Expose all enabled default CLI versions

lib/analyze-action-post.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -162803,11 +162803,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -162824,6 +162819,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",

lib/analyze-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare3 = require_compare();
-    var rcompare2 = (a, b, loose) => compare3(b, a, loose);
-    module2.exports = rcompare2;
+    var rcompare3 = (a, b, loose) => compare3(b, a, loose);
+    module2.exports = rcompare3;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare3 = require_compare();
-    var rcompare2 = require_rcompare();
+    var rcompare3 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare3,
-      rcompare: rcompare2,
+      rcompare: rcompare3,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare2;
-    function rcompare2(a, b, loose) {
+    exports2.rcompare = rcompare3;
+    function rcompare3(a, b, loose) {
       return compare3(b, a, loose);
     }
     exports2.sort = sort;
@@ -108403,11 +108403,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -108424,6 +108419,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -108484,10 +108484,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -108592,11 +108596,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -108655,34 +108659,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver5.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }
@@ -109673,8 +109684,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+      tagName = defaultCliVersion.enabledVersions[0].tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -109686,8 +109697,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+    tagName = defaultCliVersion.enabledVersions[0].tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url2 ?? "unknown";
@@ -113070,9 +113081,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
       url: getRequiredEnvParam("GITHUB_SERVER_URL"),
       apiURL: getRequiredEnvParam("GITHUB_API_URL")
     };
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     const initCodeQLResult = await initCodeQL(
       void 0,
       // There is no tools input on the upload action

lib/autobuild-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -104855,11 +104855,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -104876,6 +104871,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -104936,10 +104936,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -105044,11 +105048,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -105107,34 +105111,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver5.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }

lib/init-action-post.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare3 = require_compare();
-    var rcompare = (a, b, loose) => compare3(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare3(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare3 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare3,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare3(b, a, loose);
     }
     exports2.sort = sort;
@@ -166326,11 +166326,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -166347,6 +166342,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -166407,10 +166407,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -166515,11 +166519,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -166578,34 +166582,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver5.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }
@@ -167518,8 +167529,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+      tagName = defaultCliVersion.enabledVersions[0].tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -167531,8 +167542,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+    tagName = defaultCliVersion.enabledVersions[0].tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url2 ?? "unknown";
@@ -170298,9 +170309,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
       url: getRequiredEnvParam("GITHUB_SERVER_URL"),
       apiURL: getRequiredEnvParam("GITHUB_API_URL")
     };
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     const initCodeQLResult = await initCodeQL(
       void 0,
       // There is no tools input on the upload action

lib/init-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare2;
+    var rcompare3 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare3;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare2 = require_rcompare();
+    var rcompare3 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare: rcompare2,
+      rcompare: rcompare3,
       compareLoose,
       compareBuild,
       sort,
@@ -51280,8 +51280,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare2;
-    function rcompare2(a, b, loose) {
+    exports2.rcompare = rcompare3;
+    function rcompare3(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -105960,11 +105960,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -105981,6 +105976,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -106041,10 +106041,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -106149,11 +106153,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -106212,34 +106216,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver5.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }
@@ -108614,8 +108625,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+      tagName = defaultCliVersion.enabledVersions[0].tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -108627,8 +108638,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+    tagName = defaultCliVersion.enabledVersions[0].tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url ?? "unknown";
@@ -110538,9 +110549,7 @@ async function run(startedAt) {
         `The 'init' action should not be run in the same workflow as 'setup-codeql'.`
       );
     }
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
     const initCodeQLResult = await initCodeQL(
       getOptionalInput("tools"),

lib/resolve-environment-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -104846,11 +104846,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -104867,6 +104862,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",

lib/setup-codeql-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -104697,11 +104697,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -104718,6 +104713,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -104778,10 +104778,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -104886,11 +104890,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -104949,34 +104953,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver4.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }
@@ -106129,8 +106140,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+      tagName = defaultCliVersion.enabledVersions[0].tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -106142,8 +106153,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+    tagName = defaultCliVersion.enabledVersions[0].tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url ?? "unknown";
@@ -107386,9 +107397,7 @@ async function run(startedAt) {
     if (statusReportBase !== void 0) {
       await sendStatusReport(statusReportBase);
     }
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
     const initCodeQLResult = await initCodeQL(
       getOptionalInput("tools"),

lib/start-proxy-action-post.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -162123,11 +162123,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -162144,6 +162139,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",

lib/start-proxy-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare = require_compare();
-    var rcompare = (a, b, loose) => compare(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51951,8 +51951,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare(b, a, loose);
     }
     exports2.sort = sort;
@@ -121494,11 +121494,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -121515,6 +121510,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -121575,10 +121575,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -121683,11 +121687,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -121746,34 +121750,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver4.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }
@@ -122653,7 +122664,7 @@ async function getReleaseByVersion(version) {
 }
 async function getCliVersionFromFeatures(features) {
   const gitHubVersion = await getGitHubVersion();
-  return await features.getDefaultCliVersion(gitHubVersion.type);
+  return await features.getEnabledDefaultCliVersions(gitHubVersion.type);
 }
 async function getDownloadUrl(logger, features) {
   const proxyPackage = getProxyPackage();
@@ -122661,7 +122672,7 @@ async function getDownloadUrl(logger, features) {
     const useFeaturesToDetermineCLI = await features.getValue(
       "start_proxy_use_features_release" /* StartProxyUseFeaturesRelease */
     );
-    const versionInfo = useFeaturesToDetermineCLI ? await getCliVersionFromFeatures(features) : {
+    const versionInfo = useFeaturesToDetermineCLI ? (await getCliVersionFromFeatures(features)).enabledVersions[0] : {
       cliVersion,
       tagName: bundleVersion
     };

