Add basic change detection framework

package-lock.json

@@ -33,6 +33,7 @@
         "js-yaml": "^5.5.0",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
+        "minimatch": "^11.0.2",
         "node-forge": "^1.4.1",
         "semver": "^7.8.5",
         "undici": "^7.30.1",
@@ -564,6 +565,28 @@
         "minimatch": "^3.0.4"
       }
     },
+    "node_modules/@actions/glob/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@actions/glob/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@actions/http-client": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
@@ -1556,6 +1579,30 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/config-array/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@eslint/config-helpers": {
       "version": "0.4.2",
       "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
@@ -1619,6 +1666,17 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/globals": {
       "version": "14.0.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
@@ -1655,6 +1713,19 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@eslint/js": {
       "version": "9.39.5",
       "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz",
@@ -1764,6 +1835,30 @@
         "node": ">=10.10.0"
       }
     },
+    "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@humanwhocodes/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "dev": true,
@@ -1811,6 +1906,12 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
+      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@mapbox/node-pre-gyp": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -1899,6 +2000,17 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/@microsoft/eslint-formatter-sarif/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@microsoft/eslint-formatter-sarif/node_modules/chalk": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
@@ -2114,6 +2226,19 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/@microsoft/eslint-formatter-sarif/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@mswjs/interceptors": {
       "version": "0.41.3",
       "resolved": "https://registry.npmjs.org/@mswjs/interceptors/-/interceptors-0.41.3.tgz",
@@ -3002,29 +3127,6 @@
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -4078,13 +4180,24 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/brace-expansion/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/braces": {
@@ -4487,6 +4600,8 @@
     },
     "node_modules/concat-map": {
       "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
       "license": "MIT"
     },
     "node_modules/concordance": {
@@ -5377,29 +5492,6 @@
         }
       }
     },
-    "node_modules/eslint-plugin-import-x/node_modules/balanced-match": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.3.tgz",
-      "integrity": "sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": {
-      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/eslint-plugin-import-x/node_modules/minimatch": {
       "version": "10.2.4",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
@@ -5416,6 +5508,17 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/eslint-plugin-import/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint-plugin-import/node_modules/debug": {
       "version": "3.2.7",
       "dev": true,
@@ -5424,6 +5527,19 @@
         "ms": "^2.1.1"
       }
     },
+    "node_modules/eslint-plugin-import/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-jsdoc": {
       "version": "65.4.0",
       "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.4.0.tgz",
@@ -5553,6 +5669,17 @@
         "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9"
       }
     },
+    "node_modules/eslint-plugin-jsx-a11y/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint-plugin-jsx-a11y/node_modules/emoji-regex": {
       "version": "9.2.2",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
@@ -5560,6 +5687,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/eslint-plugin-jsx-a11y/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-no-async-foreach": {
       "version": "0.1.1",
       "dev": true,
@@ -5674,6 +5814,17 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint/node_modules/chalk": {
       "version": "4.1.0",
       "dev": true,
@@ -5724,6 +5875,19 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/eslint/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/espree": {
       "version": "10.4.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
@@ -6302,27 +6466,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/glob/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/glob/node_modules/minimatch": {
       "version": "10.2.4",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
@@ -8083,15 +8226,19 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
-      "license": "ISC",
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
+      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^1.1.7"
+        "@isaacs/nonrecursive-glob-match": "^1.0.2",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "*"
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/minimist": {
@@ -8802,27 +8949,6 @@
         "url": "https://github.com/sponsors/yqnn"
       }
     },
-    "node_modules/readdir-glob/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/readdir-glob/node_modules/brace-expansion": {
-      "version": "5.0.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
-      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/readdir-glob/node_modules/minimatch": {
       "version": "10.2.5",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@@ -10570,7 +10696,7 @@
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-        "glob": "^13.0.6",
+        "glob": "^14.0.3",
         "lite-matter": "^0.1.2",
         "mdast-util-from-markdown": "^2.1.0",
         "semver": "^7.8.5",

package.json

@@ -43,6 +43,7 @@
     "js-yaml": "^5.5.0",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
+    "minimatch": "^11.0.2",
     "node-forge": "^1.4.1",
     "semver": "^7.8.5",
     "undici": "^7.30.1",

src/actions-util.ts

@@ -78,12 +78,6 @@ export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
   );
 }
 
