Move getDiffRangesJsonFilePath to diff-informed/index.ts

Make jsonFilePath an explicit input to functions in diff-informed/index.ts
Improve JSDocs in diff-informed/index.ts
2026-11-05 05:04:36 +03:00 · 2026-11-04 15:00:19 +00:00 · 2026-11-04 14:34:23 +00:00 · 2026-11-04 13:24:10 +00:00 · 2026-11-04 13:24:10 +00:00 · 2026-11-04 13:14:15 +00:00
17 changed files with 2666 additions and 3050 deletions
@@ -2,9 +2,9 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## 4.39.3 - 04 Nov 2026
+## [UNRELEASED]

- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
+No user facing changes.

 ## 4.39.2 - 03 Nov 2026

@@ -59,7 +59,7 @@
        "eslint-plugin-import-x": "^4.17.1",
        "eslint-plugin-jsdoc": "^65.4.0",
        "eslint-plugin-no-async-foreach": "^0.1.1",
-        "glob": "^14.0.3",
+        "glob": "^13.0.6",
        "globals": "^17.13.0",
        "nock": "^14.0.17",
        "prettier": "^3.9.10",
@@ -1811,12 +1811,6 @@
        "node": ">=18.0.0"
      }
    },
-    "node_modules/@isaacs/nonrecursive-glob-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
-      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
-      "license": "BlueOak-1.0.0"
-    },
    "node_modules/@mapbox/node-pre-gyp": {
      "version": "2.0.3",
      "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -3530,6 +3524,7 @@
    },
    "node_modules/ansi-regex": {
      "version": "5.0.1",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -3539,6 +3534,7 @@
      "version": "6.2.3",
      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=12"
@@ -4443,6 +4439,7 @@
    },
    "node_modules/color-convert": {
      "version": "2.0.1",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "color-name": "~1.1.4"
@@ -4453,6 +4450,7 @@
    },
    "node_modules/color-name": {
      "version": "1.1.4",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/comment-parser": {
@@ -4577,6 +4575,7 @@
      "version": "7.0.6",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
      "dependencies": {
        "path-key": "^3.1.0",
        "shebang-command": "^2.0.0",
@@ -4831,6 +4830,7 @@
    },
    "node_modules/emoji-regex": {
      "version": "8.0.0",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/es-abstract": {
@@ -6273,14 +6273,14 @@
      }
    },
    "node_modules/glob": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
-      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "minimatch": "^11.0.2",
+        "minimatch": "^10.2.2",
        "minipass": "^7.1.3",
-        "path-scurry": "^3.0.0"
+        "path-scurry": "^2.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
@@ -6324,13 +6324,12 @@
      }
    },
    "node_modules/glob/node_modules/minimatch": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
-      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "@isaacs/nonrecursive-glob-match": "^1.0.2",
-        "brace-expansion": "^5.0.12"
+        "brace-expansion": "^5.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
@@ -6859,6 +6858,7 @@
    },
    "node_modules/is-fullwidth-code-point": {
      "version": "3.0.0",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -7169,6 +7169,7 @@
    },
    "node_modules/isexe": {
      "version": "2.0.0",
+      "dev": true,
      "license": "ISC"
    },
    "node_modules/js-string-escape": {
@@ -7478,9 +7479,9 @@
      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="
    },
    "node_modules/lru-cache": {
-      "version": "11.5.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
-      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
      "license": "BlueOak-1.0.0",
      "engines": {
        "node": "20 || >=22"
@@ -8571,6 +8572,7 @@
    },
    "node_modules/path-key": {
      "version": "3.1.1",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -8582,9 +8584,9 @@
      "license": "MIT"
    },
    "node_modules/path-scurry": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
-      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
        "lru-cache": "^11.0.0",
@@ -9170,6 +9172,7 @@
    },
    "node_modules/shebang-command": {
      "version": "2.0.0",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "shebang-regex": "^3.0.0"
@@ -9180,6 +9183,7 @@
    },
    "node_modules/shebang-regex": {
      "version": "3.0.0",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=8"
@@ -9265,6 +9269,7 @@
      "version": "4.1.0",
      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
      "engines": {
        "node": ">=14"
      },
@@ -9451,6 +9456,7 @@
    },
    "node_modules/string-width": {
      "version": "4.2.3",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "emoji-regex": "^8.0.0",
@@ -9536,6 +9542,7 @@
    },
    "node_modules/strip-ansi": {
      "version": "6.0.1",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "ansi-regex": "^5.0.1"
@@ -10273,6 +10280,7 @@
    },
    "node_modules/which": {
      "version": "2.0.2",
+      "dev": true,
      "license": "ISC",
      "dependencies": {
        "isexe": "^2.0.0"
@@ -69,7 +69,7 @@
    "eslint-plugin-import-x": "^4.17.1",
    "eslint-plugin-jsdoc": "^65.4.0",
    "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
    "globals": "^17.13.0",
    "nock": "^14.0.17",
    "prettier": "^3.9.10",
@@ -96,7 +96,7 @@
    "eslint-plugin-jsx-a11y": {
      "semver": ">=6.3.1"
    },
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
    "undici": "^7.30.1"
  }
 }
@@ -78,12 +78,6 @@ export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
  );
 }

