Merge pull request #4303 from github/mergeback/v4.39.3-to-main-33d7b85d

Mergeback v4.39.3 refs/heads/releases/v4 into main

CHANGELOG.md

@@ -6,6 +6,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 No user facing changes.
 
+## 4.39.3 - 04 Nov 2026
+
+- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
+
 ## 4.39.2 - 03 Nov 2026
 
 - Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.3",
+      "version": "4.39.4",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -59,7 +59,7 @@
         "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jsdoc": "^65.4.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
-        "glob": "^13.0.6",
+        "glob": "^14.0.3",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
         "prettier": "^3.9.10",
@@ -1811,6 +1811,12 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
+      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@mapbox/node-pre-gyp": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -3524,7 +3530,6 @@
     },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -3534,7 +3539,6 @@
       "version": "6.2.3",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
       "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -4439,7 +4443,6 @@
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -4450,7 +4453,6 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/comment-parser": {
@@ -4575,7 +4577,6 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "dev": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -4830,7 +4831,6 @@
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-abstract": {
@@ -6273,14 +6273,14 @@
       }
     },
     "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
+      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.2",
+        "minimatch": "^11.0.2",
         "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
+        "path-scurry": "^3.0.0"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6324,12 +6324,13 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
+      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "@isaacs/nonrecursive-glob-match": "^1.0.2",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6858,7 +6859,6 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7169,7 +7169,6 @@
     },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/js-string-escape": {
@@ -7479,9 +7478,9 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="
     },
     "node_modules/lru-cache": {
-      "version": "11.5.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
-      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -8572,7 +8571,6 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8584,9 +8582,9 @@
       "license": "MIT"
     },
     "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
@@ -9172,7 +9170,6 @@
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -9183,7 +9180,6 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -9269,7 +9265,6 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "dev": true,
       "engines": {
         "node": ">=14"
       },
@@ -9456,7 +9451,6 @@
     },
     "node_modules/string-width": {
       "version": "4.2.3",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -9542,7 +9536,6 @@
     },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -10280,7 +10273,6 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.4",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -69,7 +69,7 @@
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-jsdoc": "^65.4.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^13.0.6",
+    "glob": "^14.0.3",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
     "prettier": "^3.9.10",
@@ -96,7 +96,7 @@
     "eslint-plugin-jsx-a11y": {
       "semver": ">=6.3.1"
     },
-    "glob": "^13.0.6",
+    "glob": "^14.0.3",
     "undici": "^7.30.1"
   }
 }

src/actions-util.ts

@@ -78,6 +78,12 @@ export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
   );
 }
 
+const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
+
+export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
+  return path.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
+}
+
 export function getActionVersion(): string {
   return __CODEQL_ACTION_VERSION__;
 }

src/analyze.ts

@@ -19,10 +19,9 @@ import {
 } from "./dependency-caching";
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
-  type DiffThunkRange,
-  getDiffRangesJsonFilePath,
+  DiffThunkRange,
   readDiffRangesJsonFile,
-} from "./diff-informed";
+} from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
 import { getGitRoot } from "./git-utils";
@@ -296,10 +295,7 @@ export async function setupDiffInformedQueryRun(
   return await withGroupAsync(
     "Generating diff range extension pack",
     async () => {
-      const diffRanges = readDiffRangesJsonFile(
-        logger,
-        getDiffRangesJsonFilePath(),
-      );
+      const diffRanges = readDiffRangesJsonFile(logger);
       if (diffRanges === undefined) {
         logger.info(
           "No precomputed diff ranges found; skipping diff-informed analysis stage.",

src/config-utils.test.ts

@@ -15,7 +15,6 @@ import { createStubCodeQL } from "./codeql";
 import { UserConfig } from "./config/db-config";
 import * as file from "./config/file";
 import * as configUtils from "./config-utils";
-import { ActionsEnvVars } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
@@ -43,7 +42,6 @@ import {
   SAMPLE_DOTCOM_API_DETAILS,
   AssertableTarget,
   RecordingLogger,
-  getTestEnv,
 } from "./testing-utils";
 import {
   GitHubVariant,
@@ -153,11 +151,9 @@ function mockListLanguages(languages: string[]) {
 test.serial("load empty config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
-
     const languages = "javascript,python";
 
