Refactor resolveToolsInput: accept repository properties as parameter, simplify implementation and tests

Author: Copilot

CHANGELOG.md

@@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-- Organizations can now create a custom repository property with the name `github-codeql-tools` to control the CodeQL CLI tools input at the repository level. When this property is set to a valid tools input value (such as `"toolcache"`, `"latest"`, or a specific version), it will override the default tools configuration for that repository. This allows organization administrators to standardize CodeQL CLI versions across repositories or enable toolcache usage on repositories where it would otherwise be restricted. For more information on creating custom repository properties, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization).
+- Organizations can now create a custom repository property with the name `github-codeql-tools` to set the default CodeQL CLI tools value for their repositories. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) and [Customizing your advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning).
 
 ## 4.35.2 - 15 Apr 2026
 

src/init-action.ts

@@ -253,6 +253,7 @@ async function run(startedAt: Date) {
       repositoryNwo,
       logger,
     );
+    const repositoryProperties = repositoryPropertiesResult.orElse({});
 
     // Create a unique identifier for this run.
     const jobRunUuid = uuidV4();
@@ -303,7 +304,11 @@ async function run(startedAt: Date) {
     // Determine the effective tools input.
     // The explicit `tools` workflow input takes precedence. If none is provided,
     // fall back to the 'github-codeql-tools' repository property (if set).
-    effectiveToolsInput = await resolveToolsInput(repositoryNwo, logger);
+    effectiveToolsInput = resolveToolsInput(
+      getOptionalInput("tools"),
+      repositoryProperties,
+      logger,
+    );
 
     const initCodeQLResult = await initCodeQL(
       effectiveToolsInput,
@@ -351,7 +356,6 @@ async function run(startedAt: Date) {
 
     analysisKinds = await getAnalysisKinds(logger);
     const debugMode = getOptionalInput("debug") === "true" || core.isDebug();
-    const repositoryProperties = repositoryPropertiesResult.orElse({});
     const fileCoverageResult = await getFileCoverageInformationEnabled(
       debugMode,
       codeql,

src/resolve-tools-input.test.ts

@@ -1,56 +1,32 @@
 import test from "ava";
-import * as sinon from "sinon";
 
-import * as actionsUtil from "./actions-util";
-import * as properties from "./feature-flags/properties";
 import { RepositoryPropertyName } from "./feature-flags/properties";
-import { RepositoryNwo } from "./repository";
+import type { RepositoryProperties } from "./feature-flags/properties";
 import { resolveToolsInput } from "./resolve-tools-input";
 import { getRecordingLogger, LoggedMessage, setupTests } from "./testing-utils";
-import { Success } from "./util";
 
 setupTests(test);
 
-const repositoryNwo = { owner: "owner", repo: "repo" } as RepositoryNwo;
-
-test.serial(
+test(
   "resolveToolsInput returns undefined when no tools input or repository property is set",
-  async (t) => {
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns(undefined);
-
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(undefined);
-
-    const result = await resolveToolsInput(repositoryNwo, logger);
+    const result = resolveToolsInput(undefined, {}, logger);
 
     t.is(result, undefined);
-    t.is(loggedMessages.length, 0); // No logging when no tools input is resolved
+    t.is(loggedMessages.length, 0);
   },
 );
 
-test.serial(
+test(
   "resolveToolsInput returns workflow input when only workflow input is provided",
-  async (t) => {
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns("latest");
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(undefined);
-    const result = await resolveToolsInput(repositoryNwo, logger);
+    const result = resolveToolsInput("latest", {}, logger);
 
     t.is(result, "latest");
     t.is(loggedMessages.length, 1);
@@ -61,235 +37,135 @@ test.serial(
   },
 );
 
-test.serial(
+test(
   "resolveToolsInput returns repository property when only repository property is provided",
-  async (t) => {
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns(undefined);
-
-    const repositoryPropertiesResult = new Success({
+    const repositoryProperties: RepositoryProperties = {
       [RepositoryPropertyName.TOOLS]: "toolcache",
-    });
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
-    const result = await resolveToolsInput(repositoryNwo, logger);
+    };
+    const result = resolveToolsInput(undefined, repositoryProperties, logger);
 
     t.is(result, "toolcache");
-    t.is(loggedMessages.length, 2);
+    t.is(loggedMessages.length, 1);
     t.is(
-      loggedMessages[1].message,
+      loggedMessages[0].message,
       "Setting tools: toolcache based on the 'github-codeql-tools' repository property.",
     );
   },
 );
 
-test.serial(
+test(
   "resolveToolsInput prioritizes workflow input over repository property",
-  async (t) => {
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns("nightly");
-
-    const repositoryPropertiesResult = new Success({
+    const repositoryProperties: RepositoryProperties = {
       [RepositoryPropertyName.TOOLS]: "toolcache",
-    });
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
-    const result = await resolveToolsInput(repositoryNwo, logger);
+    };
+    const result = resolveToolsInput("nightly", repositoryProperties, logger);
 
     t.is(result, "nightly");
-    t.is(loggedMessages.length, 2);
+    t.is(loggedMessages.length, 1);
     t.is(
-      loggedMessages[1].message,
+      loggedMessages[0].message,
       "Setting tools: nightly based on workflow input.",
     );
   },
 );
 