-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
-  return path.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
-}
-
 export function getActionVersion(): string {
  return __CODEQL_ACTION_VERSION__;
 }
@@ -19,9 +19,10 @@ import {
 } from "./dependency-caching";
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
-  DiffThunkRange,
+  type DiffThunkRange,
+  getDiffRangesJsonFilePath,
  readDiffRangesJsonFile,
-} from "./diff-informed-analysis-utils";
+} from "./diff-informed";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
 import { getGitRoot } from "./git-utils";
@@ -295,7 +296,10 @@ export async function setupDiffInformedQueryRun(
  return await withGroupAsync(
    "Generating diff range extension pack",
    async () => {
-      const diffRanges = readDiffRangesJsonFile(logger);
+      const diffRanges = readDiffRangesJsonFile(
+        logger,
+        getDiffRangesJsonFilePath(),
+      );
      if (diffRanges === undefined) {
        logger.info(
          "No precomputed diff ranges found; skipping diff-informed analysis stage.",
@@ -15,6 +15,7 @@ import { createStubCodeQL } from "./codeql";
 import { UserConfig } from "./config/db-config";
 import * as file from "./config/file";
 import * as configUtils from "./config-utils";
+import { ActionsEnvVars } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
@@ -42,6 +43,7 @@ import {
  SAMPLE_DOTCOM_API_DETAILS,
  AssertableTarget,
  RecordingLogger,
+  getTestEnv,
 } from "./testing-utils";
 import {
  GitHubVariant,
@@ -151,9 +153,11 @@ function mockListLanguages(languages: string[]) {
 test.serial("load empty config", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+
    const languages = "javascript,python";

-    setupActionsVars(tempDir, tempDir);
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -166,7 +170,6 @@ test.serial("load empty config", async (t) => {
      },
    });

-    const state = initAllState({ logger });
    const config = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -197,9 +200,10 @@ test.serial("load empty config", async (t) => {
 test.serial("load code quality config", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
    const languages = "actions";

-    setupActionsVars(tempDir, tempDir);
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -211,7 +215,6 @@ test.serial("load code quality config", async (t) => {
      },
    });

-    const state = initAllState({ logger });
    const config = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -253,9 +256,10 @@ test.serial(
  async (t) => {
    return await withTmpDir(async (tempDir) => {
      const logger = new RecordingLogger();
+      const state = initAllState({ logger });
      const languages = "javascript";

-      setupActionsVars(tempDir, tempDir);
+      setupActionsVars(tempDir, tempDir, {}, state.env);

      const codeql = createStubCodeQL({
        async resolveLanguages() {
@@ -291,7 +295,6 @@ test.serial(
        repositoryProperties,
      });

