Enable a controlled switchover between CodeQL releases

CHANGELOG.md

@@ -2,8 +2,12 @@
 
 ## [UNRELEASED]
 
-- The default version of the CodeQL tools when running the CodeQL Action on github.com will now be more stable during the release of new GitHub Actions runner images. This will prevent fluctuations in code scanning alerts while a new runner image release rolls out to GitHub-hosted Actions runners. [#1475](https://github.com/github/codeql-action/pull/1475).
-- Upcoming versions of the GitHub Actions runner images will include a change to the layout of the CodeQL tools within the Actions toolcache. Specifically, the Actions toolcache will be pre-populated with the latest two versions of the CodeQL tools, rather than just the latest CodeQL tools. The version number of the CodeQL tools within the toolcache will also change to incorporate the version number of the corresponding release of the CodeQL CLI. Users should continue to avoid depending on the layout of the CodeQL tools within the toolcache, as this may change without warning in the future.
+- Code scanning alerts will now be more stable during the release of new GitHub Actions runner images for customers running the CodeQL Action on github.com. [#1475](https://github.com/github/codeql-action/pull/1475).
+- To accomplish this, the internal layout of the GitHub Actions tool cache has changed. This will affect a minority of customers as follows.
+  - Customers with workflows on github.com that are pinned to specific old versions of the CodeQL Action (e.g. `v2.1.32`) will no longer obtain the newest version of CodeQL from the tool cache, and will instead download a compatible older version of CodeQL from GitHub Releases. To continue using the newest version of CodeQL, please update your workflows to reference the latest version of the CodeQL Action (`v2`).
+  - Customers directly interacting with the GitHub Actions tool cache directly, for example via the `@actions/tool-cache` npm package or directly on the filesystem of a GitHub Actions runner, may need to update their workflows to take into account the following changes:
+    1. On GitHub-hosted Actions runners, the tool cache is now pre-populated with two versions, rather than one version, of the CodeQL bundle.
+    2. The version numbering of each CodeQL bundle within the tool cache has changed to include the version number of the CodeQL CLI associated with that bundle, for example the bundle containing CodeQL CLI 2.11.6 is now versioned as `2.11.6-20221211` within the tool cache rather than `0.0.0-20221211`.
 
 ## 2.1.38 - 12 Jan 2023
 

src/setup-codeql.ts

@@ -153,7 +153,7 @@ export async function tryFindCliVersionDotcomOnly(
     });
     return tryGetCodeQLCliVersionForRelease(release.data, logger);
   } catch (e) {
-    logger.error(
+    logger.debug(
       `Failed to find the CLI version for the CodeQL bundle tagged ${tagName}. Error: ${
         e instanceof Error ? e.message : e
       }`