[sam-robson]

filterAlertsByDiffRange compares SARIF artifactLocation.uri values against changed file paths from GitHub's diff API (range.path). CodeQL percent-encodes artifactLocation.uri in SARIF, while range.path is a raw file path, so alerts in files with spaces, non-ASCII characters, or special characters were dropped during diff-informed filtering.

Decode locationUri with decodeURIComponent before matching against range.path, while keeping the raw locationUri check for unencoded paths or malformed percent sequences.

 filterAlertsByDiffRange(sarifLog)
   readDiffRangesJsonFile() -> range.path ("with space/board.js")
   for each result location
     locationUri = physicalLocation.artifactLocation.uri ("with%20space/board.js")
+    decodedLocationUri = decodeURIComponent(locationUri) ("with space/board.js")
-    match range.path === locationUri
+    match range.path === decodedLocationUri || range.path === locationUri

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

• Advanced setup - Impacts users who have custom CodeQL workflows.
• Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

• Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
• Code Quality - The changes impact analyses when analysis-kinds: code-quality.
• Other first-party - The changes impact other first-party analyses.
• Third-party analyses - The changes affect the upload-sarif action.

Environments:

• Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
• GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

• Telemetry - I rely on existing telemetry or have made changes to the telemetry.
  • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
  • Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

🟢 Approval recommended

No active review issues remain, so the URI-decoding and fallback changes are ready for approval.

No open issues 🎉

1 file not reviewed

• lib/entry-points.js: Excluded by your content exclusion settings

What changed in this PR

This pull request fixes diff-informed SARIF alert filtering by decoding percent-encoded artifact URIs before comparing them with raw GitHub diff paths, while preserving raw URI fallback behavior.

Changes:

• Decode SARIF location URIs before diff-range matching.
• Preserve raw matching for unencoded and malformed URIs.
• Add unit coverage for encoded paths, special characters, Unicode, related locations, line ranges, and malformed URIs.
• Document the filtering correction.

File	Description
unreleased-change-notes/​decode-diff-informed-sarif-uris.md	Documents the corrected alert-filtering behavior.
src/​upload-lib.ts	Decodes SARIF location URIs and compares decoded and raw paths during filtering.
src/​upload-lib.test.ts	Adds coverage for encoded, raw, related, and malformed URI cases.

_{Review effort: Lite (auto)}