-    setupActionsVars(tempDir, tempDir, {}, state.env);
+    setupActionsVars(tempDir, tempDir);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -170,6 +166,7 @@ test.serial("load empty config", async (t) => {
       },
     });
 
+    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -200,10 +197,9 @@ test.serial("load empty config", async (t) => {
 test.serial("load code quality config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
     const languages = "actions";
 
-    setupActionsVars(tempDir, tempDir, {}, state.env);
+    setupActionsVars(tempDir, tempDir);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -215,6 +211,7 @@ test.serial("load code quality config", async (t) => {
       },
     });
 
+    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -256,10 +253,9 @@ test.serial(
   async (t) => {
     return await withTmpDir(async (tempDir) => {
       const logger = new RecordingLogger();
-      const state = initAllState({ logger });
       const languages = "javascript";
 
-      setupActionsVars(tempDir, tempDir, {}, state.env);
+      setupActionsVars(tempDir, tempDir);
 
       const codeql = createStubCodeQL({
         async resolveLanguages() {
@@ -295,6 +291,7 @@ test.serial(
         repositoryProperties,
       });
 
+      const state = initAllState({ logger });
       await t.notThrowsAsync(async () => {
         const config = await configUtils.initConfig(
           state,
@@ -319,8 +316,6 @@ test.serial(
 test.serial("loading a saved config produces the same config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
-    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -339,6 +334,7 @@ test.serial("loading a saved config produces the same config", async (t) => {
     // Sanity check that getConfig returns undefined before we have called initConfig
     t.deepEqual(await configUtils.getConfig(tempDir, logger), undefined);
 
+    const state = initAllState({ logger });
     const config1 = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -368,8 +364,6 @@ test.serial("loading a saved config produces the same config", async (t) => {
 test.serial("loading config with version mismatch throws", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
-    const state = initAllState({ logger });
-    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -393,6 +387,7 @@ test.serial("loading config with version mismatch throws", async (t) => {
       .stub(actionsUtil, "getActionVersion")
       .returns("does-not-exist");
 
+    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -502,8 +497,7 @@ const otherConfigFileContents = `
 
 test.serial("load non-empty input", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    const state = initAllState();
-    setupActionsVars(tempDir, tempDir, {}, state.env);
+    setupActionsVars(tempDir, tempDir);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -544,6 +538,7 @@ test.serial("load non-empty input", async (t) => {
     const languagesInput = "javascript";
     const configFilePath = createConfigFile(otherConfigFileContents, tempDir);
 
+    const state = initAllState();
     const actualConfig = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -662,9 +657,7 @@ test.serial("API client used when reading remote config", async (t) => {
     const configFile = "octo-org/codeql-config/config.yaml@main";
     const languagesInput = "javascript";
 
-    const state = initAllState({
-      env: getTestEnv({ [ActionsEnvVars.RUNNER_TEMP]: tempDir }),
-    });
+    const state = initAllState();
     await configUtils.initConfig(
       state,
       createTestInitConfigInputs({

src/config-utils.ts

@@ -48,10 +48,7 @@ import {
   addNoLanguageDiagnostic,
   makeTelemetryDiagnostic,
 } from "./diagnostics";
-import {
-  getDiffRangesJsonFilePath,
-  prepareDiffInformedAnalysis,
-} from "./diff-informed";
+import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
 import { EnvVar, exportEnvVar, getEnv } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
@@ -1291,10 +1288,9 @@ export async function initConfig(
   }
 
   const hasDiffRanges = await prepareDiffInformedAnalysis(
-    logger,
-    inputs.features,
     inputs.codeql,
-    getDiffRangesJsonFilePath(actionState.env),
+    inputs.features,
+    logger,
   );
 