-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
-  return path.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
-}
-
 export function getActionVersion(): string {
   return __CODEQL_ACTION_VERSION__;
 }

src/analyze.ts

@@ -19,9 +19,10 @@ import {
 } from "./dependency-caching";
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
-  DiffThunkRange,
+  type DiffThunkRange,
+  getDiffRangesJsonFilePath,
   readDiffRangesJsonFile,
-} from "./diff-informed-analysis-utils";
+} from "./diff-informed";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
 import { getGitRoot } from "./git-utils";
@@ -295,7 +296,10 @@ export async function setupDiffInformedQueryRun(
   return await withGroupAsync(
     "Generating diff range extension pack",
     async () => {
-      const diffRanges = readDiffRangesJsonFile(logger);
+      const diffRanges = readDiffRangesJsonFile(
+        logger,
+        getDiffRangesJsonFilePath(),
+      );
       if (diffRanges === undefined) {
         logger.info(
           "No precomputed diff ranges found; skipping diff-informed analysis stage.",

src/config-utils.test.ts

@@ -15,6 +15,7 @@ import { createStubCodeQL } from "./codeql";
 import { UserConfig } from "./config/db-config";
 import * as file from "./config/file";
 import * as configUtils from "./config-utils";
+import { ActionsEnvVars } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
@@ -42,6 +43,7 @@ import {
   SAMPLE_DOTCOM_API_DETAILS,
   AssertableTarget,
   RecordingLogger,
+  getTestEnv,
 } from "./testing-utils";
 import {
   GitHubVariant,
@@ -151,9 +153,11 @@ function mockListLanguages(languages: string[]) {
 test.serial("load empty config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+
     const languages = "javascript,python";
 
-    setupActionsVars(tempDir, tempDir);
+    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -166,7 +170,6 @@ test.serial("load empty config", async (t) => {
       },
     });
 
-    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -197,9 +200,10 @@ test.serial("load empty config", async (t) => {
 test.serial("load code quality config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
+    const state = initAllState({ logger });
     const languages = "actions";
 
-    setupActionsVars(tempDir, tempDir);
+    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -211,7 +215,6 @@ test.serial("load code quality config", async (t) => {
       },
     });
 
-    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -253,9 +256,10 @@ test.serial(
   async (t) => {
     return await withTmpDir(async (tempDir) => {
       const logger = new RecordingLogger();
+      const state = initAllState({ logger });
       const languages = "javascript";
 
-      setupActionsVars(tempDir, tempDir);
+      setupActionsVars(tempDir, tempDir, {}, state.env);
 
       const codeql = createStubCodeQL({
         async resolveLanguages() {
@@ -291,7 +295,6 @@ test.serial(
         repositoryProperties,
       });
 
-      const state = initAllState({ logger });
       await t.notThrowsAsync(async () => {
         const config = await configUtils.initConfig(
           state,
@@ -316,6 +319,8 @@ test.serial(
 test.serial("loading a saved config produces the same config", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -334,7 +339,6 @@ test.serial("loading a saved config produces the same config", async (t) => {
     // Sanity check that getConfig returns undefined before we have called initConfig
     t.deepEqual(await configUtils.getConfig(tempDir, logger), undefined);
 
-    const state = initAllState({ logger });
     const config1 = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -364,6 +368,8 @@ test.serial("loading a saved config produces the same config", async (t) => {
 test.serial("loading config with version mismatch throws", async (t) => {
   return await withTmpDir(async (tempDir) => {
     const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -387,7 +393,6 @@ test.serial("loading config with version mismatch throws", async (t) => {
       .stub(actionsUtil, "getActionVersion")
       .returns("does-not-exist");
 
-    const state = initAllState({ logger });
     const config = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -497,7 +502,8 @@ const otherConfigFileContents = `
 
 test.serial("load non-empty input", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    setupActionsVars(tempDir, tempDir);
+    const state = initAllState();
+    setupActionsVars(tempDir, tempDir, {}, state.env);
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -538,7 +544,6 @@ test.serial("load non-empty input", async (t) => {
     const languagesInput = "javascript";
     const configFilePath = createConfigFile(otherConfigFileContents, tempDir);
 
-    const state = initAllState();
     const actualConfig = await configUtils.initConfig(
       state,
       createTestInitConfigInputs({
@@ -657,7 +662,9 @@ test.serial("API client used when reading remote config", async (t) => {
     const configFile = "octo-org/codeql-config/config.yaml@main";
     const languagesInput = "javascript";
 