-      const state = initAllState({ logger });
      await t.notThrowsAsync(async () => {
        const config = await configUtils.initConfig(
          state,
@@ -316,6 +319,8 @@ test.serial(
 test.serial("loading a saved config produces the same config", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -334,7 +339,6 @@ test.serial("loading a saved config produces the same config", async (t) => {
    // Sanity check that getConfig returns undefined before we have called initConfig
    t.deepEqual(await configUtils.getConfig(tempDir, logger), undefined);

-    const state = initAllState({ logger });
    const config1 = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -364,6 +368,8 @@ test.serial("loading a saved config produces the same config", async (t) => {
 test.serial("loading config with version mismatch throws", async (t) => {
  return await withTmpDir(async (tempDir) => {
    const logger = new RecordingLogger();
+    const state = initAllState({ logger });
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -387,7 +393,6 @@ test.serial("loading config with version mismatch throws", async (t) => {
      .stub(actionsUtil, "getActionVersion")
      .returns("does-not-exist");

-    const state = initAllState({ logger });
    const config = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -497,7 +502,8 @@ const otherConfigFileContents = `

 test.serial("load non-empty input", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    setupActionsVars(tempDir, tempDir);
+    const state = initAllState();
+    setupActionsVars(tempDir, tempDir, {}, state.env);

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -538,7 +544,6 @@ test.serial("load non-empty input", async (t) => {
    const languagesInput = "javascript";
    const configFilePath = createConfigFile(otherConfigFileContents, tempDir);

-    const state = initAllState();
    const actualConfig = await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -657,7 +662,9 @@ test.serial("API client used when reading remote config", async (t) => {
    const configFile = "octo-org/codeql-config/config.yaml@main";
    const languagesInput = "javascript";

-    const state = initAllState();
+    const state = initAllState({
+      env: getTestEnv({ [ActionsEnvVars.RUNNER_TEMP]: tempDir }),
+    });
    await configUtils.initConfig(
      state,
      createTestInitConfigInputs({
@@ -48,7 +48,10 @@ import {
  addNoLanguageDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
+import {
+  getDiffRangesJsonFilePath,
+  prepareDiffInformedAnalysis,
+} from "./diff-informed";
 import { EnvVar, exportEnvVar, getEnv } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
@@ -1288,9 +1291,10 @@ export async function initConfig(
  }

  const hasDiffRanges = await prepareDiffInformedAnalysis(
-    inputs.codeql,
-    inputs.features,
    logger,
+    inputs.features,
+    inputs.codeql,
+    getDiffRangesJsonFilePath(actionState.env),
  );

  await applyIncrementalAnalysisSettings(
@@ -1,16 +1,12 @@
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";

-import * as actionsUtil from "./actions-util";
-import type { PullRequestBranches } from "./actions-util";
-import * as apiClient from "./api-client";
-import {
-  getDiffInformedAnalysisBranches,
-  prepareDiffInformedAnalysis,
-  exportedForTesting,
-} from "./diff-informed-analysis-utils";
-import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
-import { parseRepositoryNwo } from "./repository";
+import * as actionsUtil from "../actions-util";
+import type { PullRequestBranches } from "../actions-util";
+import * as apiClient from "../api-client";
+import { getEnv } from "../environment";
+import { Feature, FeatureEnablement, initFeatures } from "../feature-flags";
+import { parseRepositoryNwo } from "../repository";
 import {
  setupTests,
  createFeatures,
@@ -19,9 +15,16 @@ import {
  setupActionsVars,
  makeMacro,
  RecordingLogger,
-} from "./testing-utils";
-import { GitHubVariant, withTmpDir } from "./util";
-import type { GitHubVersion } from "./util";
+} from "../testing-utils";
+import { GitHubVariant, withTmpDir } from "../util";
+import type { GitHubVersion } from "../util";
+
+import {
+  getDiffInformedAnalysisBranches,
+  prepareDiffInformedAnalysis,
+  exportedForTesting,
+  getDiffRangesJsonFilePath,
+} from ".";

 setupTests(test);

