[Linux,macOS,Windows] Download two latest CodeQL bundles (#6884)

Previously, our runner image only included the most recent release of CodeQL. In order to improve stability of rollout of new CodeQL versions, we are now downloading the most recent two releases. The change updates the Linux and Windows script variable names to match that of the Mac script, because they are mostly functionally identical. It also adds the same log messages to all scripts and ensures Mac and Windows test parity. It tests that there are two bundles in each of the OS's as well. This will approximately double the total size and installation time of the existing CodeQL tool.
2025-12-14 13:17:54 +00:00 · 2023-01-29 05:46:43 -08:00
parent 2205d11bf5
commit 1e75a20a49
12 changed files with 218 additions and 78 deletions
--- a/images/linux/scripts/SoftwareReport/SoftwareReport.Generator.ps1
+++ b/images/linux/scripts/SoftwareReport/SoftwareReport.Generator.ps1
@@ -103,7 +103,7 @@ $tools.AddToolVersion("Bazelisk", $(Get-BazeliskVersion))
 $tools.AddToolVersion("Bicep", $(Get-BicepVersion))
 $tools.AddToolVersion("Buildah", $(Get-BuildahVersion))
 $tools.AddToolVersion("CMake", $(Get-CMakeVersion))
-$tools.AddToolVersion("CodeQL Action Bundle", $(Get-CodeQLBundleVersion))
+$tools.AddToolVersion("CodeQL Action Bundles", $(Get-CodeQLBundleVersions))
 $tools.AddToolVersion("Docker Amazon ECR Credential Helper", $(Get-DockerAmazonECRCredHelperVersion))
 $tools.AddToolVersion("Docker Compose v1", $(Get-DockerComposeV1Version))
 $tools.AddToolVersion("Docker Compose v2", $(Get-DockerComposeV2Version))
--- a/images/linux/scripts/SoftwareReport/SoftwareReport.Tools.psm1
+++ b/images/linux/scripts/SoftwareReport/SoftwareReport.Tools.psm1
@@ -30,12 +30,17 @@ function Get-BicepVersion {
    return $Matches.Version
 }

-function Get-CodeQLBundleVersion {
+function Get-CodeQLBundleVersions {
    $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
-    $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Select-Object -First 1 -Expand FullName
-    $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
+    $CodeQLVersionPaths = Get-ChildItem $CodeQLVersionsWildcard 
+    $CodeQlVersions=@()
+    foreach ($CodeQLVersionPath in $CodeQLVersionPaths) {
+        $FullCodeQLVersionPath = $CodeQLVersionPath | Select-Object -Expand FullName
+        $CodeQLPath = Join-Path $FullCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
        $CodeQLVersion = & $CodeQLPath version --quiet
-    return $CodeQLVersion
+        $CodeQLVersions += $CodeQLVersion
+    }
+    return $CodeQLVersions
 }

 function Get-PodManVersion {
--- a/images/linux/scripts/installers/codeql-bundle.sh
+++ b/images/linux/scripts/installers/codeql-bundle.sh
@@ -7,19 +7,39 @@
 source $HELPER_SCRIPTS/install.sh

 # Retrieve the name of the CodeQL bundle preferred by the Action (in the format codeql-bundle-YYYYMMDD).
-codeql_bundle_name="$(curl -sSL https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json | jq -r .bundleVersion)"
-# Convert the bundle name to a version number (0.0.0-YYYYMMDD).
-codeql_bundle_version="0.0.0-${codeql_bundle_name##*-}"
+base_url="$(curl -sSL https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json)"
+codeql_tag_name="$(echo "$base_url" | jq -r '.bundleVersion')"
+codeql_cli_version="$(echo "$base_url" | jq -r '.cliVersion')"
+prior_codeql_tag_name="$(echo "$base_url" | jq -r '.priorBundleVersion')"
+prior_codeql_cli_version="$(echo "$base_url" | jq -r '.priorCliVersion')"

-extraction_directory="$AGENT_TOOLSDIRECTORY/CodeQL/$codeql_bundle_version/x64"
-mkdir -p "$extraction_directory"
+# Convert the tag names to bundles with a version number (x.y.z-YYYYMMDD).
+codeql_bundle_version="${codeql_cli_version}-${codeql_tag_name##*-}"
+prior_codeql_bundle_version="${prior_codeql_cli_version}-${prior_codeql_tag_name##*-}"