-    const state = initAllState();
+    const state = initAllState({
+      env: getTestEnv({ [ActionsEnvVars.RUNNER_TEMP]: tempDir }),
+    });
     await configUtils.initConfig(
       state,
       createTestInitConfigInputs({

src/config-utils.ts

@@ -48,7 +48,10 @@ import {
   addNoLanguageDiagnostic,
   makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
+import {
+  getDiffRangesJsonFilePath,
+  prepareDiffInformedAnalysis,
+} from "./diff-informed";
 import { EnvVar, exportEnvVar, getEnv } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
@@ -1288,9 +1291,10 @@ export async function initConfig(
   }
 
   const hasDiffRanges = await prepareDiffInformedAnalysis(
-    inputs.codeql,
-    inputs.features,
     logger,
+    inputs.features,
+    inputs.codeql,
+    getDiffRangesJsonFilePath(actionState.env),
   );
 
   await applyIncrementalAnalysisSettings(

src/diff-informed/index.test.ts

@@ -1,16 +1,12 @@
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
 
-import * as actionsUtil from "./actions-util";
-import type { PullRequestBranches } from "./actions-util";
-import * as apiClient from "./api-client";
-import {
-  getDiffInformedAnalysisBranches,
-  prepareDiffInformedAnalysis,
-  exportedForTesting,
-} from "./diff-informed-analysis-utils";
-import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
-import { parseRepositoryNwo } from "./repository";
+import * as actionsUtil from "../actions-util";
+import type { PullRequestBranches } from "../actions-util";
+import * as apiClient from "../api-client";
+import { getEnv } from "../environment";
+import { Feature, FeatureEnablement, initFeatures } from "../feature-flags";
+import { parseRepositoryNwo } from "../repository";
 import {
   setupTests,
   createFeatures,
@@ -19,9 +15,16 @@ import {
   setupActionsVars,
   makeMacro,
   RecordingLogger,
-} from "./testing-utils";
-import { GitHubVariant, withTmpDir } from "./util";
-import type { GitHubVersion } from "./util";
+} from "../testing-utils";
+import { GitHubVariant, withTmpDir } from "../util";
+import type { GitHubVersion } from "../util";
+
+import {
+  getDiffInformedAnalysisBranches,
+  prepareDiffInformedAnalysis,
+  exportedForTesting,
+  getDiffRangesJsonFilePath,
+} from ".";
 
 setupTests(test);
 
@@ -192,9 +195,10 @@ test.serial(
         .resolves({ type: GitHubVariant.DOTCOM });
 
       const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
         logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
       );
 
       t.false(result);
@@ -222,9 +226,10 @@ test.serial(
       };
 
       const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
         logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
       );
 
       t.false(result);
@@ -259,9 +264,10 @@ test.serial(
       } as any);
 
       const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
         logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
       );
 
       t.true(result);
@@ -296,9 +302,10 @@ test.serial(
       } as any);
 
       const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
         logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
       );
 
       t.false(result);

src/diff-informed/index.ts

@@ -1,23 +1,43 @@
 import * as fs from "fs";
+import path from "path";
 
-import * as actionsUtil from "./actions-util";
-import type { PullRequestBranches } from "./actions-util";
-import { getApiClient, getGitHubVersion } from "./api-client";
-import type { CodeQL } from "./codeql";
-import { Feature, FeatureEnablement } from "./feature-flags";
-import { Logger } from "./logging";
-import { getRepositoryNwoFromEnv } from "./repository";
-import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
+import * as actionsUtil from "../actions-util";
+import type { PullRequestBranches } from "../actions-util";
+import { getApiClient, getGitHubVersion } from "../api-client";
+import type { CodeQL } from "../codeql";
+import { type Env, getEnv } from "../environment";
+import type { FeatureEnablement } from "../feature-flags";
+import { Feature } from "../feature-flags/features";
+import { Logger } from "../logging";
+import { getRepositoryNwoFromEnv } from "../repository";
+import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "../util";
+
+/** The filename used to persist PR diff ranges. */
+const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
+
+/**
+ * Gets the full path of the file used to persist PR diff ranges.
+ */
+export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
+  return path.join(
+    actionsUtil.getTemporaryDirectory(env),
+    PR_DIFF_RANGE_JSON_FILENAME,
+  );
+}
 
 /**
  * This interface is an abbreviated version of the file diff object returned by
  * the GitHub API.
  */
-interface FileDiff {
+export interface FileDiff {
+  /** The name of the file that has changed. */
   filename: string;
+  /** The number of changes. */
   changes: number;
-  // A patch may be absent if the file is binary, if the file diff is too large,
-  // or if the file is unchanged.
+  /**
+   * The diff, if available. It may be absent if the file is binary, if the file diff is too large,
+   * or if the file is unchanged.
+   */
   patch?: string | undefined;
 }
 
