BlueOak-1.0.0"
-    },
    "node_modules/@mapbox/node-pre-gyp": {
      "version": "2.0.3",
      "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -3530,6 +3524,7 @@
    },
    "node_modules/ansi-regex": {
      "version": "5.0.1",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -3539,6 +3534,7 @@
      "version": "6.2.3",
      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=12"
@@ -4443,6 +4439,7 @@
    },
    "node_modules/color-convert": {
      "version": "2.0.1",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "color-name": "~1.1.4"
@@ -4453,6 +4450,7 @@
    },
    "node_modules/color-name": {
      "version": "1.1.4",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/comment-parser": {
@@ -4577,6 +4575,7 @@
      "version": "7.0.6",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
      "dependencies": {
        "path-key": "^3.1.0",
        "shebang-command": "^2.0.0",
@@ -4831,6 +4830,7 @@
    },
    "node_modules/emoji-regex": {
      "version": "8.0.0",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/es-abstract": {
@@ -6273,14 +6273,14 @@
      }
    },
    "node_modules/glob": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
-      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "minimatch": "^11.0.2",
+        "minimatch": "^10.2.2",
        "minipass": "^7.1.3",
-        "path-scurry": "^3.0.0"
+        "path-scurry": "^2.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
@@ -6324,13 +6324,12 @@
      }
    },
    "node_modules/glob/node_modules/minimatch": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
-      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "@isaacs/nonrecursive-glob-match": "^1.0.2",
-        "brace-expansion": "^5.0.12"
+        "brace-expansion": "^5.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
@@ -6859,6 +6858,7 @@
    },
    "node_modules/is-fullwidth-code-point": {
      "version": "3.0.0",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -7169,6 +7169,7 @@
    },
    "node_modules/isexe": {
      "version": "2.0.0",
+      "dev": true,
      "license": "ISC"
    },
    "node_modules/js-string-escape": {
@@ -7478,9 +7479,9 @@
      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="
    },
    "node_modules/lru-cache": {
-      "version": "11.5.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
-      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
      "license": "BlueOak-1.0.0",
      "engines": {
        "node": "20 || >=22"
@@ -8571,6 +8572,7 @@
    },
    "node_modules/path-key": {
      "version": "3.1.1",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -8582,9 +8584,9 @@
      "license": "MIT"
    },
    "node_modules/path-scurry": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
-      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
        "lru-cache": "^11.0.0",
@@ -9170,6 +9172,7 @@
    },
    "node_modules/shebang-command": {
      "version": "2.0.0",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "shebang-regex": "^3.0.0"
@@ -9180,6 +9183,7 @@
    },
    "node_modules/shebang-regex": {
      "version": "3.0.0",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -9265,6 +9269,7 @@
      "version": "4.1.0",
      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
      "engines": {
        "node": ">=14"
      },
@@ -9451,6 +9456,7 @@
    },
    "node_modules/string-width": {
      "version": "4.2.3",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "emoji-regex": "^8.0.0",
@@ -9536,6 +9542,7 @@
    },
    "node_modules/strip-ansi": {
      "version": "6.0.1",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "ansi-regex": "^5.0.1"
@@ -10273,6 +10280,7 @@
    },
    "node_modules/which": {
      "version": "2.0.2",
+      "dev": true,
      "license": "ISC",
      "dependencies": {
        "isexe": "^2.0.0"
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.39.4",
+  "version": "4.39.3",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -69,7 +69,7 @@
    "eslint-plugin-import-x": "^4.17.1",
    "eslint-plugin-jsdoc": "^65.4.0",
    "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
    "globals": "^17.13.0",
    "nock": "^14.0.17",
    "prettier": "^3.9.10",
@@ -96,7 +96,7 @@
    "eslint-plugin-jsx-a11y": {
      "semver": ">=6.3.1"
    },
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
    "undici": "^7.30.1"
  }
 }
@@ -0,0 +1,35 @@
+name: "Linux Arm64"
+description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
+operatingSystems:
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
+# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
+# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
+versions:
+  - nightly-latest
+installGo: true
+installDotNet: true
+# The set of languages CodeQL supports on this platform, excluding Swift (macOS only).
+env:
+  LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
+steps:
+  - uses: ./../action/init
+    with:
+      languages: ${{ env.LANGUAGES }}
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in ${LANGUAGES//,/ }; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+        echo "Found database for $lang"
+      done
@@ -1,66 +0,0 @@
-name: "Runner images"
-description: "An end-to-end integration test checking that CodeQL can analyze interpreted and compiled code on the GitHub-hosted runner images"
-# This check runs on each image listed in
-# https://github.com/actions/runner-images#available-images, except for:
-# - `ubuntu-slim`, which is intended for lightweight jobs rather than builds like this one.
-# - `windows-11-arm`, since CodeQL doesn't support Windows on Arm64.
-# - `xcode-27`, a preview image that the `unsupported-macos` check runs on.
-operatingSystems:
-  # The Ubuntu 22.04 images have brownouts from 23 March 2027 and are retired on 17 April 2027, so
-  # remove them before the brownouts start.
-  # See https://github.com/actions/runner-images/issues/14254.
-  - os: ubuntu
-    runner-image: ubuntu-22.04
-  - os: ubuntu
-    runner-image: ubuntu-22.04-arm
-  - os: ubuntu
-    runner-image: ubuntu-24.04
-  - os: ubuntu
-    runner-image: ubuntu-24.04-arm
-  - os: ubuntu
-    runner-image: ubuntu-26.04
-  - os: ubuntu
-    runner-image: ubuntu-26.04-arm
-  - os: windows
-    runner-image: windows-2022
-  - os: windows
-    runner-image: windows-2025
-  # Use larger runners for macOS to keep these jobs off the critical path.
-  - os: macos
-    runner-image: macos-15-large
-  - os: macos
-    runner-image: macos-15-xlarge
-  - os: macos
-    runner-image: macos-26-large
-  - os: macos
-    runner-image: macos-26-xlarge
-# Other PR checks cover the supported CodeQL versions, so this check only tests the linked version.
-# Linux Arm64 bundles are only available for CodeQL 2.27.0 and later, so older stable versions
-# can't run on the Arm64 images.
-versions:
-  - linked
-installGo: true
-installDotNet: true
-# The languages to build and analyze. CodeQL only supports Swift on macOS.
-env:
-  LANGUAGES: "cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}"
-steps:
-  - uses: ./../action/init
-    with:
-      languages: ${{ env.LANGUAGES }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Build code
-    run: ./build.sh
-  - uses: ./../action/analyze
-    with:
-      upload-database: false
-  - name: Assert databases exist
-    run: |
-      cd "$RUNNER_TEMP/codeql_databases"
-      for lang in ${LANGUAGES//,/ }; do
-        if [[ ! -d "$lang" ]]; then
-          echo "Did not find a database for $lang"
-          exit 1
-        fi
-        echo "Found database for $lang"
-      done
@@ -24,5 +24,3 @@ is:
  # PRs), so requiring them would block the PRs they don't run on.
  - "github-advanced-security"
  - "License compliance check"
-  # Only runs when a PR is removed from the merge queue.
-  - "Notify"
@@ -78,12 +78,6 @@ export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
  );
 }