-echo "Downloading CodeQL bundle $codeql_bundle_version..."
-download_with_retries "https://github.com/github/codeql-action/releases/download/$codeql_bundle_name/codeql-bundle.tar.gz" "/tmp" "codeql-bundle.tar.gz"
-tar -xzf "/tmp/codeql-bundle.tar.gz" -C "$extraction_directory"
+# Download and name both CodeQL bundles.
+codeql_bundle_versions=("${codeql_bundle_version}" "${prior_codeql_bundle_version}")
+codeql_tag_names=("${codeql_tag_name}" "${prior_codeql_tag_name}")

-# Touch a special file that indicates to the CodeQL Action that this bundle was baked-in to the hosted runner images.
-touch "$extraction_directory/pinned-version"
+for index in "${!codeql_bundle_versions[@]}"; do
+  bundle_version="${codeql_bundle_versions[$index]}"
+  bundle_tag_name="${codeql_tag_names[$index]}"
  
-# Touch a file to indicate to the toolcache that setting up CodeQL is complete.
-touch "$extraction_directory.complete"
+  echo "Downloading CodeQL bundle $bundle_version..."
+    download_with_retries "https://github.com/github/codeql-action/releases/download/$bundle_tag_name/codeql-bundle.tar.gz" "/tmp" "codeql-bundle.tar.gz"
+    codeql_archive="/tmp/codeql-bundle.tar.gz"
+
+    codeql_toolcache_path="$AGENT_TOOLSDIRECTORY/CodeQL/$bundle_version/x64"
+    mkdir -p "$codeql_toolcache_path"
+
+    echo "Unpacking the downloaded CodeQL bundle archive..."
+    tar -xzf "$codeql_archive" -C "$codeql_toolcache_path"
+
+    # We only pin the latest version in the toolcache, to support overriding the CodeQL version specified in defaults.json on GitHub Enterprise.
+    if [[ "$bundle_version" == "$codeql_bundle_version" ]]; then
+        touch "$codeql_toolcache_path/pinned-version"
+    fi
+
+    # Touch a file to indicate to the toolcache that setting up CodeQL is complete.
+    touch "$codeql_toolcache_path.complete"
+done
--- a/images/linux/scripts/tests/Toolset.Tests.ps1
+++ b/images/linux/scripts/tests/Toolset.Tests.ps1
@@ -60,6 +60,19 @@ Describe "Toolset" {
                        }
                    }
                }
+
+                # Validate that there are two versions of CodeQL included. 
+                if ($toolName -eq "CodeQL") {
+                    $foundPriorVersion = Get-Item $expectedVersionPath `
+                        | Sort-Object -Property {[SemVer]$_.name} -Descending `
+                        | Select-Object -Last 1
+                    $foundPriorVersionPath = Join-Path $foundPriorVersion $tool.arch
+
+                    $priorExecutablePath = Join-Path $foundPriorVersionPath "codeql/codeql"   
+                    It "Validate prior version of codeql/codeql" -TestCases @{PriorExecutablePath = $priorExecutablePath} {
+                        $PriorExecutablePath | Should -Exist
+                    }
+                }
            }
        }
    }
--- a/images/macos/provision/core/codeql-bundle.sh
+++ b/images/macos/provision/core/codeql-bundle.sh
@@ -2,24 +2,41 @@
 source ~/utils/utils.sh

 # Retrieve the name of the CodeQL bundle preferred by the Action (in the format codeql-bundle-YYYYMMDD).
-codeql_bundle_name="$(curl -sSL https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json | jq -r .bundleVersion)"
-# Convert the bundle name to a version number (0.0.0-YYYYMMDD).
-codeql_bundle_version="0.0.0-${codeql_bundle_name##*-}"
+base_url="$(curl -sSL https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json)"
+codeql_tag_name="$(echo "$base_url" | jq -r '.bundleVersion')"
+codeql_cli_version="$(echo "$base_url" | jq -r '.cliVersion')"
+prior_codeql_tag_name="$(echo "$base_url" | jq -r '.priorBundleVersion')"
+prior_codeql_cli_version="$(echo "$base_url" | jq -r '.priorCliVersion')"