-test.serial(
-  "resolveToolsInput handles empty string values correctly",
-  async (t) => {
+test(
+  "resolveToolsInput treats empty string workflow input as not set",
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon.stub(actionsUtil, "getOptionalInput").withArgs("tools").returns("");
-
-    const repositoryPropertiesResult = new Success({
+    const repositoryProperties: RepositoryProperties = {
       [RepositoryPropertyName.TOOLS]: "toolcache",
-    });
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
-
-    const result = await resolveToolsInput(repositoryNwo, logger);
+    };
+    const result = resolveToolsInput("", repositoryProperties, logger);
 
-    // Empty string is falsy, so should fall back to repository property
     t.is(result, "toolcache");
-    t.is(loggedMessages.length, 2);
+    t.is(loggedMessages.length, 1);
     t.is(
-      loggedMessages[1].message,
+      loggedMessages[0].message,
       "Setting tools: toolcache based on the 'github-codeql-tools' repository property.",
     );
   },
 );
 
-test.serial(
-  "resolveToolsInput handles various tools input values correctly",
-  async (t) => {
+test(
+  "resolveToolsInput returns workflow input with URL value",
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    // Test with specific version
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns("2.15.0");
-
-    const repositoryPropertiesResult = new Success({
-      [RepositoryPropertyName.TOOLS]: "2.20.0",
-    });
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
-    const result = await resolveToolsInput(repositoryNwo, logger);
-    t.is(result, "2.15.0");
-    t.is(
-      loggedMessages[loggedMessages.length - 1].message,
-      "Setting tools: 2.15.0 based on workflow input.",
-    );
-  },
-);
-
-test.serial(
-  "resolveToolsInput handles URL input values correctly",
-  async (t) => {
-    const loggedMessages: LoggedMessage[] = [];
-    const logger = getRecordingLogger(loggedMessages);
+    const url = "https://example.com/codeql-bundle.tar.gz";
+    const result = resolveToolsInput(url, {}, logger);
 
-    // Test with URL
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns("https://example.com/codeql-bundle.tar.gz");
-    const repositoryPropertiesResult = new Success({
-      [RepositoryPropertyName.TOOLS]:
-        "https://example.com/old-codeql-bundle.tar.gz",
-    });
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
-    const result = await resolveToolsInput(repositoryNwo, logger);
-    t.is(result, "https://example.com/codeql-bundle.tar.gz");
+    t.is(result, url);
+    t.is(loggedMessages.length, 1);
     t.is(
-      loggedMessages[loggedMessages.length - 1].message,
-      "Setting tools: https://example.com/codeql-bundle.tar.gz based on workflow input.",
+      loggedMessages[0].message,
+      `Setting tools: ${url} based on workflow input.`,
     );
   },
 );
 
-test.serial(
-  "resolveToolsInput handles repository property with different values",
-  async (t) => {
+test(
+  "resolveToolsInput returns repository property with 'latest' value",
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns(undefined);
-
-    // Test with "latest"
-    const repositoryProperties = {
+    const repositoryProperties: RepositoryProperties = {
       [RepositoryPropertyName.TOOLS]: "latest",
     };
-    const repositoryPropertiesResult = new Success(repositoryProperties);
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
+    const result = resolveToolsInput(undefined, repositoryProperties, logger);
 
-    const result = await resolveToolsInput(repositoryNwo, logger);
     t.is(result, "latest");
     t.is(
-      loggedMessages[loggedMessages.length - 1].message,
+      loggedMessages[0].message,
       "Setting tools: latest based on the 'github-codeql-tools' repository property.",
     );
   },
 );
 
-test.serial(
-  "resolveToolsInput handles repository property with specific version",
-  async (t) => {
+test(
+  "resolveToolsInput returns repository property with specific version",
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns(undefined);
-
-    const repositoryProperties = {
+    const repositoryProperties: RepositoryProperties = {
       [RepositoryPropertyName.TOOLS]: "2.16.1",
     };
-    const repositoryPropertiesResult = new Success(repositoryProperties);
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
+    const result = resolveToolsInput(undefined, repositoryProperties, logger);
 
-    const result = await resolveToolsInput(repositoryNwo, logger);
     t.is(result, "2.16.1");
     t.is(
-      loggedMessages[loggedMessages.length - 1].message,
+      loggedMessages[0].message,
       "Setting tools: 2.16.1 based on the 'github-codeql-tools' repository property.",
     );
   },
 );
 
-test.serial(
-  "resolveToolsInput handles undefined repository property correctly",
-  async (t) => {
+test(
+  "resolveToolsInput returns undefined when repository property is undefined",
+  (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
 
-    sinon
-      .stub(actionsUtil, "getOptionalInput")
-      .withArgs("tools")
-      .returns(undefined);
-
-    const repositoryProperties = {
+    const repositoryProperties: RepositoryProperties = {
       [RepositoryPropertyName.TOOLS]: undefined,
     };
-
-    const repositoryPropertiesResult = new Success(repositoryProperties);
-    sinon
-      .stub(properties, "loadRepositoryProperties")
-      .withArgs(repositoryNwo, logger)
-      .resolves(repositoryPropertiesResult);
-
-    const result = await resolveToolsInput(repositoryNwo, logger);
+    const result = resolveToolsInput(undefined, repositoryProperties, logger);
 
     t.is(result, undefined);
-    t.is(loggedMessages.length, 1);
-    t.is(
-      loggedMessages[0].message,
-      "Loaded repository properties: github-codeql-tools",
-    );
+    t.is(loggedMessages.length, 0);
   },
 );
+