-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
-  return path.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
-}
-
 export function getActionVersion(): string {
  return __CODEQL_ACTION_VERSION__;
 }
@@ -19,9 +19,10 @@ import {
 } from "./dependency-caching";
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
-  DiffThunkRange,
+  type DiffThunkRange,
+  getDiffRangesJsonFilePath,
  readDiffRangesJsonFile,
-} from "./diff-informed-analysis-utils";
+} from "./diff-informed";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
 import { getGitRoot } from "./git-utils";
@@ -295,7 +296,10 @@ export async function setupDiffInformedQueryRun(
  return await withGroupAsync(
    "Generating diff range extension pack",
    async () => {
-      const diffRanges = readDiffRangesJsonFile(logger);
+      const diffRanges = readDiffRangesJsonFile(
+        logger,
+        getDiffRangesJsonFilePath(),
+      );
      if (diffRanges === undefined) {
        logger.info(
          "No precomputed diff ranges found; skipping diff-informed analysis stage.",
@@ -15,6 +15,7 @@ import { createStubCodeQL } from "./codeql";
 import { UserConfig } from "./config/db-config";
 import * as file from "./config/file";
 import * as configUtils from "./config-utils";
+import { ActionsEnvVars } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
@@ -42,6 +43,7 @@ import {
  SAMPLE_DOTCOM_API_DETAILS,
  AssertableTarget,
  RecordingLogger,
+  getTestEnv,
 } from "./testing-utils";
 import {
  GitHubVariant,
@@ -151,9 +153,11 @@ function mockListLanguages(languages: string[]) {
 test.serial("load empty config", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+
    const languages = "javascript,python";

