From 45693cc6882bb175b58a06818c91876e201037c7 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Fri, 14 Aug 2026 11:53:32 +0100
Subject: [PATCH 1/2] Refactor `ENOSPC` check into `isDiskConfigurationError`
 function

---
 lib/entry-points.js |  8 +++++++-
 src/codeql.test.ts  | 18 ++++++++++++++++++
 src/codeql.ts       | 18 ++++++++++++++++--
 3 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index 56914e8848..c7f68a4b68 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -152288,6 +152288,12 @@ var CODEQL_NEXT_MINIMUM_VERSION = "2.20.7";
 var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16";
 var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
+function isDiskConfigurationError(e) {
+  if (!(e instanceof Error)) {
+    return false;
+  }
+  return e.message.includes("ENOSPC");
+}
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) {
   try {
     const {
@@ -152323,7 +152329,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
     };
   } catch (rawError) {
     const e = wrapApiConfigurationError(rawError);
-    const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") ? ConfigurationError : Error;
+    const ErrorClass = e instanceof ConfigurationError || isDiskConfigurationError(e) ? ConfigurationError : Error;
     throw new ErrorClass(
       `Unable to download and extract CodeQL CLI: ${getErrorMessage(e)}${e instanceof Error && e.stack ? `
 
diff --git a/src/codeql.test.ts b/src/codeql.test.ts
index e8208888e7..77cf5c35cd 100644
--- a/src/codeql.test.ts
+++ b/src/codeql.test.ts
@@ -51,6 +51,24 @@ test.beforeEach(() => {
   });
 });
 
+test("isDiskConfigurationError - true for expected errors", async (t) => {
+  t.true(
+    codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")),
+  );
+});
+
+test("isDiskConfigurationError - false for other errors", async (t) => {
+  t.false(codeql.isDiskConfigurationError("Not an Error instance"));
+
+  const otherMessages = [
+    "Does not contain an error code we test for",
+    "ENOSP: Not quite the full error code",
+  ];
+  for (const otherMessage of otherMessages) {
+    t.false(codeql.isDiskConfigurationError(new Error(otherMessage)));
+  }
+});
+
 async function installIntoToolcache({
   apiDetails = SAMPLE_DOTCOM_API_DETAILS,
   cliVersion,
diff --git a/src/codeql.ts b/src/codeql.ts
index 8f7e9e7445..404819fb7f 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -273,6 +273,21 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 
+/**
+ * Decides whether `e` is a disk-related error outside of our control
+ * that should be classified as a `ConfigurationError`.
+ *
+ * @param e The error to check.
+ * @returns True if the error should be treated as a `ConfigurationError` or false if not.
+ */
+export function isDiskConfigurationError(e: unknown): boolean {
+  if (!(e instanceof Error)) {
+    return false;
+  }
+
+  return e.message.includes("ENOSPC"); // out of disk space
+}
+
 /**
  * Set up CodeQL CLI access.
  *
@@ -343,8 +358,7 @@ export async function setupCodeQL(
   } catch (rawError) {
     const e = api.wrapApiConfigurationError(rawError);
     const ErrorClass =
-      e instanceof util.ConfigurationError ||
-      (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space
+      e instanceof util.ConfigurationError || isDiskConfigurationError(e)
         ? util.ConfigurationError
         : Error;
 

From 47fa6222231b12097f83215dd7a6b4a0915841fd Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Fri, 14 Aug 2026 11:56:26 +0100
Subject: [PATCH 2/2] Make `EACCES` a `ConfigurationError`

---
 lib/entry-points.js | 6 +++++-
 src/codeql.test.ts  | 7 +++++++
 src/codeql.ts       | 7 ++++++-
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index c7f68a4b68..c10b0ce2ea 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -152292,7 +152292,11 @@ function isDiskConfigurationError(e) {
   if (!(e instanceof Error)) {
     return false;
   }
-  return e.message.includes("ENOSPC");
+  return (
+    // out of disk space
+    e.message.includes("ENOSPC") || // access denied
+    e.message.includes("EACCES")
+  );
 }
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) {
   try {
diff --git a/src/codeql.test.ts b/src/codeql.test.ts
index 77cf5c35cd..df4bafe295 100644
--- a/src/codeql.test.ts
+++ b/src/codeql.test.ts
@@ -55,6 +55,13 @@ test("isDiskConfigurationError - true for expected errors", async (t) => {
   t.true(
     codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")),
   );
+  t.true(
+    codeql.isDiskConfigurationError(
+      new Error(
+        "EACCES: permission denied, mkdir /opt/hostedtoolcache/CodeQL/",
+      ),
+    ),
+  );
 });
 
 test("isDiskConfigurationError - false for other errors", async (t) => {
diff --git a/src/codeql.ts b/src/codeql.ts
index 404819fb7f..117b0d8e65 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -285,7 +285,12 @@ export function isDiskConfigurationError(e: unknown): boolean {
     return false;
   }
 
-  return e.message.includes("ENOSPC"); // out of disk space
+  return (
+    // out of disk space
+    e.message.includes("ENOSPC") ||
+    // access denied
+    e.message.includes("EACCES")
+  );
 }
 
 /**