@@ -63,9 +83,10 @@ export async function getDiffInformedAnalysisBranches(
  *   and are therefore available for use, `false` otherwise.
  */
 export async function prepareDiffInformedAnalysis(
-  codeql: CodeQL,
-  features: FeatureEnablement,
   logger: Logger,
+  features: FeatureEnablement,
+  codeql: CodeQL,
+  jsonFilePath: string,
 ): Promise<boolean> {
   let branches: PullRequestBranches | undefined;
   try {
@@ -84,7 +105,7 @@ export async function prepareDiffInformedAnalysis(
   }
 
   try {
-    return await computeAndPersistDiffRanges(branches, logger);
+    return await computeAndPersistDiffRanges(logger, jsonFilePath, branches);
   } catch (e) {
     logger.warning(
       `Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
@@ -93,29 +114,45 @@ export async function prepareDiffInformedAnalysis(
   }
 }
 
+/** Describes a changed line range in a file. */
 export interface DiffThunkRange {
   /** Relative path from the repository root, using forward slashes as separators. */
   path: string;
+  /** The starting line of the change (1-based and inclusive). */
   startLine: number;
+  /** The last line of the change (1-based and inclusive). */
   endLine: number;
 }
 
+/**
+ * Writes an array of {@link DiffThunkRange} objects to the file given by {@link jsonFilePath}.
+ *
+ * @param logger The logger to use.
+ * @param jsonFilePath The path of the file to write.
+ * @param ranges The changed line ranges to write.
+ */
 export function writeDiffRangesJsonFile(
   logger: Logger,
+  jsonFilePath: string,
   ranges: DiffThunkRange[],
 ): void {
   const jsonContents = JSON.stringify(ranges, null, 2);
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
   fs.writeFileSync(jsonFilePath, jsonContents);
   logger.debug(
     `Wrote pr-diff-range JSON file to ${jsonFilePath}:\n${jsonContents}`,
   );
 }
 
+/**
+ * Reads an array of {@link DiffThunkRange} objects from the file given by {@link jsonFilePath}.
+ *
+ * @param logger The logger to use.
+ * @returns The array of {@link DiffThunkRange} objects or `undefined` if the file couldn't be read.
+ */
 export function readDiffRangesJsonFile(
   logger: Logger,
+  jsonFilePath: string,
 ): DiffThunkRange[] | undefined {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
   if (!fs.existsSync(jsonFilePath)) {
     logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`);
     return undefined;
@@ -138,12 +175,12 @@ export function readDiffRangesJsonFile(
  * Return the file line ranges that were added or modified in the pull request.
  *
  * @param branches The base and head branches of the pull request.
- * @param logger
- * @returns An array of tuples, where each tuple contains the relative path of a
- * file (relative to the repository root, as returned by the GitHub compare API),
- * the start line and the end line (both 1-based and inclusive) of an
- * added or modified range in that file. Returns `undefined` if the action was
- * not triggered by a pull request or if there was an error.
+ * @param logger The logger to use.
+ *
+ * @returns
+ *  An array of {@link DiffThunkRange} objects, where each describes a line range in a file
+ *  that was changed in the pull request described by {@link branches} or `undefined` if
+ *  we were unable to compute them.
  */
 export async function getPullRequestEditedDiffRanges(
   branches: PullRequestBranches,
@@ -180,22 +217,25 @@ export async function getPullRequestEditedDiffRanges(
  * diff from the GitHub API and writes it to the diff ranges JSON file so that
  * CodeQL can use it for diff-informed analysis.
  *
+ * @param logger The logger to use.
+ * @param jsonFilePath The path of the JSON file to write.
  * @param branches The base and head branches of the pull request, as returned
  *   by `getDiffInformedAnalysisBranches`.
- * @param logger
+ *
  * @returns `true` if the diff ranges were successfully computed and persisted,
  *   otherwise `false`.
  */
 export async function computeAndPersistDiffRanges(
-  branches: PullRequestBranches,
   logger: Logger,
+  jsonFilePath: string,
+  branches: PullRequestBranches,
 ): Promise<boolean> {
   logger.info("Computing PR diff ranges...");
   const ranges = await getPullRequestEditedDiffRanges(branches, logger);
   if (ranges === undefined) {
     return false;
   }
-  writeDiffRangesJsonFile(logger, ranges);
+  writeDiffRangesJsonFile(logger, jsonFilePath, ranges);
   const distinctFiles = new Set(ranges.map((r) => r.path)).size;
   logger.info(
     `Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
@@ -203,6 +243,19 @@ export async function computeAndPersistDiffRanges(
   return true;
 }
 