   await applyIncrementalAnalysisSettings(

src/diff-informed-analysis-utils.test.ts

@@ -1,12 +1,16 @@
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
 
-import * as actionsUtil from "../actions-util";
-import type { PullRequestBranches } from "../actions-util";
-import * as apiClient from "../api-client";
-import { getEnv } from "../environment";
-import { Feature, FeatureEnablement, initFeatures } from "../feature-flags";
-import { parseRepositoryNwo } from "../repository";
+import * as actionsUtil from "./actions-util";
+import type { PullRequestBranches } from "./actions-util";
+import * as apiClient from "./api-client";
+import {
+  getDiffInformedAnalysisBranches,
+  prepareDiffInformedAnalysis,
+  exportedForTesting,
+} from "./diff-informed-analysis-utils";
+import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
+import { parseRepositoryNwo } from "./repository";
 import {
   setupTests,
   createFeatures,
@@ -15,16 +19,9 @@ import {
   setupActionsVars,
   makeMacro,
   RecordingLogger,
-} from "../testing-utils";
-import { GitHubVariant, withTmpDir } from "../util";
-import type { GitHubVersion } from "../util";
-
-import {
-  getDiffInformedAnalysisBranches,
-  prepareDiffInformedAnalysis,
-  exportedForTesting,
-  getDiffRangesJsonFilePath,
-} from ".";
+} from "./testing-utils";
+import { GitHubVariant, withTmpDir } from "./util";
+import type { GitHubVersion } from "./util";
 
 setupTests(test);
 
@@ -195,10 +192,9 @@ test.serial(
         .resolves({ type: GitHubVariant.DOTCOM });
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.false(result);
@@ -226,10 +222,9 @@ test.serial(
       };
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.false(result);
@@ -264,10 +259,9 @@ test.serial(
       } as any);
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.true(result);
@@ -302,10 +296,9 @@ test.serial(
       } as any);
 
       const result = await prepareDiffInformedAnalysis(
-        logger,
-        features,
         codeql,
-        getDiffRangesJsonFilePath(getEnv()),
+        features,
+        logger,
       );
 
       t.false(result);

src/diff-informed-analysis-utils.ts

@@ -1,43 +1,23 @@
 import * as fs from "fs";
-import path from "path";
 
-import * as actionsUtil from "../actions-util";
-import type { PullRequestBranches } from "../actions-util";
-import { getApiClient, getGitHubVersion } from "../api-client";
-import type { CodeQL } from "../codeql";
-import { type Env, getEnv } from "../environment";
-import type { FeatureEnablement } from "../feature-flags";
-import { Feature } from "../feature-flags/features";
-import { Logger } from "../logging";
-import { getRepositoryNwoFromEnv } from "../repository";
-import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "../util";
-
-/** The filename used to persist PR diff ranges. */
-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-/**
- * Gets the full path of the file used to persist PR diff ranges.
- */
-export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
-  return path.join(
-    actionsUtil.getTemporaryDirectory(env),
-    PR_DIFF_RANGE_JSON_FILENAME,
-  );
-}
+import * as actionsUtil from "./actions-util";
+import type { PullRequestBranches } from "./actions-util";
+import { getApiClient, getGitHubVersion } from "./api-client";
+import type { CodeQL } from "./codeql";
+import { Feature, FeatureEnablement } from "./feature-flags";
+import { Logger } from "./logging";
+import { getRepositoryNwoFromEnv } from "./repository";
+import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
 
 /**
  * This interface is an abbreviated version of the file diff object returned by
  * the GitHub API.
  */
-export interface FileDiff {
-  /** The name of the file that has changed. */
+interface FileDiff {
   filename: string;
-  /** The number of changes. */
   changes: number;
-  /**
-   * The diff, if available. It may be absent if the file is binary, if the file diff is too large,
-   * or if the file is unchanged.
-   */
+  // A patch may be absent if the file is binary, if the file diff is too large,
+  // or if the file is unchanged.
   patch?: string | undefined;
 }
 
@@ -83,10 +63,9 @@ export async function getDiffInformedAnalysisBranches(
  *   and are therefore available for use, `false` otherwise.
  */
 export async function prepareDiffInformedAnalysis(
-  logger: Logger,
-  features: FeatureEnablement,
   codeql: CodeQL,
-  jsonFilePath: string,
+  features: FeatureEnablement,
+  logger: Logger,
 ): Promise<boolean> {
   let branches: PullRequestBranches | undefined;
   try {
@@ -105,7 +84,7 @@ export async function prepareDiffInformedAnalysis(
   }
 
   try {
-    return await computeAndPersistDiffRanges(logger, jsonFilePath, branches);
+    return await computeAndPersistDiffRanges(branches, logger);
   } catch (e) {
     logger.warning(
       `Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
@@ -114,45 +93,29 @@ export async function prepareDiffInformedAnalysis(
   }
 }
 
