[theinfosecguy]

Merge +packs into the job’s selected language instead of the first key in a shared config. This prevents added queries from being silently skipped. Includes regression tests.

Verified with 1,232 tests and CodeQL 2.20.7/2.27.4 runs. The bundled command-injection repro on 2.27.4 reports 0 findings before the fix and 1 afterward.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the fix that applies additive query packs to the job’s selected language.

No open issues 🎉

What changed in this PR

Fixes CodeQL Action’s additive packs handling so extra query packs apply to the job’s selected language, rather than the first language in a shared configuration.

Changes:

• Passes selected languages into configuration generation and handles missing language entries.
• Adds regression coverage for shared configurations, key ordering, and array-form packs.
• Updates the generated bundle and adds a release note.

File	Description
unreleased-change-notes/​fix-pack-language-merge.md	Documents the additive packs fix.
tests/​multi-language-repo/​.github/​codeql/​codeql-config-packaging3.yml	Adds Ruby packs before JavaScript to exercise language selection.
src/​config/​db-config.ts	Merges additive packs into the selected language’s entry.
src/​config-utils.ts	Passes selected languages to configuration generation.
src/​config-utils.test.ts	Tests shared-config merging through initialization.
src/​codeql.test.ts	Covers key ordering, missing or empty entries, and array-form packs.
lib/​entry-points.js	Updates the generated JavaScript bundle.

_{Review effort: Balanced (auto)}