-    setupActionsVars(tempDir, tempDir);
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -166,7 +170,6 @@ test.serial("load empty config", async (t) => {
      },
    });

-    const state = initAllState({ logger });
    const config = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -197,9 +200,10 @@ test.serial("load empty config", async (t) => {
 test.serial("load code quality config", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
    const languages = "actions";

-    setupActionsVars(tempDir, tempDir);
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -211,7 +215,6 @@ test.serial("load code quality config", async (t) => {
      },
    });

-    const state = initAllState({ logger });
    const config = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -253,9 +256,10 @@ test.serial(
  async (t) => {
    return await withTmpDir(async (tempDir) => {
      const logger = new RecordingLogger();
+      const state = initAllState({ logger });
      const languages = "javascript";

-      setupActionsVars(tempDir, tempDir);
+      setupActionsVars(tempDir, tempDir, {}, state.env);

      const codeql = createStubCodeQL({
        async resolveLanguages() {
@@ -291,7 +295,6 @@ test.serial(
        repositoryProperties,
      });

-      const state = initAllState({ logger });
      await t.notThrowsAsync(async () => {
        const config = await configUtils.initConfig(
          state,
@@ -316,6 +319,8 @@ test.serial(
 test.serial("loading a saved config produces the same config", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -334,7 +339,6 @@ test.serial("loading a saved config produces the same config", async (t) => {
    // Sanity check that getConfig returns undefined before we have called initConfig
    t.deepEqual(await configUtils.getConfig(tempDir, logger), undefined);

-    const state = initAllState({ logger });
    const config1 = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -364,6 +368,8 @@ test.serial("loading a saved config produces the same config", async (t) => {
 test.serial("loading config with version mismatch throws", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -387,7 +393,6 @@ test.serial("loading config with version mismatch throws", async (t) => {
      .stub(actionsUtil, "getActionVersion")
      .returns("does-not-exist");

-    const state = initAllState({ logger });
    const config = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -497,7 +502,8 @@ const otherConfigFileContents = `

 test.serial("load non-empty input", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    setupActionsVars(tempDir, tempDir);
+    const state = initAllState();
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -538,7 +544,6 @@ test.serial("load non-empty input", async (t) => {
    const languagesInput = "javascript";
    const configFilePath = createConfigFile(otherConfigFileContents, tempDir);

-    const state = initAllState();
    const actualConfig = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -657,7 +662,9 @@ test.serial("API client used when reading remote config", async (t) => {
    const configFile = "octo-org/codeql-config/config.yaml@main";
    const languagesInput = "javascript";

-    const state = initAllState();
+    const state = initAllState({
+      env: getTestEnv({ [ActionsEnvVars.RUNNER_TEMP]: tempDir }),
+    });
    await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -48,7 +48,10 @@ import {
  addNoLanguageDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
+import {
+  getDiffRangesJsonFilePath,
+  prepareDiffInformedAnalysis,
+} from "./diff-informed";
 import { EnvVar, exportEnvVar, getEnv } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
@@ -1288,9 +1291,10 @@ export async function initConfig(
  }

  const hasDiffRanges = await prepareDiffInformedAnalysis(
-    inputs.codeql,
-    inputs.features,
    logger,
+    inputs.features,
+    inputs.codeql,
+    getDiffRangesJsonFilePath(actionState.env),
  );

  await applyIncrementalAnalysisSettings(
@@ -1,16 +1,12 @@
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";