-/** Describes a changed line range in a file. */
 export interface DiffThunkRange {
   /** Relative path from the repository root, using forward slashes as separators. */
   path: string;
-  /** The starting line of the change (1-based and inclusive). */
   startLine: number;
-  /** The last line of the change (1-based and inclusive). */
   endLine: number;
 }
 
-/**
- * Writes an array of {@link DiffThunkRange} objects to the file given by {@link jsonFilePath}.
- *
- * @param logger The logger to use.
- * @param jsonFilePath The path of the file to write.
- * @param ranges The changed line ranges to write.
- */
 export function writeDiffRangesJsonFile(
   logger: Logger,
-  jsonFilePath: string,
   ranges: DiffThunkRange[],
 ): void {
   const jsonContents = JSON.stringify(ranges, null, 2);
+  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
   fs.writeFileSync(jsonFilePath, jsonContents);
   logger.debug(
     `Wrote pr-diff-range JSON file to ${jsonFilePath}:\n${jsonContents}`,
   );
 }
 
-/**
- * Reads an array of {@link DiffThunkRange} objects from the file given by {@link jsonFilePath}.
- *
- * @param logger The logger to use.
- * @returns The array of {@link DiffThunkRange} objects or `undefined` if the file couldn't be read.
- */
 export function readDiffRangesJsonFile(
   logger: Logger,
-  jsonFilePath: string,
 ): DiffThunkRange[] | undefined {
+  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
   if (!fs.existsSync(jsonFilePath)) {
     logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`);
     return undefined;
@@ -175,12 +138,12 @@ export function readDiffRangesJsonFile(
  * Return the file line ranges that were added or modified in the pull request.
  *
  * @param branches The base and head branches of the pull request.
- * @param logger The logger to use.
- *
- * @returns
- *  An array of {@link DiffThunkRange} objects, where each describes a line range in a file
- *  that was changed in the pull request described by {@link branches} or `undefined` if
- *  we were unable to compute them.
+ * @param logger
+ * @returns An array of tuples, where each tuple contains the relative path of a
+ * file (relative to the repository root, as returned by the GitHub compare API),
+ * the start line and the end line (both 1-based and inclusive) of an
+ * added or modified range in that file. Returns `undefined` if the action was
+ * not triggered by a pull request or if there was an error.
  */
 export async function getPullRequestEditedDiffRanges(
   branches: PullRequestBranches,
@@ -217,25 +180,22 @@ export async function getPullRequestEditedDiffRanges(
  * diff from the GitHub API and writes it to the diff ranges JSON file so that
  * CodeQL can use it for diff-informed analysis.
  *
- * @param logger The logger to use.
- * @param jsonFilePath The path of the JSON file to write.
  * @param branches The base and head branches of the pull request, as returned
  *   by `getDiffInformedAnalysisBranches`.
- *
+ * @param logger
  * @returns `true` if the diff ranges were successfully computed and persisted,
  *   otherwise `false`.
  */
 export async function computeAndPersistDiffRanges(
-  logger: Logger,
-  jsonFilePath: string,
   branches: PullRequestBranches,
+  logger: Logger,
 ): Promise<boolean> {
   logger.info("Computing PR diff ranges...");
   const ranges = await getPullRequestEditedDiffRanges(branches, logger);
   if (ranges === undefined) {
     return false;
   }
-  writeDiffRangesJsonFile(logger, jsonFilePath, ranges);
+  writeDiffRangesJsonFile(logger, ranges);
   const distinctFiles = new Set(ranges.map((r) => r.path)).size;
   logger.info(
     `Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
@@ -243,19 +203,6 @@ export async function computeAndPersistDiffRanges(
   return true;
 }
 
-/**
- * Fetch an array of {@link FileDiff} objects using the GitHub API describing the changed files
- * in the pull request with the base and head refs given by {@link branches}.
- *
- * @param branches The pull request branch refs.
- * @param logger The logger to use.
- *
- * @throws Non-HTTP errors that occur while fetching the file diffs.
- *
- * @returns
- *  An array of {@link FileDiff} objects describing the changed files in the PR, or
- *  `undefined` if we couldn't obtain the changed files from the API.
- */
 async function getFileDiffsWithBasehead(
   branches: PullRequestBranches,
   logger: Logger,
@@ -296,16 +243,6 @@ async function getFileDiffsWithBasehead(
   }
 }
 
