Merge pull request #2787 from github/dbartol/remove-actions-extractor

Remove bundled copy of `actions` extractor

Author: henrymercer

CHANGELOG.md

@@ -4,7 +4,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-No user facing changes.
+- The CodeQL Action no longer includes its own copy of the extractor for the `actions` language, which is currently in public preview.
+  The `actions` extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the `actions` language _and_ you have pinned
+  your `tools:` property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable
+  `actions` analysis.
 
 ## 3.28.18 - 16 May 2025
 

actions-extractor/codeql-extractor.yml

@@ -570,20 +570,6 @@ export async function getCodeQLForCmd(
         extraArgs.push(`--trace-process-name=${processName}`);
       }
 
-      if (config.languages.indexOf(Language.actions) >= 0) {
-        // We originally added an embedded version of the Actions extractor to the CodeQL Action
-        // itself in order to deploy the extractor between CodeQL releases. When we did add the
-        // extractor to the CLI, though, its autobuild script was missing the execute bit.
-        // 2.20.6 is the first CLI release with the fully-functional extractor in the CLI. For older
-        // versions, we'll keep using the embedded extractor. We can remove the embedded extractor
-        // once 2.20.6 is deployed in the runner images.
-        if (!(await util.codeQlVersionAtLeast(codeql, "2.20.6"))) {
-          extraArgs.push("--search-path");
-          const extractorPath = path.resolve(__dirname, "../actions-extractor");
-          extraArgs.push(extractorPath);
-        }
-      }
-
       const codeScanningConfigFile = await generateCodeScanningConfig(
         config,
         logger,