lib/upload-lib.js

@@ -45983,8 +45983,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare3 = require_compare();
-    var rcompare = (a, b, loose) => compare3(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare3(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -47209,7 +47209,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare3 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -47247,7 +47247,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare3,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare3(b, a, loose);
     }
     exports2.sort = sort;
@@ -108009,11 +108009,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -108030,6 +108025,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -108815,8 +108815,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+      tagName = defaultCliVersion.enabledVersions[0].tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -108828,8 +108828,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+    tagName = defaultCliVersion.enabledVersions[0].tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url2 ?? "unknown";
@@ -111060,9 +111060,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
       url: getRequiredEnvParam("GITHUB_SERVER_URL"),
       apiURL: getRequiredEnvParam("GITHUB_API_URL")
     };
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     const initCodeQLResult = await initCodeQL(
       void 0,
       // There is no tools input on the upload action

lib/upload-sarif-action-post.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare2(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare2 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare2,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -153559,8 +153559,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare2(b, a, loose);
     }
     exports2.sort = sort;
@@ -162293,11 +162293,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -162314,6 +162309,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",

lib/upload-sarif-action.js

@@ -44678,8 +44678,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare3 = require_compare();
-    var rcompare = (a, b, loose) => compare3(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare2 = (a, b, loose) => compare3(b, a, loose);
+    module2.exports = rcompare2;
   }
 });
 
@@ -45904,7 +45904,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare3 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare2 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -45942,7 +45942,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare3,
-      rcompare,
+      rcompare: rcompare2,
       compareLoose,
       compareBuild,
       sort,
@@ -51129,8 +51129,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare2;
+    function rcompare2(a, b, loose) {
       return compare3(b, a, loose);
     }
     exports2.sort = sort;
@@ -107682,11 +107682,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
-  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
@@ -107703,6 +107698,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -107763,10 +107763,14 @@ var OfflineFeatures = class {
     this.logger = logger;
   }
   logger;
-  async getDefaultCliVersion(_variant) {
+  async getEnabledDefaultCliVersions(_variant) {
     return {
-      cliVersion,
-      tagName: bundleVersion
+      enabledVersions: [
+        {
+          cliVersion,
+          tagName: bundleVersion
+        }
+      ]
     };
   }
   /**
@@ -107871,11 +107875,11 @@ var Features = class extends OfflineFeatures {
       logger
     );
   }
-  async getDefaultCliVersion(variant) {
+  async getEnabledDefaultCliVersions(variant) {
     if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
+      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
     }
-    return super.getDefaultCliVersion(variant);
+    return super.getEnabledDefaultCliVersions(variant);
   }
   /**
    *
@@ -107934,34 +107938,41 @@ var GitHubFeatureFlags = class {
     }
     return version;
   }
-  async getDefaultCliVersionFromFlags() {
+  /**
+   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
+   * flags, sorted from highest to lowest. Falls back to the version pinned in
+   * `defaults.json` if no such flags are enabled.
+   */
+  async getEnabledDefaultCliVersionsFromFlags() {
     const response = await this.getAllFeatures();
-    const enabledFeatureFlagCliVersions = Object.entries(response).map(
+    const sortedCliVersions = Object.entries(response).map(
       ([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0
-    ).filter((f) => f !== void 0);
-    if (enabledFeatureFlagCliVersions.length === 0) {
+    ).filter((f) => f !== void 0).sort(semver4.rcompare);
+    if (sortedCliVersions.length === 0) {
       this.logger.warning(
         `Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is ${cliVersion}.`
       );
       const result = {
-        cliVersion,
-        tagName: bundleVersion
+        enabledVersions: [
+          {
+            cliVersion,
+            tagName: bundleVersion
+          }
+        ]
       };
       if (this.hasAccessedRemoteFeatureFlags) {
         result.toolsFeatureFlagsValid = false;
       }
       return result;
     }
-    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
-      (maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion,
-      enabledFeatureFlagCliVersions[0]
-    );
     this.logger.debug(
-      `Derived default CLI version of ${maxCliVersion} from feature flags.`
+      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`
     );
     return {
-      cliVersion: maxCliVersion,
-      tagName: `codeql-bundle-v${maxCliVersion}`,
+      enabledVersions: sortedCliVersions.map((cliVersion2) => ({
+        cliVersion: cliVersion2,
+        tagName: `codeql-bundle-v${cliVersion2}`
+      })),
       toolsFeatureFlagsValid: true
     };
   }
@@ -109481,8 +109492,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+      tagName = defaultCliVersion.enabledVersions[0].tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -109494,8 +109505,8 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    cliVersion2 = defaultCliVersion.enabledVersions[0].cliVersion;
+    tagName = defaultCliVersion.enabledVersions[0].tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url2 ?? "unknown";
@@ -111655,9 +111666,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
       url: getRequiredEnvParam("GITHUB_SERVER_URL"),
       apiURL: getRequiredEnvParam("GITHUB_API_URL")
     };
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     const initCodeQLResult = await initCodeQL(
       void 0,
       // There is no tools input on the upload action