Disable overlay analysis when pull request analyses fail

Once branch selection has settled on an overlay-base build, make a single
non-paginating request for the most recent pull request failure marker. In
the happy path no markers exist and the list is empty.

On detection, save the persistent overlay status cache entry, which is what
makes pull requests skip overlay analysis too, and disable overlay analysis
for this run. Any failure is treated as if no marker was found, so the check
never disables overlay analysis on its own errors.

`overlay_analysis_status_check_pr_dry_run` performs the same request and
emits the same telemetry, but leaves overlay analysis enabled.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ff943063-d9be-440f-9cac-5e44c4fcfbaa

Author: henrymercer

lib/entry-points.js

@@ -1008,6 +1008,7 @@ interface OverlayDatabaseModeTestSetup {
   diskUsage: DiskUsage | undefined;
   memoryFlagValue: number;
   shouldSkipOverlayAnalysisDueToCachedStatus: boolean;
+  shouldSkipOverlayAnalysisDueToPullRequestFailure: boolean;
   repositoryProperties: RepositoryProperties;
 }
 
@@ -1029,6 +1030,7 @@ const defaultOverlayDatabaseModeTestSetup: OverlayDatabaseModeTestSetup = {
   },
   memoryFlagValue: 6920,
   shouldSkipOverlayAnalysisDueToCachedStatus: false,
+  shouldSkipOverlayAnalysisDueToPullRequestFailure: false,
   repositoryProperties: {},
 };
 
@@ -1072,6 +1074,13 @@ const checkOverlayEnablementMacro = makeMacro({
           .stub(overlayStatus, "shouldSkipOverlayAnalysis")
           .resolves(setup.shouldSkipOverlayAnalysisDueToCachedStatus);
 
+        sinon
+          .stub(
+            overlayStatus,
+            "shouldSkipOverlayAnalysisAfterPullRequestFailure",
+          )
+          .resolves(setup.shouldSkipOverlayAnalysisDueToPullRequestFailure);
+
         // Mock feature flags
         const features = createFeatures(setup.features);
 
@@ -1206,6 +1215,59 @@ checkOverlayEnablementMacro.serial(
   },
 );
 
+checkOverlayEnablementMacro.serial(
+  "No overlay-base database on default branch if a pull request analysis failed",
+  {
+    languages: [BuiltInLanguage.javascript],
+    features: [
+      Feature.OverlayAnalysis,
+      Feature.OverlayAnalysisJavascript,
+      Feature.OverlayAnalysisStatusCheckPr,
+    ],
+    isDefaultBranch: true,
+    shouldSkipOverlayAnalysisDueToPullRequestFailure: true,
+  },
+  {
+    disabledReason: OverlayDisabledReason.PullRequestAnalysisFailed,
+  },
+);
+
+checkOverlayEnablementMacro.serial(
+  "Overlay-base database on default branch if no pull request analysis failed",
+  {
+    languages: [BuiltInLanguage.javascript],
+    features: [
+      Feature.OverlayAnalysis,
+      Feature.OverlayAnalysisJavascript,
+      Feature.OverlayAnalysisStatusCheckPr,
+    ],
+    isDefaultBranch: true,
+    shouldSkipOverlayAnalysisDueToPullRequestFailure: false,
+  },
+  {
+    overlayDatabaseMode: OverlayDatabaseMode.OverlayBase,
+    useOverlayDatabaseCaching: true,
+  },
+);
+
+checkOverlayEnablementMacro.serial(
+  "Pull request analyses do not consult the pull request failure status",
+  {
+    languages: [BuiltInLanguage.javascript],
+    features: [
+      Feature.OverlayAnalysis,
+      Feature.OverlayAnalysisJavascript,
+      Feature.OverlayAnalysisStatusCheckPr,
+    ],
+    isPullRequest: true,
+    shouldSkipOverlayAnalysisDueToPullRequestFailure: true,
+  },
+  {
+    overlayDatabaseMode: OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: true,
+  },
+);
+
 checkOverlayEnablementMacro.serial(
   "Overlay-base database on default branch when feature enabled with custom analysis",
   {

