`tools: linked` doesn't seem to work?

[Adam5Wu]

If my understanding is correct, using tools: linked is supposed to used the pre-cached CodeQL in the host image, thereby saving initialization time.

But my latest attempt shows that it doesn't seem to work:

...
'tools: linked' was requested, so using CodeQL version 2.20.6, the version shipped with the Action.
Did not find CodeQL tools version 2.20.6 in the toolcache.
Using CodeQL CLI version 2.20.6 sourced from https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.20.6/codeql-bundle-win64.tar.gz .
...

[adityasharad]

Thanks for checking. I believe this is working as designed. tools: linked will use the CodeQL version associated by default with the version of the CodeQL Action you're using - this is defined in https://github.com/github/codeql-action/blob/main/lib/defaults.json. This is not guaranteed to be the same version pre-cached in the Actions runner image's tool cache, as these are rolled out on different frequencies (in practice they will usually not match when we've just rolled out a new CodeQL version, and will start to match about a week later when the cache is updated). We treat the tool cache as a performance optimisation without guaranteeing that runs will hit it.

I hope this helps - please let us know if you have more questions.

[Adam5Wu]

Thanks for the explanation, @adityasharad!

I'd like to avoid the prolonged wait for CodeQL to set up init, is there any way I could tell the init action to "just use whatever version in the tool-cache"?

[adityasharad]

I believe we no longer provide this option. It used to be the default behaviour if you didn't specify tools; however we changed it for a subtle but good reason. GitHub Actions runner image changes are rolled out gradually on a per-run (not per-repo) basis, which meant that if CodeQL is loaded only from the tool cache, alternate runs of code scanning on the same repo could pick up different image versions and hence different CodeQL versions from the cache, and then the set of alerts found on that branch could "wobble" (open, close, and reopen spuriously) as CodeQL capabilities change between versions. Today, if tools isn't specified, GitHub decides the CodeQL version for you instead, and we gradually roll out new versions in a consistent way.

I understand the desire to speed up the init step, but we expect the CodeQL download to take no more than a minute, and have been improving the performance of this step. If you're not seeing that, could you please share a link to your repo so we can investigate?

[Adam5Wu]

The Initialize CodeQL step for me were between 2:00 ~ 3:30, e.g,:

• https://github.com/Adam5Wu/ESPWS2812FBLess/actions/runs/13803346086/job/38609618478
• https://github.com/Adam5Wu/ESPWS2812FBLess/actions/runs/13824523778/job/38676931225

I did notice that the set up on Linux seems to complete faster than on Windows.

---

BTW: I did hack my way through to trick the init script to use the version from the tool cache. 😄
... and that cuts down the end-to-end time of the step to 0:50:

• https://github.com/Adam5Wu/ESPWS2812FBLess/actions/runs/13826025798/job/38681011090

[aeisenberg]

Thanks for your feedback. We're aware that initializing the tools on Windows can be slow. We're working on a fix, but I can't guarantee when it will be available.

Until then, I recommend that you perform your analyses on a linux runner if at all possible.

[Adam5Wu]

Thanks for the explanation and confirmation!