-echo "Downloading CodeQL bundle $codeql_bundle_version..."
-download_with_retries "https://github.com/github/codeql-action/releases/download/$codeql_bundle_name/codeql-bundle.tar.gz" "/tmp" "codeql-bundle.tar.gz"
-codeqlArchive="/tmp/codeql-bundle.tar.gz"
+# Convert the tag names to bundles with a version number (x.y.z-YYYYMMDD).
+codeql_bundle_version="${codeql_cli_version}-${codeql_tag_name##*-}"
+prior_codeql_bundle_version="${prior_codeql_cli_version}-${prior_codeql_tag_name##*-}"

-codeqlToolcachePath="$AGENT_TOOLSDIRECTORY/codeql/$codeql_bundle_version/x64"
-mkdir -p $codeqlToolcachePath
+# Download and name both CodeQL bundles.
+codeql_bundle_versions=("${codeql_bundle_version}" "${prior_codeql_bundle_version}")
+codeql_tag_names=("${codeql_tag_name}" "${prior_codeql_tag_name}")

-echo "Unpacking the downloaded CodeQL bundle archive..."
-tar -xzf $codeqlArchive -C $codeqlToolcachePath
+for index in "${!codeql_bundle_versions[@]}"; do
+  bundle_version="${codeql_bundle_versions[$index]}"
+  bundle_tag_name="${codeql_tag_names[$index]}"
  
-# Touch a special file that indicates to the CodeQL Action that this bundle was baked-in to the hosted runner images.
-touch "$codeqlToolcachePath/pinned-version"
+  echo "Downloading CodeQL bundle $bundle_version..."
+    download_with_retries "https://github.com/github/codeql-action/releases/download/$bundle_tag_name/codeql-bundle.tar.gz" "/tmp" "codeql-bundle.tar.gz"
+    codeql_archive="/tmp/codeql-bundle.tar.gz"

-# Touch a file to indicate to the toolcache that setting up CodeQL is complete.
-touch "$codeqlToolcachePath.complete"
+    codeql_toolcache_path="$AGENT_TOOLSDIRECTORY/CodeQL/$bundle_version/x64"
+    mkdir -p "$codeql_toolcache_path"

-invoke_tests "Common" "CodeQL"
+    echo "Unpacking the downloaded CodeQL bundle archive..."
+    tar -xzf "$codeql_archive" -C "$codeql_toolcache_path"
+
+    # We only pin the latest version in the toolcache, to support overriding the CodeQL version specified in defaults.json on GitHub Enterprise.
+    if [[ "$bundle_version" == "$codeql_bundle_version" ]]; then
+        touch "$codeql_toolcache_path/pinned-version"
+    fi
+
+    # Touch a file to indicate to the toolcache that setting up CodeQL is complete.
+    touch "$codeql_toolcache_path.complete"
+done
+
+invoke_tests "Common" "CodeQLBundles"
--- a/images/macos/software-report/SoftwareReport.Common.psm1
+++ b/images/macos/software-report/SoftwareReport.Common.psm1
@@ -632,12 +632,17 @@ function Build-GraalVMTable {
    }
 }

-function Get-CodeQLBundleVersion {
-    $CodeQLVersionWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
-    $CodeQLVersionPath = Get-ChildItem $CodeQLVersionWildcard | Select-Object -First 1 -Expand FullName
-    $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
+function Get-CodeQLBundleVersions {
+    $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+    $CodeQLVersionPaths = Get-ChildItem $CodeQLVersionsWildcard 
+    $CodeQlVersions=@()
+    foreach ($CodeQLVersionPath in $CodeQLVersionPaths) {
+        $FullCodeQLVersionPath = $CodeQLVersionPath | Select-Object -Expand FullName
+        $CodeQLPath = Join-Path $FullCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
        $CodeQLVersion = & $CodeQLPath version --quiet
-    return $CodeQLVersion
+        $CodeQLVersions += $CodeQLVersion
+    }
+    return $CodeQLVersions
 }