-import * as actionsUtil from "./actions-util";
-import type { PullRequestBranches } from "./actions-util";
-import * as apiClient from "./api-client";
-import {
-  getDiffInformedAnalysisBranches,
-  prepareDiffInformedAnalysis,
-  exportedForTesting,
-} from "./diff-informed-analysis-utils";
-import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
-import { parseRepositoryNwo } from "./repository";
+import * as actionsUtil from "../actions-util";
+import type { PullRequestBranches } from "../actions-util";
+import * as apiClient from "../api-client";
+import { getEnv } from "../environment";
+import { Feature, FeatureEnablement, initFeatures } from "../feature-flags";
+import { parseRepositoryNwo } from "../repository";
 import {
  setupTests,
  createFeatures,
@@ -19,9 +15,16 @@ import {
  setupActionsVars,
  makeMacro,
  RecordingLogger,
-} from "./testing-utils";
-import { GitHubVariant, withTmpDir } from "./util";
-import type { GitHubVersion } from "./util";
+} from "../testing-utils";
+import { GitHubVariant, withTmpDir } from "../util";
+import type { GitHubVersion } from "../util";
+
+import {
+  getDiffInformedAnalysisBranches,
+  prepareDiffInformedAnalysis,
+  exportedForTesting,
+  getDiffRangesJsonFilePath,
+} from ".";

 setupTests(test);

@@ -192,9 +195,10 @@ test.serial(
        .resolves({ type: GitHubVariant.DOTCOM });

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.false(result);
@@ -222,9 +226,10 @@ test.serial(
      };

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.false(result);
@@ -259,9 +264,10 @@ test.serial(
      } as any);

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.true(result);
@@ -296,9 +302,10 @@ test.serial(
      } as any);

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.false(result);
@@ -1,23 +1,43 @@
 import * as fs from "fs";
+import path from "path";

-import * as actionsUtil from "./actions-util";
-import type { PullRequestBranches } from "./actions-util";
-import { getApiClient, getGitHubVersion } from "./api-client";
-import type { CodeQL } from "./codeql";
-import { Feature, FeatureEnablement } from "./feature-flags";
-import { Logger } from "./logging";
-import { getRepositoryNwoFromEnv } from "./repository";
-import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
+import * as actionsUtil from "../actions-util";
+import type { PullRequestBranches } from "../actions-util";
+import { getApiClient, getGitHubVersion } from "../api-client";
+import type { CodeQL } from "../codeql";
+import { type Env, getEnv } from "../environment";
+import type { FeatureEnablement } from "../feature-flags";
+import { Feature } from "../feature-flags/features";
+import { Logger } from "../logging";
+import { getRepositoryNwoFromEnv } from "../repository";
+import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "../util";
+
+/** The filename used to persist PR diff ranges. */
+const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
+
+/**
+ * Gets the full path of the file used to persist PR diff ranges.
+ */
+export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
+  return path.join(
+    actionsUtil.getTemporaryDirectory(env),
+    PR_DIFF_RANGE_JSON_FILENAME,
+  );
+}

 /**
 * This interface is an abbreviated version of the file diff object returned by
 * the GitHub API.
 */
-interface FileDiff {
+export interface FileDiff {
+  /** The name of the file that has changed. */
  filename: string;
+  /** The number of changes. */
  changes: number;
-  // A patch may be absent if the file is binary, if the file diff is too large,
-  // or if the file is unchanged.
+  /**
+   * The diff, if available. It may be absent if the file is binary, if the file diff is too large,
+   * or if the file is unchanged.
+   */
  patch?: string | undefined;
 }

@@ -63,9 +83,10 @@ export async function getDiffInformedAnalysisBranches(
 *   and are therefore available for use, `false` otherwise.
 */
 export async function prepareDiffInformedAnalysis(
-  codeql: CodeQL,
-  features: FeatureEnablement,
  logger: Logger,
+  features: FeatureEnablement,
+  codeql: CodeQL,
+  jsonFilePath: string,
 ): Promise<boolean> {
  let branches: PullRequestBranches | undefined;
  try {
@@ -84,7 +105,7 @@ export async function prepareDiffInformedAnalysis(
  }

  try {
-    return await computeAndPersistDiffRanges(branches, logger);
+    return await computeAndPersistDiffRanges(logger, jsonFilePath, branches);
  } catch (e) {
    logger.warning(
      `Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
@@ -93,29 +114,45 @@ export async function prepareDiffInformedAnalysis(
  }
 }

