Document exclusion of nightlies

src/overlay/caching.test.ts

@@ -390,3 +390,30 @@ test.serial(
     t.deepEqual(result, ["2.25.0"]);
   },
 );
+
+test.serial(
+  "getCodeQlVersionsForOverlayBaseDatabases ignores nightly versions with build metadata",
+  async (t) => {
+    const logger = getRunnerLogger(true);
+
+    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
+    sinon.stub(apiClient, "listActionsCaches").resolves([
+      {
+        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-2.25.0-abc123-1-1",
+      },
+      {
+        // Nightly release with semver build metadata; should be ignored.
+        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-2.26.0+202604211234-def456-2-1",
+      },
+      {
+        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-2.24.0-ghi789-3-1",
+      },
+    ]);
+
+    const result = await getCodeQlVersionsForOverlayBaseDatabases(
+      ["python"],
+      logger,
+    );
+    t.deepEqual(result, ["2.25.0", "2.24.0"]);
+  },
+);

src/overlay/caching.ts

@@ -437,9 +437,9 @@ async function getCacheKeyPrefixBase(
 
 /**
  * Searches the GitHub Actions cache for overlay-base databases matching the given languages, and
- * returns all CodeQL versions found across matching cache entries.
+ * returns all stable CodeQL versions found across matching cache entries.
  *
- * @returns Unique CodeQL versions found in cached overlay-base databases, sorted from latest to
+ * @returns Unique stable CodeQL versions found in cached overlay-base databases, sorted from latest to
  * earliest, or undefined if one of the languages is not a built-in language.
  */
 export async function getCodeQlVersionsForOverlayBaseDatabases(
@@ -475,9 +475,14 @@ export async function getCodeQlVersionsForOverlayBaseDatabases(
       `${caches.length === 1 ? "database" : "databases"} in the Actions cache.`,
   );
 
-  // Parse CodeQL versions from cache keys.
-  // After the prefix, the remaining key format starts with
-  // `${codeQlVersion}-`.
+  // Parse CodeQL versions from cache keys, matching only stable releases.
+  //
+  // After the prefix, the remaining key format starts with `${codeQlVersion}-`. Nightlies will have
+  // a suffix like `+202604201548` that will break the match.
+  //
+  // Caveat: this relies on the fact that we haven't released any CodeQL bundles with the
+  // `x.y.z-<pre-release>` semver format which does not interact well with the current overlay base
+  // DB cache key format.
   const versionRegex = /^([\d.]+)-/;
   const versionSet = new Set<string>();