 function Get-ColimaVersion {
--- a/images/macos/software-report/SoftwareReport.Generator.ps1
+++ b/images/macos/software-report/SoftwareReport.Generator.ps1
@@ -137,7 +137,7 @@ $tools.AddToolVersion("Bicep CLI", $(Get-BicepVersion))
 $tools.AddToolVersion("Cabal", $(Get-CabalVersion))
 $tools.AddToolVersion("Cmake", $(Get-CmakeVersion))
 if (-not $os.IsCatalina) {
-    $tools.AddToolVersion("CodeQL Action Bundle", $(Get-CodeQLBundleVersion))
+    $tools.AddToolVersion("CodeQL Action Bundles", $(Get-CodeQLBundleVersions))
 }
 if (-not $os.IsCatalina) {
    $tools.AddToolVersion("Colima", $(Get-ColimaVersion))
--- a/images/macos/tests/Common.Tests.ps1
+++ b/images/macos/tests/Common.Tests.ps1
@@ -139,15 +139,39 @@ Describe "VirtualBox" -Skip:($os.IsBigSur) {
    }
 }

-Describe "CodeQL" -Skip:($os.IsCatalina) {
-    It "codeql" {
-        $CodeQLVersionWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
-        $CodeQLVersionPath = Get-ChildItem $CodeQLVersionWildcard | Select-Object -First 1 -Expand FullName
-        $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
-        "$CodeQLPath version --quiet" | Should -ReturnZeroExitCode
+Describe "CodeQLBundles" -Skip:($os.IsCatalina) {
+    It "Latest CodeQL Bundle" {
+        $CodeQLVersionWildcards = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $LatestCodeQLVersionPath = Get-ChildItem $CodeQLVersionWildcards | Sort-Object -Property { [SemVer]$_.name } -Descending | Select-Object -First 1 -Expand FullName
+        $LatestCodeQLPath = Join-Path $LatestCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
+        "$LatestCodeQLPath version --quiet" | Should -ReturnZeroExitCode

-        $CodeQLPacksPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "qlpacks"
-        $CodeQLPacksPath | Should -Exist
+        $LatestCodeQLPacksPath = Join-Path $LatestCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "qlpacks"
+        $LatestCodeQLPacksPath | Should -Exist
+    }
+
+    It "Prior CodeQL Bundle" {
+        $CodeQLVersionWildcards = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $PriorCodeQLVersionPath = Get-ChildItem $CodeQLVersionWildcards | Sort-Object -Property { [SemVer]$_.name } -Descending | Select-Object -Last 1 -Expand FullName
+        $PriorCodeQLPath = Join-Path $PriorCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
+        "$PriorCodeQLPath version --quiet" | Should -ReturnZeroExitCode
+
+        $PriorCodeQLPacksPath = Join-Path $PriorCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "qlpacks"
+        $PriorCodeQLPacksPath | Should -Exist
+    }
+
+    It "Latest and Prior CodeQL Bundles are unique" {
+        $CodeQLVersionWildcards = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+
+        $LatestCodeQLVersionPath = Get-ChildItem $CodeQLVersionWildcards | Sort-Object -Property { [SemVer]$_.name } -Descending | Select-Object -First 1 -Expand FullName
+        $LatestCodeQLPath = Join-Path $LatestCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
+        $LatestCodeQLVersion = & $LatestCodeQLPath version --quiet
+
+        $PriorCodeQLVersionPath = Get-ChildItem $CodeQLVersionWildcards | Sort-Object -Property { [SemVer]$_.name } -Descending | Select-Object -Last 1 -Expand FullName
+        $PriorCodeQLPath = Join-Path $PriorCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql"
+        $PriorCodeQLVersion = & $PriorCodeQLPath version --quiet
+
+        $LatestCodeQLVersion | Should -Not -Match $PriorCodeQLVersion
    }
 }

--- a/images/win/scripts/Installers/Install-CodeQLBundle.ps1
+++ b/images/win/scripts/Installers/Install-CodeQLBundle.ps1
@@ -4,25 +4,48 @@
 ################################################################################

 # Retrieve the name of the CodeQL bundle preferred by the Action (in the format codeql-bundle-YYYYMMDD).
-$CodeQLBundleName = (Invoke-RestMethod "https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json").bundleVersion
-# Convert the bundle name to a version number (0.0.0-YYYYMMDD).
-$CodeQLBundleVersion = "0.0.0-" + $CodeQLBundleName.split("-")[-1]
+$Defaults = (Invoke-RestMethod "https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json")
+$CodeQLTagName = $Defaults.bundleVersion
+$CodeQLCliVersion = $Defaults.cliVersion
+$PriorCodeQLTagName = $Defaults.priorBundleVersion
+$PriorCodeQLCliVersion = $Defaults.priorCliVersion

