Enable cleaning up toolcache bundles by default

[henrymercer]

This PR graduates the cleanup_toolcache_bundles feature flag and removes the CODEQL_ACTION_CLEANUP_TOOLCACHE_BUNDLES override.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk

Which use cases does this change impact?

Workflow types:

• Advanced setup - Impacts users who have custom CodeQL workflows.
• Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

• Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
• Code Quality - The changes impact analyses when analysis-kinds: code-quality.
• Other first-party - The changes impact other first-party analyses.

Environments:

• Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

• Telemetry - The existing codeql-action/toolcache-bundle-cleanup diagnostic reports deleted versions and whether cleanup failed.
• Other - Cleanup failures remain visible in action logs and do not prevent the bundle download from continuing.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows. The removed environment variable was an internal rollout override rather than a documented workflow interface.
• Consider adding a changelog entry for this change. The 4.38.0 entry already describes the staged rollout, so no additional entry is included.
• Confirm the readme and docs have been updated if necessary. No documentation updates are required.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

🔵 Needs a closer look

Removing the cleanup disable switch warrants human confirmation of rollout telemetry.

0 open findings

What changed in this PR

Makes CodeQL toolcache cleanup the default on eligible GitHub-hosted runners to reclaim disk space for analysis.

Changes:

• Removes the cleanup feature flag and environment override while retaining existing safeguards.
• Updates tests and the multi-language autodetection check template for the new default.

File	Description
src/​setup-codeql.ts	Removes feature gating from bundle cleanup.
src/​setup-codeql.test.ts	Updates cleanup tests and injected environments.
src/​feature-flags.ts	Removes the cleanup flag and override configuration.
pr-checks/​checks/​multi-language-autodetect.yml	Removes the obsolete cleanup override.

Files excluded by content exclusion policy (2)

• .github/workflows/__multi-language-autodetect.yml
• lib/entry-points.js

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.