src/config-utils.test.ts

@@ -70,7 +70,12 @@ import {
   OverlayDisabledReason,
 } from "./overlay/diagnostics";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
-import { shouldSkipOverlayAnalysis } from "./overlay/status";
+import {
+  getPullRequestFailureCheck,
+  PullRequestFailureCheck,
+  shouldSkipOverlayAnalysis,
+  shouldSkipOverlayAnalysisAfterPullRequestFailure,
+} from "./overlay/status";
 import { RepositoryNwo } from "./repository";
 import { ToolsFeature } from "./tools-features";
 import { downloadTrapCaches } from "./trap-caching";
@@ -780,8 +785,16 @@ export async function checkOverlayEnablement(
   const checkOverlayStatus = await features.getValue(
     Feature.OverlayAnalysisStatusCheck,
   );
+  const pullRequestFailureCheck = await getPullRequestFailureCheck(features);
+  // The pull request failure check needs the disk usage to compute its cache key prefix, but it
+  // only applies when analyzing the default branch, and it fails open if the disk usage is
+  // unavailable rather than disabling overlay analysis.
   const needDiskUsage = performResourceChecks || checkOverlayStatus;
-  const diskUsage = needDiskUsage ? await checkDiskUsage(logger) : undefined;
+  const wantDiskUsage =
+    needDiskUsage ||
+    (pullRequestFailureCheck !== PullRequestFailureCheck.None &&
+      !isAnalyzingPullRequest());
+  const diskUsage = wantDiskUsage ? await checkDiskUsage(logger) : undefined;
   if (needDiskUsage && diskUsage === undefined) {
     logger.warning(
       `Unable to determine disk usage, therefore setting overlay database mode to ${OverlayDatabaseMode.None}.`,
@@ -822,6 +835,22 @@ export async function checkOverlayEnablement(
         "with caching because we are analyzing a pull request.",
     );
   } else if (await isAnalyzingDefaultBranch()) {
+    if (
+      diskUsage !== undefined &&
+      (await shouldSkipOverlayAnalysisAfterPullRequestFailure(
+        codeql,
+        languages,
+        diskUsage,
+        pullRequestFailureCheck,
+        logger,
+      ))
+    ) {
+      logger.info(
+        `Setting overlay database mode to ${OverlayDatabaseMode.None} ` +
+          "because a pull request analysis using overlay analysis did not complete successfully.",
+      );
+      return new Failure(OverlayDisabledReason.PullRequestAnalysisFailed);
+    }
     overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
     logger.info(
       `Setting overlay database mode to ${overlayDatabaseMode} ` +

src/config-utils.ts

@@ -157,6 +157,19 @@ export enum Feature {
   OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
   /** Controls whether the Actions cache is checked for overlay build outcomes. */
   OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
+  /**
+   * Controls whether the Actions cache is checked for pull request analyses that failed while
+   * using overlay analysis, and overlay analysis disabled if any are found.
+   *
+   * Requires `OverlayAnalysisStatusCheck` to be enabled as well: disabling overlay analysis for
+   * subsequent runs works by writing the cache entry that flag controls the reading of.
+   */
+  OverlayAnalysisStatusCheckPr = "overlay_analysis_status_check_pr",
+  /**
+   * Like `OverlayAnalysisStatusCheckPr`, but only logs a diagnostic instead of disabling overlay
+   * analysis. `OverlayAnalysisStatusCheckPr` overrides this flag.
+   */
+  OverlayAnalysisStatusCheckPrDryRun = "overlay_analysis_status_check_pr_dry_run",
   /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
   OverlayAnalysisStatusSave = "overlay_analysis_status_save",
   QaTelemetryEnabled = "qa_telemetry_enabled",
@@ -414,6 +427,16 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK",
     minimumVersion: undefined,
   },
+  [Feature.OverlayAnalysisStatusCheckPr]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK_PR",
+    minimumVersion: undefined,
+  },
+  [Feature.OverlayAnalysisStatusCheckPrDryRun]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK_PR_DRY_RUN",
+    minimumVersion: undefined,
+  },
   [Feature.OverlayAnalysisStatusSave]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",