Failed SARIF testing and logging improvements

[mbg]

Cherry-picked changes from #4223 which primarily improve our ability to test the failed SARIF upload process in init-post. These changes are in prep for #4223 to make them easier to review, but aren't all used here yet. The main changes here are:

• For the failed SARIF upload process, the function of shouldSkipSarifUpload is now divided up between it and a new shouldSkipGenerateFailedSarif. To maintain backwards compatibility, shouldSkipSarifUpload implies shouldSkipGenerateFailedSarif by default.
  • Both can now explicitly be set to false rather than just explicitly set to true.
• shouldSkipGenerateFailedSarif now guards whether the failed SARIF is generated rather than shouldSkipSarifUpload. This allows us to generate the failed SARIF, but not upload it. Previously not uploading it implied not generating it.
• combineSarifFilesUsingCLI was calling getConfig itself, which made it oblivious to the new failed configuration file that was introduced in Store and restore "failed" configuration if init step aborts #4225. This is changed so that the Config is propagated to it from higher up in the call hierarchy.
  • See Include diagnostics in failed SARIF if they were created before a database was initialised #4223 (comment) for one implication of this change.
• Some logging improvements.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

• Advanced setup - Impacts users who have custom CodeQL workflows.
• Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

• Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
• Code Quality - The changes impact analyses when analysis-kinds: code-quality.
• Other first-party - The changes impact other first-party analyses.
• Third-party analyses - The changes affect the upload-sarif action.

Environments:

• Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
• GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

• Telemetry - I rely on existing telemetry or have made changes to the telemetry.
  • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
  • Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

🔵 Needs a closer look

Cross-action upload behavior needs human validation, including an unresolved processing-wait inconsistency.

1 open finding

• Test mode incorrectly skips SARIF processing waits · New

What changed in this PR

Improves failed-SARIF testing and logging, preparing init-post to handle diagnostics from aborted initialization.

Changes:

• Separates failed-SARIF generation and upload controls, including explicit false overrides.
• Propagates configuration through SARIF processing.
• Adds test-mode artifacts and upload-aware processing waits.

File	Description
src/​util.ts	Adds independent generation and upload controls.
src/​util.test.ts	Tests skip settings and overrides.
src/​upload-sarif.ts	Forwards configuration to post-processing.
src/​upload-sarif.test.ts	Updates mocks and configuration assertions.
src/​upload-sarif-action.ts	Loads configuration for CLI reuse.
src/​upload-lib.ts	Uses supplied configuration and skips waits when uploads are disabled.
src/​init-action-post.ts	Logs aborted-configuration fallback.
src/​init-action-post-helper.ts	Separates generation controls and adds testing artifacts.
src/​init-action-post-helper.test.ts	Checks configuration forwarding.
src/​environment.ts	Defines the generation-skip setting.
src/​analyze-action.ts	Passes configuration into SARIF processing.

Files excluded by content exclusion policy (1)

• lib/entry-points.js

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.