@@ -192,9 +195,10 @@ test.serial(
        .resolves({ type: GitHubVariant.DOTCOM });

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.false(result);
@@ -222,9 +226,10 @@ test.serial(
      };

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.false(result);
@@ -259,9 +264,10 @@ test.serial(
      } as any);

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.true(result);
@@ -296,9 +302,10 @@ test.serial(
      } as any);

      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
        logger,
+        features,
+        codeql,
+        getDiffRangesJsonFilePath(getEnv()),
      );

      t.false(result);
@@ -1,23 +1,43 @@
 import * as fs from "fs";
+import path from "path";

-import * as actionsUtil from "./actions-util";
-import type { PullRequestBranches } from "./actions-util";
-import { getApiClient, getGitHubVersion } from "./api-client";
-import type { CodeQL } from "./codeql";
-import { Feature, FeatureEnablement } from "./feature-flags";
-import { Logger } from "./logging";
-import { getRepositoryNwoFromEnv } from "./repository";
-import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
+import * as actionsUtil from "../actions-util";
+import type { PullRequestBranches } from "../actions-util";
+import { getApiClient, getGitHubVersion } from "../api-client";
+import type { CodeQL } from "../codeql";
+import { type Env, getEnv } from "../environment";
+import type { FeatureEnablement } from "../feature-flags";
+import { Feature } from "../feature-flags/features";
+import { Logger } from "../logging";
+import { getRepositoryNwoFromEnv } from "../repository";
+import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "../util";
+
+/** The filename used to persist PR diff ranges. */
+const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
+
+/**
+ * Gets the full path of the file used to persist PR diff ranges.
+ */
+export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
+  return path.join(
+    actionsUtil.getTemporaryDirectory(env),
+    PR_DIFF_RANGE_JSON_FILENAME,
+  );
+}

 /**
 * This interface is an abbreviated version of the file diff object returned by
 * the GitHub API.
 */
-interface FileDiff {
+export interface FileDiff {
+  /** The name of the file that has changed. */
  filename: string;
+  /** The number of changes. */
  changes: number;
-  // A patch may be absent if the file is binary, if the file diff is too large,
-  // or if the file is unchanged.
+  /**
+   * The diff, if available. It may be absent if the file is binary, if the file diff is too large,
+   * or if the file is unchanged.
+   */
  patch?: string | undefined;
 }

@@ -63,9 +83,10 @@ export async function getDiffInformedAnalysisBranches(
 *   and are therefore available for use, `false` otherwise.
 */
 export async function prepareDiffInformedAnalysis(
-  codeql: CodeQL,
-  features: FeatureEnablement,
  logger: Logger,
+  features: FeatureEnablement,
+  codeql: CodeQL,
+  jsonFilePath: string,
 ): Promise<boolean> {
  let branches: PullRequestBranches | undefined;
  try {
@@ -84,7 +105,7 @@ export async function prepareDiffInformedAnalysis(
  }

  try {
-    return await computeAndPersistDiffRanges(branches, logger);
+    return await computeAndPersistDiffRanges(logger, jsonFilePath, branches);
  } catch (e) {
    logger.warning(
      `Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
@@ -93,29 +114,45 @@ export async function prepareDiffInformedAnalysis(
  }
 }

+/** Describes a changed line range in a file. */
 export interface DiffThunkRange {
  /** Relative path from the repository root, using forward slashes as separators. */
  path: string;
+  /** The starting line of the change (1-based and inclusive). */
  startLine: number;
+  /** The last line of the change (1-based and inclusive). */
  endLine: number;
 }

+/**
+ * Writes an array of {@link DiffThunkRange} objects to the file given by {@link jsonFilePath}.
+ *
+ * @param logger The logger to use.
+ * @param jsonFilePath The path of the file to write.
+ * @param ranges The changed line ranges to write.
+ */
 export function writeDiffRangesJsonFile(
  logger: Logger,
+  jsonFilePath: string,
  ranges: DiffThunkRange[],
 ): void {
  const jsonContents = JSON.stringify(ranges, null, 2);
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
  fs.writeFileSync(jsonFilePath, jsonContents);
  logger.debug(
    `Wrote pr-diff-range JSON file to ${jsonFilePath}:\n${jsonContents}`,
  );
 }