-$ExtractionDirectory = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath $CodeQLBundleVersion | Join-Path -ChildPath "x64"
-New-Item -Path $ExtractionDirectory -ItemType Directory -Force | Out-Null
+# Convert the tag names to bundles with a version number (x.y.z-YYYYMMDD).
+$CodeQLBundleVersion = $CodeQLCliVersion + "-" + $CodeQLTagName.split("-")[-1]
+$PriorCodeQLBundleVersion = $PriorCodeQLCliVersion + "-" + $PriorCodeQLTagName.split("-")[-1]

-Write-Host "Downloading CodeQL bundle $CodeQLBundleVersion..."
-$CodeQLBundlePath = Start-DownloadWithRetry -Url "https://github.com/github/codeql-action/releases/download/$CodeQLBundleName/codeql-bundle.tar.gz" -Name "codeql-bundle.tar.gz"
-$DownloadDirectoryPath = (Get-Item $CodeQLBundlePath).Directory.FullName
-Extract-7Zip -Path $CodeQLBundlePath -DestinationPath $DownloadDirectoryPath
-$UnGzipedCodeQLBundlePath = Join-Path $DownloadDirectoryPath "codeql-bundle.tar"
-Extract-7Zip -Path $UnGzipedCodeQLBundlePath -DestinationPath $ExtractionDirectory
+$Bundles = @(
+    [PSCustomObject]@{
+        TagName=$CodeQLTagName; 
+        BundleVersion=$CodeQLBundleVersion;
+    },
+    [PSCustomObject]@{
+        TagName=$PriorCodeQLTagName; 
+        BundleVersion=$PriorCodeQLBundleVersion;
+    }
+)

-# Touch a special file that indicates to the CodeQL Action that this bundle was baked-in to the hosted runner images.
-New-Item -ItemType file (Join-Path $ExtractionDirectory -ChildPath "pinned-version")
+foreach ($Bundle in $Bundles) {
+    Write-Host "Downloading CodeQL bundle $($Bundle.BundleVersion)..."
+    $CodeQLBundlePath = Start-DownloadWithRetry -Url "https://github.com/github/codeql-action/releases/download/$($Bundle.TagName)/codeql-bundle.tar.gz" -Name "codeql-bundle.tar.gz"
+    $DownloadDirectoryPath = (Get-Item $CodeQLBundlePath).Directory.FullName

-# Touch a file to indicate to the toolcache that setting up CodeQL is complete.
-New-Item -ItemType file "$ExtractionDirectory.complete"
+    $CodeQLToolcachePath = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath $Bundle.BundleVersion | Join-Path -ChildPath "x64"
+    New-Item -Path $CodeQLToolcachePath -ItemType Directory -Force | Out-Null

-# Test that the tool has been extracted successfully.
-Invoke-PesterTests -TestFile "Tools" -TestName "CodeQLBundle"
+    Write-Host "Unpacking the downloaded CodeQL bundle archive..."
+    Extract-7Zip -Path $CodeQLBundlePath -DestinationPath $DownloadDirectoryPath
+    $UnGzipedCodeQLBundlePath = Join-Path $DownloadDirectoryPath "codeql-bundle.tar"
+    Extract-7Zip -Path $UnGzipedCodeQLBundlePath -DestinationPath $CodeQLToolcachePath
+
+    # We only pin the latest version in the toolcache, to support overriding the CodeQL version specified in defaults.json on GitHub Enterprise.
+    if ($Bundle.BundleVersion -eq $CodeQLBundleVersion) {
+        New-Item -ItemType file (Join-Path $CodeQLToolcachePath -ChildPath "pinned-version")
+    }
+
+    # Touch a file to indicate to the toolcache that setting up CodeQL is complete.
+    New-Item -ItemType file "$CodeQLToolcachePath.complete"
+}
+
+# Test that the tools have been extracted successfully.
+Invoke-PesterTests -TestFile "Tools" -TestName "CodeQLBundles"
--- a/images/win/scripts/SoftwareReport/SoftwareReport.Generator.ps1
+++ b/images/win/scripts/SoftwareReport/SoftwareReport.Generator.ps1
@@ -69,7 +69,7 @@ $tools.AddToolVersion("Bazelisk", $(Get-BazeliskVersion))
 $tools.AddToolVersion("Bicep", $(Get-BicepVersion))
 $tools.AddToolVersion("Cabal", $(Get-CabalVersion))
 $tools.AddToolVersion("CMake", $(Get-CMakeVersion))
-$tools.AddToolVersion("CodeQL Action Bundle", $(Get-CodeQLBundleVersion))
+$tools.AddToolVersion("CodeQL Action Bundle", $(Get-CodeQLBundleVersions))
 $tools.AddToolVersion("Docker", $(Get-DockerVersion))
 $tools.AddToolVersion("Docker Compose v1", $(Get-DockerComposeVersion))
 $tools.AddToolVersion("Docker Compose v2", $(Get-DockerComposeVersionV2))
--- a/images/win/scripts/SoftwareReport/SoftwareReport.Tools.psm1
+++ b/images/win/scripts/SoftwareReport/SoftwareReport.Tools.psm1
@@ -42,12 +42,17 @@ function Get-CMakeVersion {
    return $cmakeVersion
 }