+/** Describes a changed line range in a file. */
 export interface DiffThunkRange {
  /** Relative path from the repository root, using forward slashes as separators. */
  path: string;
+  /** The starting line of the change (1-based and inclusive). */
  startLine: number;
+  /** The last line of the change (1-based and inclusive). */
  endLine: number;
 }

+/**
+ * Writes an array of {@link DiffThunkRange} objects to the file given by {@link jsonFilePath}.
+ *
+ * @param logger The logger to use.
+ * @param jsonFilePath The path of the file to write.
+ * @param ranges The changed line ranges to write.
+ */
 export function writeDiffRangesJsonFile(
  logger: Logger,
+  jsonFilePath: string,
  ranges: DiffThunkRange[],
 ): void {
  const jsonContents = JSON.stringify(ranges, null, 2);
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
  fs.writeFileSync(jsonFilePath, jsonContents);
  logger.debug(
    `Wrote pr-diff-range JSON file to ${jsonFilePath}:\n${jsonContents}`,
  );
 }

+/**
+ * Reads an array of {@link DiffThunkRange} objects from the file given by {@link jsonFilePath}.
+ *
+ * @param logger The logger to use.
+ * @returns The array of {@link DiffThunkRange} objects or `undefined` if the file couldn't be read.
+ */
 export function readDiffRangesJsonFile(
  logger: Logger,
+  jsonFilePath: string,
 ): DiffThunkRange[] | undefined {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
  if (!fs.existsSync(jsonFilePath)) {
    logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`);
    return undefined;
@@ -138,12 +175,12 @@ export function readDiffRangesJsonFile(
 * Return the file line ranges that were added or modified in the pull request.
 *
 * @param branches The base and head branches of the pull request.
- * @param logger
- * @returns An array of tuples, where each tuple contains the relative path of a
- * file (relative to the repository root, as returned by the GitHub compare API),
- * the start line and the end line (both 1-based and inclusive) of an
- * added or modified range in that file. Returns `undefined` if the action was
- * not triggered by a pull request or if there was an error.
+ * @param logger The logger to use.
+ *
+ * @returns
+ *  An array of {@link DiffThunkRange} objects, where each describes a line range in a file
+ *  that was changed in the pull request described by {@link branches} or `undefined` if
+ *  we were unable to compute them.
 */
 export async function getPullRequestEditedDiffRanges(
  branches: PullRequestBranches,
@@ -180,22 +217,25 @@ export async function getPullRequestEditedDiffRanges(
 * diff from the GitHub API and writes it to the diff ranges JSON file so that
 * CodeQL can use it for diff-informed analysis.
 *
+ * @param logger The logger to use.
+ * @param jsonFilePath The path of the JSON file to write.
 * @param branches The base and head branches of the pull request, as returned
 *   by `getDiffInformedAnalysisBranches`.
- * @param logger
+ *
 * @returns `true` if the diff ranges were successfully computed and persisted,
 *   otherwise `false`.
 */
 export async function computeAndPersistDiffRanges(
-  branches: PullRequestBranches,
  logger: Logger,
+  jsonFilePath: string,
+  branches: PullRequestBranches,
 ): Promise<boolean> {
  logger.info("Computing PR diff ranges...");
  const ranges = await getPullRequestEditedDiffRanges(branches, logger);
  if (ranges === undefined) {
    return false;
  }
-  writeDiffRangesJsonFile(logger, ranges);
+  writeDiffRangesJsonFile(logger, jsonFilePath, ranges);
  const distinctFiles = new Set(ranges.map((r) => r.path)).size;
  logger.info(
    `Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
@@ -203,6 +243,19 @@ export async function computeAndPersistDiffRanges(
  return true;
 }

+/**
+ * Fetch an array of {@link FileDiff} objects using the GitHub API describing the changed files
+ * in the pull request with the base and head refs given by {@link branches}.
+ *
+ * @param branches The pull request branch refs.
+ * @param logger The logger to use.
+ *
+ * @throws Non-HTTP errors that occur while fetching the file diffs.
+ *
+ * @returns
+ *  An array of {@link FileDiff} objects describing the changed files in the PR, or
+ *  `undefined` if we couldn't obtain the changed files from the API.
+ */
 async function getFileDiffsWithBasehead(
  branches: PullRequestBranches,
  logger: Logger,
@@ -243,6 +296,16 @@ async function getFileDiffsWithBasehead(
  }
 }