+/**
+ * Reads an array of {@link DiffThunkRange} objects from the file given by {@link jsonFilePath}.
+ *
+ * @param logger The logger to use.
+ * @returns The array of {@link DiffThunkRange} objects or `undefined` if the file couldn't be read.
+ */
 export function readDiffRangesJsonFile(
  logger: Logger,
+  jsonFilePath: string,
 ): DiffThunkRange[] | undefined {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
  if (!fs.existsSync(jsonFilePath)) {
    logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`);
    return undefined;
@@ -138,12 +175,12 @@ export function readDiffRangesJsonFile(
 * Return the file line ranges that were added or modified in the pull request.
 *
 * @param branches The base and head branches of the pull request.
- * @param logger
- * @returns An array of tuples, where each tuple contains the relative path of a
- * file (relative to the repository root, as returned by the GitHub compare API),
- * the start line and the end line (both 1-based and inclusive) of an
- * added or modified range in that file. Returns `undefined` if the action was
- * not triggered by a pull request or if there was an error.
+ * @param logger The logger to use.
+ *
+ * @returns
+ *  An array of {@link DiffThunkRange} objects, where each describes a line range in a file
+ *  that was changed in the pull request described by {@link branches} or `undefined` if
+ *  we were unable to compute them.
 */
 export async function getPullRequestEditedDiffRanges(
  branches: PullRequestBranches,
@@ -180,22 +217,25 @@ export async function getPullRequestEditedDiffRanges(
 * diff from the GitHub API and writes it to the diff ranges JSON file so that
 * CodeQL can use it for diff-informed analysis.
 *
+ * @param logger The logger to use.
+ * @param jsonFilePath The path of the JSON file to write.
 * @param branches The base and head branches of the pull request, as returned
 *   by `getDiffInformedAnalysisBranches`.
- * @param logger
+ *
 * @returns `true` if the diff ranges were successfully computed and persisted,
 *   otherwise `false`.
 */
 export async function computeAndPersistDiffRanges(
-  branches: PullRequestBranches,
  logger: Logger,
+  jsonFilePath: string,
+  branches: PullRequestBranches,
 ): Promise<boolean> {
  logger.info("Computing PR diff ranges...");
  const ranges = await getPullRequestEditedDiffRanges(branches, logger);
  if (ranges === undefined) {
    return false;
  }
-  writeDiffRangesJsonFile(logger, ranges);
+  writeDiffRangesJsonFile(logger, jsonFilePath, ranges);
  const distinctFiles = new Set(ranges.map((r) => r.path)).size;
  logger.info(
    `Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
@@ -203,6 +243,19 @@ export async function computeAndPersistDiffRanges(
  return true;
 }

+/**
+ * Fetch an array of {@link FileDiff} objects using the GitHub API describing the changed files
+ * in the pull request with the base and head refs given by {@link branches}.
+ *
+ * @param branches The pull request branch refs.
+ * @param logger The logger to use.
+ *
+ * @throws Non-HTTP errors that occur while fetching the file diffs.
+ *
+ * @returns
+ *  An array of {@link FileDiff} objects describing the changed files in the PR, or
+ *  `undefined` if we couldn't obtain the changed files from the API.
+ */
 async function getFileDiffsWithBasehead(
  branches: PullRequestBranches,
  logger: Logger,
@@ -243,6 +296,16 @@ async function getFileDiffsWithBasehead(
  }
 }