+/**
+ * Fetch an array of {@link FileDiff} objects using the GitHub API describing the changed files
+ * in the pull request with the base and head refs given by {@link branches}.
+ *
+ * @param branches The pull request branch refs.
+ * @param logger The logger to use.
+ *
+ * @throws Non-HTTP errors that occur while fetching the file diffs.
+ *
+ * @returns
+ *  An array of {@link FileDiff} objects describing the changed files in the PR, or
+ *  `undefined` if we couldn't obtain the changed files from the API.
+ */
 async function getFileDiffsWithBasehead(
   branches: PullRequestBranches,
   logger: Logger,
@@ -243,6 +296,16 @@ async function getFileDiffsWithBasehead(
   }
 }
 
+/**
+ * Extracts an array of {@link DiffThunkRange} objects from {@link fileDiff}.
+ *
+ * @param fileDiff The {@link FileDiff} object describing changes to a particular file.
+ * @param logger The logger to use.
+ *
+ * @returns
+ *  The {@link DiffThunkRange} objects extracted from {@link fileDiff},
+ *  or `undefined` if there are none that could be extracted.
+ */
 function getDiffRanges(
   fileDiff: FileDiff,
   logger: Logger,

src/feature-flags.ts

@@ -6,6 +6,7 @@ import * as semver from "semver";
 import { getApiClient } from "./api-client";
 import type { CodeQL } from "./codeql";
 import * as defaults from "./defaults.json";
+import { Feature } from "./feature-flags/features";
 import { Logger } from "./logging";
 import {
   CODEQL_OVERLAY_MINIMUM_VERSION,
@@ -21,6 +22,8 @@ import { RepositoryNwo } from "./repository";
 import { ToolsFeature } from "./tools-features";
 import * as util from "./util";
 
+export { Feature } from "./feature-flags/features";
+
 const DEFAULT_VERSION_FEATURE_FLAG_PREFIX = "default_codeql_version_";
 const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
 
@@ -61,107 +64,6 @@ export interface CodeQLDefaultVersionInfo {
   toolsFeatureFlagsValid?: boolean;
 }
 
-/**
- * Features as named by the GitHub API endpoint.
- *
- * Do not include the `codeql_action_` prefix as this is stripped by the API
- * endpoint.
- *
- * Legacy features should end with `_enabled`.
- */
-export enum Feature {
-  /** Allows supported properties of configuration files to be merged. */
-  AllowMergeConfigFiles = "allow_merge_config_files",
-  /** Controls whether we allow multiple values for the `analysis-kinds` input. */
-  AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
-  /**
-   * Whether to check for unsupported traced analysis. Primarily intended as an override to disable
-   * the check if it causes problems somehow.
-   */
-  CheckUnsupportedTracedAnalysis = "check_unsupported_traced_analysis",
-  /** Whether to allow the `config-file` input to be specified via a repository property. */
-  ConfigFileRepositoryProperty = "config_file_repository_property",
-  CppDependencyInstallation = "cpp_dependency_installation_enabled",
-  CsharpCacheBuildModeNone = "csharp_cache_bmn",
-  CsharpNewCacheKey = "csharp_new_cache_key",
-  DiffInformedQueries = "diff_informed_queries",
-  DisableCsharpBuildless = "disable_csharp_buildless",
-  DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
-  DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
-  ExportDiagnosticsEnabled = "export_diagnostics_enabled",
-  /**
-   * Emergency override that forces the CodeQL CLI to use the JGit-based Git backend instead of its
-   * default backend selection.
-   */
-  ForceJGit = "force_jgit",
-  ForceNightly = "force_nightly",
-  IgnoreGeneratedFiles = "ignore_generated_files",
-  JavaNetworkDebugging = "java_network_debugging",
-  OverlayAnalysis = "overlay_analysis",
-  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
-  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
-  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
-  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
-  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
-  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
-  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
-  OverlayAnalysisCpp = "overlay_analysis_cpp",
-  OverlayAnalysisCsharp = "overlay_analysis_csharp",
-  OverlayAnalysisGo = "overlay_analysis_go",
-  OverlayAnalysisJava = "overlay_analysis_java",
-  OverlayAnalysisJavascript = "overlay_analysis_javascript",
-  /**
-   * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb",
-  OverlayAnalysisPython = "overlay_analysis_python",
-  OverlayAnalysisRuby = "overlay_analysis_ruby",
-  /** Controls whether hardware checks are skipped for overlay analysis. */
-  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
-  /** Controls whether the Actions cache is checked for overlay build outcomes. */
-  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
-  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
-  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
-  QaTelemetryEnabled = "qa_telemetry_enabled",
-  /** Whether we should fail early if we detect that traced analysis is unsupported. */
-  AbortUnsupportedTracedAnalysis = "abort_unsupported_traced_analysis",
-  /** Routes (some) API requests through the registry proxy. */
-  ProxyApiRequests = "proxy_api_requests",
-  /** Note that this currently only disables baseline file coverage information. */
-  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
-  StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
-  /** Whether to allow the `tools` input to be specified via a repository property. */
-  ToolsRepositoryProperty = "tools_repository_property",
-  UploadOverlayDbToApi = "upload_overlay_db_to_api",
-  ValidateDbConfig = "validate_db_config",
-}
-
 export type FeatureConfig = {
   /**
    * Default value in environments where the feature flags API is not available,