+/**
+ * Extracts an array of {@link DiffThunkRange} objects from {@link fileDiff}.
+ *
+ * @param fileDiff The {@link FileDiff} object describing changes to a particular file.
+ * @param logger The logger to use.
+ *
+ * @returns
+ *  The {@link DiffThunkRange} objects extracted from {@link fileDiff},
+ *  or `undefined` if there are none that could be extracted.
+ */
 function getDiffRanges(
  fileDiff: FileDiff,
  logger: Logger,
@@ -5,6 +5,7 @@ import test from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "../actions-util";
+import * as diffInformed from "../diff-informed";
 import * as gitUtils from "../git-utils";
 import {
  createTestConfig,
@@ -60,7 +61,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
      const changesFilePath = await writeOverlayChangesFile(
@@ -126,7 +127,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);

@@ -196,7 +197,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);

@@ -259,7 +260,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      // getGitRoot returns the repo root (parent of sourceRoot)
      sinon.stub(gitUtils, "getGitRoot").resolves(repoRoot);
@@ -1,9 +1,9 @@
 import * as fs from "fs";
 import * as path from "path";

-import * as actionsUtil from "../actions-util";
 import { getOptionalInput, getTemporaryDirectory } from "../actions-util";
 import { type Config } from "../config-utils";
+import { getDiffRangesJsonFilePath } from "../diff-informed";
 import { getFileOidsUnderPath, getGitRoot } from "../git-utils";
 import { Logger } from "../logging";
 import { getBaseDatabaseOidsFilePath } from "../util";
@@ -135,7 +135,7 @@ async function getDiffRangeFilePaths(
  sourceRoot: string,
  logger: Logger,
 ): Promise<string[]> {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
+  const jsonFilePath = getDiffRangesJsonFilePath();

  if (!fs.existsSync(jsonFilePath)) {
    logger.debug(
@@ -1821,8 +1821,7 @@ function createToolcacheEntry(
 /**
 * Stubs out the download and the diagnostic sink, then downloads the CodeQL tools.
 *
- * @returns the extraction directory and, if the toolcache cleanup diagnostic was emitted, the
- * cleanup duration it reports and its other attributes.
+ * @returns the extraction directory and the toolcache cleanup diagnostic, if emitted.
 */
 async function runDownloadCodeQL(
  toolcacheRoot: string,
@@ -1838,7 +1837,6 @@ async function runDownloadCodeQL(
 ): Promise<{
  codeqlFolder: string;
  cleanupDiagnostic: toolsDownload.ToolcacheCleanupResult | undefined;
-  cleanupDurationMs: number | undefined;
 }> {
  stubDownloadAndExtract();
  const addDiagnostic = sinon.stub(diagnostics, "addNoLanguageDiagnostic");
@@ -1868,21 +1866,11 @@ async function runDownloadCodeQL(
    .map((call) => call.args[1])
    .find((d) => d.source?.id === "codeql-action/toolcache-bundle-cleanup");

-  if (diagnostic === undefined) {
-    return {
-      codeqlFolder,
-      cleanupDiagnostic: undefined,
-      cleanupDurationMs: undefined,
-    };
-  }
-
-  // The duration varies between runs, so split it out to let tests compare the other attributes
-  // exactly.
-  const { durationMs, ...cleanupDiagnostic } =
-    diagnostic.attributes as toolsDownload.ToolcacheCleanupResult & {
-      durationMs: number;
-    };
-  return { codeqlFolder, cleanupDiagnostic, cleanupDurationMs: durationMs };
+  return {
+    codeqlFolder,
+    cleanupDiagnostic: diagnostic?.attributes as
+      toolsDownload.ToolcacheCleanupResult | undefined,
+  };
 }

 /**
@@ -2003,35 +1991,6 @@ test.serial(
  },
 );