+/**
+ * Extracts an array of {@link DiffThunkRange} objects from {@link fileDiff}.
+ *
+ * @param fileDiff The {@link FileDiff} object describing changes to a particular file.
+ * @param logger The logger to use.
+ *
+ * @returns
+ *  The {@link DiffThunkRange} objects extracted from {@link fileDiff},
+ *  or `undefined` if there are none that could be extracted.
+ */
 function getDiffRanges(
  fileDiff: FileDiff,
  logger: Logger,
@@ -6,6 +6,7 @@ import * as semver from "semver";
 import { getApiClient } from "./api-client";
 import type { CodeQL } from "./codeql";
 import * as defaults from "./defaults.json";
+import { Feature } from "./feature-flags/features";
 import { Logger } from "./logging";
 import {
  CODEQL_OVERLAY_MINIMUM_VERSION,
@@ -21,6 +22,8 @@ import { RepositoryNwo } from "./repository";
 import { ToolsFeature } from "./tools-features";
 import * as util from "./util";

+export { Feature } from "./feature-flags/features";
+
 const DEFAULT_VERSION_FEATURE_FLAG_PREFIX = "default_codeql_version_";
 const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";

@@ -61,107 +64,6 @@ export interface CodeQLDefaultVersionInfo {
  toolsFeatureFlagsValid?: boolean;
 }