src/feature-flags/features.ts

@@ -0,0 +1,100 @@
+/**
+ * Features as named by the GitHub API endpoint.
+ *
+ * Do not include the `codeql_action_` prefix as this is stripped by the API
+ * endpoint.
+ *
+ * Legacy features should end with `_enabled`.
+ */
+export enum Feature {
+  /** Allows supported properties of configuration files to be merged. */
+  AllowMergeConfigFiles = "allow_merge_config_files",
+  /** Controls whether we allow multiple values for the `analysis-kinds` input. */
+  AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
+  /**
+   * Whether to check for unsupported traced analysis. Primarily intended as an override to disable
+   * the check if it causes problems somehow.
+   */
+  CheckUnsupportedTracedAnalysis = "check_unsupported_traced_analysis",
+  /** Whether to allow the `config-file` input to be specified via a repository property. */
+  ConfigFileRepositoryProperty = "config_file_repository_property",
+  CppDependencyInstallation = "cpp_dependency_installation_enabled",
+  CsharpCacheBuildModeNone = "csharp_cache_bmn",
+  CsharpNewCacheKey = "csharp_new_cache_key",
+  DiffInformedQueries = "diff_informed_queries",
+  DisableCsharpBuildless = "disable_csharp_buildless",
+  DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
+  DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
+  ExportDiagnosticsEnabled = "export_diagnostics_enabled",
+  /**
+   * Emergency override that forces the CodeQL CLI to use the JGit-based Git backend instead of its
+   * default backend selection.
+   */
+  ForceJGit = "force_jgit",
+  ForceNightly = "force_nightly",
+  IgnoreGeneratedFiles = "ignore_generated_files",
+  JavaNetworkDebugging = "java_network_debugging",
+  OverlayAnalysis = "overlay_analysis",
+  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
+  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
+  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
+  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
+  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
+  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
+  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
+  OverlayAnalysisCpp = "overlay_analysis_cpp",
+  OverlayAnalysisCsharp = "overlay_analysis_csharp",
+  OverlayAnalysisGo = "overlay_analysis_go",
+  OverlayAnalysisJava = "overlay_analysis_java",
+  OverlayAnalysisJavascript = "overlay_analysis_javascript",
+  /**
+   * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb",
+  OverlayAnalysisPython = "overlay_analysis_python",
+  OverlayAnalysisRuby = "overlay_analysis_ruby",
+  /** Controls whether hardware checks are skipped for overlay analysis. */
+  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
+  /** Controls whether the Actions cache is checked for overlay build outcomes. */
+  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
+  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
+  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
+  QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Whether we should fail early if we detect that traced analysis is unsupported. */
+  AbortUnsupportedTracedAnalysis = "abort_unsupported_traced_analysis",
+  /** Routes (some) API requests through the registry proxy. */
+  ProxyApiRequests = "proxy_api_requests",
+  /** Note that this currently only disables baseline file coverage information. */
+  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
+  StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
+  /** Whether to allow the `tools` input to be specified via a repository property. */
+  ToolsRepositoryProperty = "tools_repository_property",
+  UploadOverlayDbToApi = "upload_overlay_db_to_api",
+  ValidateDbConfig = "validate_db_config",
+}