-function Get-CodeQLBundleVersion {
-    $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "codeql" | Join-Path -ChildPath "*"
-    $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Select-Object -First 1 -Expand FullName
-    $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
+function Get-CodeQLBundleVersions {
+    $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+    $CodeQLVersionPaths = Get-ChildItem $CodeQLVersionsWildcard 
+    $CodeQlVersions=@()
+    foreach ($CodeQLVersionPath in $CodeQLVersionPaths) {
+        $FullCodeQLVersionPath = $CodeQLVersionPath | Select-Object -Expand FullName
+        $CodeQLPath = Join-Path $FullCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
        $CodeQLVersion = & $CodeQLPath version --quiet
-    return $CodeQLVersion
+        $CodeQLVersions += $CodeQLVersion
+    }
+    return $CodeQLVersions
 }

 function Get-DockerVersion {
--- a/images/win/scripts/Tests/Tools.Tests.ps1
+++ b/images/win/scripts/Tests/Tools.Tests.ps1
@@ -21,13 +21,41 @@ Describe "Bazel" {
    }
 }

-Describe "CodeQLBundle" {
-    It "CodeQLBundle" {
-        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "codeql" | Join-Path -ChildPath "*"
-        $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Select-Object -First 1 -Expand FullName
-        $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
-        "$CodeQLPath version" | Should -ReturnZeroExitCode
+Describe "CodeQLBundles" {
+    It "Latest CodeQL Bundle" {
+        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $LatestCodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Sort-Object -Descending | Select-Object -First 1 -Expand FullName
+        $LatestCodeQLPath = Join-Path $LatestCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
+        "$LatestCodeQLPath version --quiet" | Should -ReturnZeroExitCode
+
+        $LatestCodeQLPacksPath = Join-Path $LatestCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "qlpacks"
+        $LatestCodeQLPacksPath | Should -Exist
    }
+
+    It "Prior CodeQL Bundle" {
+        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $PriorCodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Sort-Object -Descending | Select-Object -Last 1 -Expand FullName
+        $PriorCodeQLPath = Join-Path $PriorCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
+        "$PriorCodeQLPath version --quiet" | Should -ReturnZeroExitCode
+
+        $PriorCodeQLPacksPath = Join-Path $PriorCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "qlpacks"
+        $PriorCodeQLPacksPath | Should -Exist
+    }
+
+    It "Latest and Prior CodeQL Bundles are unique" {
+        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+
+        $LatestCodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Sort-Object -Descending | Select-Object -First 1 -Expand FullName
+        $LatestCodeQLPath = Join-Path $LatestCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
+        $LatestCodeQLVersion = & $LatestCodeQLPath version --quiet
+
+        $PriorCodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Sort-Object -Descending | Select-Object -Last 1 -Expand FullName
+        $PriorCodeQLPath = Join-Path $PriorCodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
+        $PriorCodeQLVersion = & $PriorCodeQLPath version --quiet
+
+        $LatestCodeQLVersion | Should -Not -Match $PriorCodeQLVersion
+    }
+
 }

 Describe "R" {