-/**
- * Features as named by the GitHub API endpoint.
- *
- * Do not include the `codeql_action_` prefix as this is stripped by the API
- * endpoint.
- *
- * Legacy features should end with `_enabled`.
- */
-export enum Feature {
-  /** Allows supported properties of configuration files to be merged. */
-  AllowMergeConfigFiles = "allow_merge_config_files",
-  /** Controls whether we allow multiple values for the `analysis-kinds` input. */
-  AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
-  /**
-   * Whether to check for unsupported traced analysis. Primarily intended as an override to disable
-   * the check if it causes problems somehow.
-   */
-  CheckUnsupportedTracedAnalysis = "check_unsupported_traced_analysis",
-  /** Whether to allow the `config-file` input to be specified via a repository property. */
-  ConfigFileRepositoryProperty = "config_file_repository_property",
-  CppDependencyInstallation = "cpp_dependency_installation_enabled",
-  CsharpCacheBuildModeNone = "csharp_cache_bmn",
-  CsharpNewCacheKey = "csharp_new_cache_key",
-  DiffInformedQueries = "diff_informed_queries",
-  DisableCsharpBuildless = "disable_csharp_buildless",
-  DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
-  DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
-  ExportDiagnosticsEnabled = "export_diagnostics_enabled",
-  /**
-   * Emergency override that forces the CodeQL CLI to use the JGit-based Git backend instead of its
-   * default backend selection.
-   */
-  ForceJGit = "force_jgit",
-  ForceNightly = "force_nightly",
-  IgnoreGeneratedFiles = "ignore_generated_files",
-  JavaNetworkDebugging = "java_network_debugging",
-  OverlayAnalysis = "overlay_analysis",
-  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
-  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
-  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
-  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
-  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
-  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
-  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
-  OverlayAnalysisCpp = "overlay_analysis_cpp",
-  OverlayAnalysisCsharp = "overlay_analysis_csharp",
-  OverlayAnalysisGo = "overlay_analysis_go",
-  OverlayAnalysisJava = "overlay_analysis_java",
-  OverlayAnalysisJavascript = "overlay_analysis_javascript",
-  /**
-   * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb",
-  /**
-   * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if
-   * none are enabled, the default applies.
-   */
-  OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb",
-  OverlayAnalysisPython = "overlay_analysis_python",
-  OverlayAnalysisRuby = "overlay_analysis_ruby",
-  /** Controls whether hardware checks are skipped for overlay analysis. */
-  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
-  /** Controls whether the Actions cache is checked for overlay build outcomes. */
-  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
-  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
-  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
-  QaTelemetryEnabled = "qa_telemetry_enabled",
-  /** Whether we should fail early if we detect that traced analysis is unsupported. */
-  AbortUnsupportedTracedAnalysis = "abort_unsupported_traced_analysis",
-  /** Routes (some) API requests through the registry proxy. */
-  ProxyApiRequests = "proxy_api_requests",
-  /** Note that this currently only disables baseline file coverage information. */
-  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
-  StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
-  /** Whether to allow the `tools` input to be specified via a repository property. */
-  ToolsRepositoryProperty = "tools_repository_property",
-  UploadOverlayDbToApi = "upload_overlay_db_to_api",
-  ValidateDbConfig = "validate_db_config",
-}
-
 export type FeatureConfig = {
  /**
   * Default value in environments where the feature flags API is not available,
@@ -0,0 +1,100 @@
+/**
+ * Features as named by the GitHub API endpoint.
+ *
+ * Do not include the `codeql_action_` prefix as this is stripped by the API
+ * endpoint.
+ *
+ * Legacy features should end with `_enabled`.
+ */
+export enum Feature {
+  /** Allows supported properties of configuration files to be merged. */
+  AllowMergeConfigFiles = "allow_merge_config_files",
+  /** Controls whether we allow multiple values for the `analysis-kinds` input. */
+  AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
+  /**
+   * Whether to check for unsupported traced analysis. Primarily intended as an override to disable
+   * the check if it causes problems somehow.
+   */
+  CheckUnsupportedTracedAnalysis = "check_unsupported_traced_analysis",
+  /** Whether to allow the `config-file` input to be specified via a repository property. */
+  ConfigFileRepositoryProperty = "config_file_repository_property",
+  CppDependencyInstallation = "cpp_dependency_installation_enabled",
+  CsharpCacheBuildModeNone = "csharp_cache_bmn",
+  CsharpNewCacheKey = "csharp_new_cache_key",
+  DiffInformedQueries = "diff_informed_queries",
+  DisableCsharpBuildless = "disable_csharp_buildless",
+  DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
+  DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
+  ExportDiagnosticsEnabled = "export_diagnostics_enabled",
+  /**
+   * Emergency override that forces the CodeQL CLI to use the JGit-based Git backend instead of its
+   * default backend selection.
+   */
+  ForceJGit = "force_jgit",
+  ForceNightly = "force_nightly",
+  IgnoreGeneratedFiles = "ignore_generated_files",
+  JavaNetworkDebugging = "java_network_debugging",
+  OverlayAnalysis = "overlay_analysis",
+  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
+  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
+  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
+  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
+  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
+  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
+  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
+  OverlayAnalysisCpp = "overlay_analysis_cpp",
+  OverlayAnalysisCsharp = "overlay_analysis_csharp",
+  OverlayAnalysisGo = "overlay_analysis_go",
+  OverlayAnalysisJava = "overlay_analysis_java",
+  OverlayAnalysisJavascript = "overlay_analysis_javascript",
+  /**
+   * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb",
+  /**
+   * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if
+   * none are enabled, the default applies.
+   */
+  OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb",
+  OverlayAnalysisPython = "overlay_analysis_python",
+  OverlayAnalysisRuby = "overlay_analysis_ruby",
+  /** Controls whether hardware checks are skipped for overlay analysis. */
+  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
+  /** Controls whether the Actions cache is checked for overlay build outcomes. */
+  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
+  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
+  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
+  QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Whether we should fail early if we detect that traced analysis is unsupported. */
+  AbortUnsupportedTracedAnalysis = "abort_unsupported_traced_analysis",
+  /** Routes (some) API requests through the registry proxy. */
+  ProxyApiRequests = "proxy_api_requests",
+  /** Note that this currently only disables baseline file coverage information. */
+  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
+  StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
+  /** Whether to allow the `tools` input to be specified via a repository property. */
+  ToolsRepositoryProperty = "tools_repository_property",
+  UploadOverlayDbToApi = "upload_overlay_db_to_api",
+  ValidateDbConfig = "validate_db_config",
+}
@@ -5,6 +5,7 @@ import test from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "../actions-util";
+import * as diffInformed from "../diff-informed";
 import * as gitUtils from "../git-utils";
 import {
  createTestConfig,
@@ -60,7 +61,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);
      const changesFilePath = await writeOverlayChangesFile(
@@ -126,7 +127,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);