src/languages/changes.test.ts

@@ -0,0 +1,79 @@
+import test from "ava";
+
+import type { FileDiff } from "../diff-informed";
+import { setupTests } from "../testing-utils";
+
+import { matchPatterns, relevantChangeFor } from "./changes";
+
+setupTests(test);
+
+function mkTestDiff(filename: string): FileDiff {
+  return { filename, changes: 42 };
+}
+
+test("matchPatterns - true if any pattern matches", (t) => {
+  t.true(matchPatterns("/path/to/file.js", ["*.js"]));
+  t.true(matchPatterns("/path/to", ["/path/**"]));
+  t.true(matchPatterns("/path/to", ["foo.txt", "/path/**"]));
+  t.true(matchPatterns("/path/to", ["foo.txt", "/path/from", "/path/to*"]));
+});
+
+test("matchPatterns - false if no pattern matches", (t) => {
+  t.false(matchPatterns("/path/to", []));
+  t.false(matchPatterns("/path/to", ["/some/path/**"]));
+});
+
+test("relevantChangeFor - relevant if expected", (t) => {
+  // No configuration: all files are relevant
+  t.true(relevantChangeFor({}, mkTestDiff("/path/to/file.js")));
+
+  // Various configurations that we expect to match the given path.
+  t.true(
+    relevantChangeFor({ patterns: ["*.js"] }, mkTestDiff("/path/to/file.js")),
+  );
+  t.true(
+    relevantChangeFor(
+      { patterns: ["/path/**"] },
+      mkTestDiff("/path/to/file.js"),
+    ),
+  );
+
+  // `exclude` configuration doesn't apply
+  t.true(
+    relevantChangeFor({ exclude: ["*.ts"] }, mkTestDiff("/path/to/file.js")),
+  );
+  t.true(
+    relevantChangeFor(
+      { patterns: ["*.js"], exclude: ["file.ts"] },
+      mkTestDiff("/path/to/file.js"),
+    ),
+  );
+  t.true(
+    relevantChangeFor(
+      { patterns: ["/path/**"], exclude: ["/path/to/**/*.ts"] },
+      mkTestDiff("/path/to/file.js"),
+    ),
+  );
+});
+
+test("relevantChangeFor - exclude patterns filter results", (t) => {
+  // No patterns: all files are relevant, but `exclude` filters `.js` files.
+  t.false(
+    relevantChangeFor({ exclude: ["*.js"] }, mkTestDiff("/path/to/file.js")),
+  );
+
+  // Various `patterns` configurations that we expect to match the given path and
+  // more specific `exclude` configurations that we expect to also match.
+  t.false(
+    relevantChangeFor(
+      { patterns: ["*.js"], exclude: ["file.js"] },
+      mkTestDiff("/path/to/file.js"),
+    ),
+  );
+  t.false(
+    relevantChangeFor(
+      { patterns: ["/path/**"], exclude: ["/path/to/**/*.js"] },
+      mkTestDiff("/path/to/file.js"),
+    ),
+  );
+});

src/languages/changes.ts

@@ -0,0 +1,112 @@
+import { minimatch } from "minimatch";
+
+import type { FileDiff } from "../diff-informed";
+
+import { BuiltInLanguage } from ".";
+
+/**
+ * Represents configurations for how to detect whether changes relate to a given analysis.
+ */
+export type ChangePatterns = {
+  /**
+   * A list of glob patterns.
+   *
+   * If a changed file has matches one of these, we conclude that files relevant to the
+   * analysis have changed.
+   *
+   * If undefined, all changes are considered relevant.
+   */
+  patterns?: string[];
+
+  /**
+   * A list of glob patterns to exclude from `patterns`. Allows specific patterns to be excluded
+   * that would otherwise be included by `patterns`.
+   *
+   * If a changed file matches one of `patterns` and `exclude`, then it is not considered
+   * relevant to the analysis.
+   */
+  exclude?: string[];
+};
+
+/**
+ * A mapping from all {@link BuildInLanguage}s to a {@link ChangePatterns} configuration.
+ */
+export const CHANGE_PATTERNS: Record<BuiltInLanguage, ChangePatterns> = {
+  [BuiltInLanguage.actions]: {},
+  [BuiltInLanguage.cpp]: {},
+  [BuiltInLanguage.csharp]: {},
+  [BuiltInLanguage.go]: {},
+  [BuiltInLanguage.java]: {},
+  [BuiltInLanguage.javascript]: {},
+  [BuiltInLanguage.python]: {},
+  [BuiltInLanguage.ruby]: {},
+  [BuiltInLanguage.rust]: {},
+  [BuiltInLanguage.swift]: {},
+};
+
+/**
+ * Decides whether {@link val} matches any of {@link patterns}. Returns early
+ * as soon as a pattern matches.
+ */
+export function matchPatterns(val: string, patterns: string[]): boolean {
+  for (const pattern of patterns) {
+    if (minimatch(val, pattern, { matchBase: true })) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Decides whether {@link diff} matches the configuration in {@link changePatterns}.
+ *
+ * @param changePatterns The configuration of patterns to match {@link diff}'s path against.
+ * @param diff A description of a change.
+ */
+export function relevantChangeFor(
+  changePatterns: ChangePatterns,
+  diff: FileDiff,
+): boolean {
+  // If `patterns` is defined and none match, then the change is not relevant.
+  if (
+    changePatterns.patterns !== undefined &&
+    !matchPatterns(diff.filename, changePatterns.patterns)
+  ) {
+    return false;
+  }
+
+  // At this point we have decided that the change is relevant, either because no
+  // patterns are configured (all changes are relevant) or because one of the configured
+  // patterns matched. Let's check if `exclude` patterns are configured and if any match.
+  // If so, then we don't consider the change relevant after all.
+  if (
+    changePatterns.exclude !== undefined &&
+    matchPatterns(diff.filename, changePatterns.exclude)
+  ) {
+    return false;
+  }
+
+  // The change is relevant and none of the `exclude` patterns matched (or none were configured).
+  return true;
+}
+
+/**
+ * Decides whether at least one of the given {@link diffs} matches the configuration for {@link language}
+ * from {@link CHANGE_PATTERNS}.
+ *
+ * @param language The language to check for changes for.
+ * @param diffs All changes to check.
+ */
+export function relevantChangesFor(
+  language: BuiltInLanguage,
+  diffs: FileDiff[],
+): boolean {
+  for (const diff of diffs) {
+    if (relevantChangeFor(CHANGE_PATTERNS[language], diff)) {
+      return true;
+    }
+  }
+
+  return false;
+}