-test.serial(
-  "downloadCodeQLBundle reports the total time taken to clean up the toolcache",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-
-      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_CLI_VERSION);
-      createToolcacheEntry(tmpDir, "CodeQL", CLEANUP_STALE_VERSION);
-
-      // Advance the clock by 1.5s each time a path is deleted, so that deleting both versions
-      // takes 3s.
-      let elapsedMs = 1000;
-      sinon.stub(performance, "now").callsFake(() => elapsedMs);
-      const rm = fs.promises.rm;
-      sinon.stub(fs.promises, "rm").callsFake(async (...args) => {
-        elapsedMs += 1500;
-        await rm(...args);
-      });
-
-      const { cleanupDurationMs } = await runDownloadCodeQL(
-        tmpDir,
-        CLEANUP_BUNDLE_VERSION,
-      );
-
-      t.is(cleanupDurationMs, 3000);
-    });
-  },
-);
-
 test.serial(
  "downloadCodeQLBundle reports no deleted versions when the toolcache has no CodeQL bundles",
  async (t) => {
@@ -814,7 +814,6 @@ async function tryDeleteToolcacheBundles({
    return;
  }

-  const startTime = performance.now();
  const result = await deleteToolcacheBundles({ env, logger });

  addNoLanguageDiagnostic(
@@ -822,7 +821,7 @@ async function tryDeleteToolcacheBundles({
    makeTelemetryDiagnostic(
      "codeql-action/toolcache-bundle-cleanup",
      "Toolcache CodeQL bundle cleanup",
-      { ...result, durationMs: util.durationMsSince(startTime) },
+      { ...result },
    ),
  );
 }
@@ -342,16 +342,13 @@ export async function deleteToolcacheBundles({
      const versionDirectory = path.join(toolDirectory, entry.name);

      try {
-        const deletionStart = performance.now();
        await fs.promises.rm(versionDirectory, {
          force: true,
          recursive: true,
        });
        deletedVersions.push(entry.name);
        logger.info(
-          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space (${formatDuration(
-            durationMsSince(deletionStart),
-          )}).`,
+          `Deleted the CodeQL tools at '${versionDirectory}' from the toolcache to free up disk space.`,
        );
      } catch (e) {
        failed = true;
@@ -9,7 +9,7 @@ import * as sinon from "sinon";
 import * as analyses from "./analyses";
 import { AnalysisKind, CodeQuality, CodeScanning } from "./analyses";
 import * as api from "./api-client";
-import * as diffUtils from "./diff-informed-analysis-utils";
+import * as diffUtils from "./diff-informed";
 import { getEnv } from "./environment";
 import { Logger } from "./logging";
 import * as sarif from "./sarif";
@@ -1074,6 +1074,7 @@ function runFilterAlertsByDiffRange(
  logger: Logger = new RecordingLogger(),
 ): Partial<sarif.Log> {
  sinon.stub(diffUtils, "readDiffRangesJsonFile").returns(diffRanges);
+  sinon.stub(diffUtils, "getDiffRangesJsonFilePath").returns("");
  return uploadLib.filterAlertsByDiffRange(logger, input);
 }

@@ -13,7 +13,10 @@ import * as api from "./api-client";
 import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import type { ActionConfig } from "./config/action-config";
-import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
+import {
+  getDiffRangesJsonFilePath,
+  readDiffRangesJsonFile,
+} from "./diff-informed";
 import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
@@ -1079,7 +1082,10 @@ export function filterAlertsByDiffRange(
  logger: Logger,
  sarifLog: Partial<sarif.Log>,
 ): Partial<sarif.Log> {
-  const diffRanges = readDiffRangesJsonFile(logger);
+  const diffRanges = readDiffRangesJsonFile(
+    logger,
+    getDiffRangesJsonFilePath(),
+  );
  if (!diffRanges?.length) {
    return sarifLog;
  }
@@ -0,0 +1 @@
+- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
Author	SHA1	Message	Date
Michael B. Gale	c29d405e42	Move `getDiffRangesJsonFilePath` to `diff-informed/index.ts`	2026-11-04 15:00:19 +00:00
Michael B. Gale	8c16574468	Make `jsonFilePath` an explicit input to functions in `diff-informed/index.ts`	2026-11-04 14:34:23 +00:00
Michael B. Gale	3a4f195d36	Improve JSDocs in `diff-informed/index.ts`	2026-11-04 13:24:10 +00:00
Michael B. Gale	2465f77e2e	Move `diff-informed` utils to subfolder	2026-11-04 13:24:10 +00:00
				`@@ -0,0 +1 @@`
				`- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)`