-/**
- * Extracts an array of {@link DiffThunkRange} objects from {@link fileDiff}.
- *
- * @param fileDiff The {@link FileDiff} object describing changes to a particular file.
- * @param logger The logger to use.
- *
- * @returns
- *  The {@link DiffThunkRange} objects extracted from {@link fileDiff},
- *  or `undefined` if there are none that could be extracted.
- */
 function getDiffRanges(
   fileDiff: FileDiff,
   logger: Logger,

src/overlay/index.test.ts

@@ -5,7 +5,6 @@ import test from "ava";
 import * as sinon from "sinon";
 
 import * as actionsUtil from "../actions-util";
-import * as diffInformed from "../diff-informed";
 import * as gitUtils from "../git-utils";
 import {
   createTestConfig,
@@ -61,7 +60,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
       const changesFilePath = await writeOverlayChangesFile(
@@ -127,7 +126,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
 
@@ -197,7 +196,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
 
@@ -260,7 +259,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(diffInformed, "getDiffRangesJsonFilePath")
+        .stub(actionsUtil, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       // getGitRoot returns the repo root (parent of sourceRoot)
       sinon.stub(gitUtils, "getGitRoot").resolves(repoRoot);

src/overlay/index.ts

@@ -1,9 +1,9 @@
 import * as fs from "fs";
 import * as path from "path";
 
+import * as actionsUtil from "../actions-util";
 import { getOptionalInput, getTemporaryDirectory } from "../actions-util";
 import { type Config } from "../config-utils";
-import { getDiffRangesJsonFilePath } from "../diff-informed";
 import { getFileOidsUnderPath, getGitRoot } from "../git-utils";
 import { Logger } from "../logging";
 import { getBaseDatabaseOidsFilePath } from "../util";
@@ -135,7 +135,7 @@ async function getDiffRangeFilePaths(
   sourceRoot: string,
   logger: Logger,
 ): Promise<string[]> {
-  const jsonFilePath = getDiffRangesJsonFilePath();
+  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
 
   if (!fs.existsSync(jsonFilePath)) {
     logger.debug(

src/upload-lib.test.ts

@@ -9,7 +9,7 @@ import * as sinon from "sinon";
 import * as analyses from "./analyses";
 import { AnalysisKind, CodeQuality, CodeScanning } from "./analyses";
 import * as api from "./api-client";
-import * as diffUtils from "./diff-informed";
+import * as diffUtils from "./diff-informed-analysis-utils";
 import { getEnv } from "./environment";
 import { Logger } from "./logging";
 import * as sarif from "./sarif";
@@ -1074,7 +1074,6 @@ function runFilterAlertsByDiffRange(
   logger: Logger = new RecordingLogger(),
 ): Partial<sarif.Log> {
   sinon.stub(diffUtils, "readDiffRangesJsonFile").returns(diffRanges);
-  sinon.stub(diffUtils, "getDiffRangesJsonFilePath").returns("");
   return uploadLib.filterAlertsByDiffRange(logger, input);
 }
 

src/upload-lib.ts

@@ -13,10 +13,7 @@ import * as api from "./api-client";
 import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import type { ActionConfig } from "./config/action-config";
-import {
-  getDiffRangesJsonFilePath,
-  readDiffRangesJsonFile,
-} from "./diff-informed";
+import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
 import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
@@ -1082,10 +1079,7 @@ export function filterAlertsByDiffRange(
   logger: Logger,
   sarifLog: Partial<sarif.Log>,
 ): Partial<sarif.Log> {
-  const diffRanges = readDiffRangesJsonFile(
-    logger,
-    getDiffRangesJsonFilePath(),
-  );
+  const diffRanges = readDiffRangesJsonFile(logger);
   if (!diffRanges?.length) {
     return sarifLog;
   }

unreleased-change-notes/decode-diff-informed-sarif-uris.md

@@ -1 +0,0 @@
-- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)