src/overlay/index.test.ts

@@ -5,6 +5,7 @@ import test from "ava";
 import * as sinon from "sinon";
 
 import * as actionsUtil from "../actions-util";
+import * as diffInformed from "../diff-informed";
 import * as gitUtils from "../git-utils";
 import {
   createTestConfig,
@@ -60,7 +61,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
       const changesFilePath = await writeOverlayChangesFile(
@@ -126,7 +127,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
 
@@ -196,7 +197,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
 
@@ -259,7 +260,7 @@ test.serial(
       const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
       sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
       sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
         .returns(diffRangeFilePath);
       // getGitRoot returns the repo root (parent of sourceRoot)
       sinon.stub(gitUtils, "getGitRoot").resolves(repoRoot);

src/overlay/index.ts

@@ -1,9 +1,9 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as actionsUtil from "../actions-util";
 import { getOptionalInput, getTemporaryDirectory } from "../actions-util";
 import { type Config } from "../config-utils";
+import { getDiffRangesJsonFilePath } from "../diff-informed";
 import { getFileOidsUnderPath, getGitRoot } from "../git-utils";
 import { Logger } from "../logging";
 import { getBaseDatabaseOidsFilePath } from "../util";
@@ -135,7 +135,7 @@ async function getDiffRangeFilePaths(
   sourceRoot: string,
   logger: Logger,
 ): Promise<string[]> {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
+  const jsonFilePath = getDiffRangesJsonFilePath();
 
   if (!fs.existsSync(jsonFilePath)) {
     logger.debug(

src/upload-lib.test.ts

@@ -9,7 +9,7 @@ import * as sinon from "sinon";
 import * as analyses from "./analyses";
 import { AnalysisKind, CodeQuality, CodeScanning } from "./analyses";
 import * as api from "./api-client";
-import * as diffUtils from "./diff-informed-analysis-utils";
+import * as diffUtils from "./diff-informed";
 import { getEnv } from "./environment";
 import { Logger } from "./logging";
 import * as sarif from "./sarif";
@@ -1074,6 +1074,7 @@ function runFilterAlertsByDiffRange(
   logger: Logger = new RecordingLogger(),
 ): Partial<sarif.Log> {
   sinon.stub(diffUtils, "readDiffRangesJsonFile").returns(diffRanges);
+  sinon.stub(diffUtils, "getDiffRangesJsonFilePath").returns("");
   return uploadLib.filterAlertsByDiffRange(logger, input);
 }
 

src/upload-lib.ts

@@ -13,7 +13,10 @@ import * as api from "./api-client";
 import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import type { ActionConfig } from "./config/action-config";
-import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
+import {
+  getDiffRangesJsonFilePath,
+  readDiffRangesJsonFile,
+} from "./diff-informed";
 import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
@@ -1079,7 +1082,10 @@ export function filterAlertsByDiffRange(
   logger: Logger,
   sarifLog: Partial<sarif.Log>,
 ): Partial<sarif.Log> {
-  const diffRanges = readDiffRangesJsonFile(logger);
+  const diffRanges = readDiffRangesJsonFile(
+    logger,
+    getDiffRangesJsonFilePath(),
+  );
   if (!diffRanges?.length) {
     return sarifLog;
   }