@@ -196,7 +197,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      sinon.stub(gitUtils, "getGitRoot").resolves(sourceRoot);

@@ -259,7 +260,7 @@ test.serial(
      const diffRangeFilePath = path.join(tempDir, "pr-diff-range.json");
      sinon.stub(actionsUtil, "getTemporaryDirectory").returns(tempDir);
      sinon
-        .stub(actionsUtil, "getDiffRangesJsonFilePath")
+        .stub(diffInformed, "getDiffRangesJsonFilePath")
        .returns(diffRangeFilePath);
      // getGitRoot returns the repo root (parent of sourceRoot)
      sinon.stub(gitUtils, "getGitRoot").resolves(repoRoot);
@@ -1,9 +1,9 @@
 import * as fs from "fs";
 import * as path from "path";

-import * as actionsUtil from "../actions-util";
 import { getOptionalInput, getTemporaryDirectory } from "../actions-util";
 import { type Config } from "../config-utils";
+import { getDiffRangesJsonFilePath } from "../diff-informed";
 import { getFileOidsUnderPath, getGitRoot } from "../git-utils";
 import { Logger } from "../logging";
 import { getBaseDatabaseOidsFilePath } from "../util";
@@ -135,7 +135,7 @@ async function getDiffRangeFilePaths(
  sourceRoot: string,
  logger: Logger,
 ): Promise<string[]> {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
+  const jsonFilePath = getDiffRangesJsonFilePath();

  if (!fs.existsSync(jsonFilePath)) {
    logger.debug(
@@ -9,7 +9,7 @@ import * as sinon from "sinon";
 import * as analyses from "./analyses";
 import { AnalysisKind, CodeQuality, CodeScanning } from "./analyses";
 import * as api from "./api-client";
-import * as diffUtils from "./diff-informed-analysis-utils";
+import * as diffUtils from "./diff-informed";
 import { getEnv } from "./environment";
 import { Logger } from "./logging";
 import * as sarif from "./sarif";
@@ -1074,6 +1074,7 @@ function runFilterAlertsByDiffRange(
  logger: Logger = new RecordingLogger(),
 ): Partial<sarif.Log> {
  sinon.stub(diffUtils, "readDiffRangesJsonFile").returns(diffRanges);
+  sinon.stub(diffUtils, "getDiffRangesJsonFilePath").returns("");
  return uploadLib.filterAlertsByDiffRange(logger, input);
 }

@@ -13,7 +13,10 @@ import * as api from "./api-client";
 import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import type { ActionConfig } from "./config/action-config";
-import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
+import {
+  getDiffRangesJsonFilePath,
+  readDiffRangesJsonFile,
+} from "./diff-informed";
 import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
@@ -1079,7 +1082,10 @@ export function filterAlertsByDiffRange(
  logger: Logger,
  sarifLog: Partial<sarif.Log>,
 ): Partial<sarif.Log> {
-  const diffRanges = readDiffRangesJsonFile(logger);
+  const diffRanges = readDiffRangesJsonFile(
+    logger,
+    getDiffRangesJsonFilePath(),
+  );
  if (!diffRanges?.length) {
    return sarifLog;
  }
@@ -0,0 +1 @@
+- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
Author	SHA1	Message	Date
Michael B. Gale	c29d405e42	Move `getDiffRangesJsonFilePath` to `diff-informed/index.ts`	2026-11-04 15:00:19 +00:00
Michael B. Gale	8c16574468	Make `jsonFilePath` an explicit input to functions in `diff-informed/index.ts`	2026-11-04 14:34:23 +00:00
Michael B. Gale	3a4f195d36	Improve JSDocs in `diff-informed/index.ts`	2026-11-04 13:24:10 +00:00
Michael B. Gale	2465f77e2e	Move `diff-informed` utils to subfolder	2026-11-04 13:24:10 +00:00
Michael B. Gale	29ddace71d	Move `Feature` enum to a separate file	2026-11-04 13:14:15 +00:00
				`@@ -0,0 +1 @@`
				`- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)`