From 040890448b2ead3ae67c1f514514955da784ec52 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Thu, 22 Oct 2026 14:47:35 +0100
Subject: [PATCH 01/19] Add workflow to comment on a PR when it was dequeued

---
 .github/workflows/pr-dequeued.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/pr-dequeued.yml

diff --git a/.github/workflows/pr-dequeued.yml b/.github/workflows/pr-dequeued.yml
new file mode 100644
index 000000000..7d39ef97e
--- /dev/null
+++ b/.github/workflows/pr-dequeued.yml
@@ -0,0 +1,28 @@
+name: PR dequeued
+
+on:
+  pull_request:
+    types:
+      - dequeued
+
+jobs:
+  notify:
+    name: Notify
+    runs-on: ubuntu-slim
+
+    if: github.event.pull_request.merged != true
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Notify that the PR was removed from the merge queue
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REASON: ${{ github.event.reason }}
+          SENDER: ${{ github.event.sender.login }}
+        run: |
+          echo "@$SENDER The pull request was removed from the merge queue (\`$REASON\`)." \
+            "Please resolve any issues if required and enqueue the PR again." |
+            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

From 37a5faff2595fa45bfd7c8fccbe67d7ca717f315 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Fri, 23 Oct 2026 12:19:29 +0100
Subject: [PATCH 02/19] Switch to `pull_request.user.login`

---
 .github/workflows/pr-dequeued.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-dequeued.yml b/.github/workflows/pr-dequeued.yml
index 7d39ef97e..0c47c9dc7 100644
--- a/.github/workflows/pr-dequeued.yml
+++ b/.github/workflows/pr-dequeued.yml
@@ -21,8 +21,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REASON: ${{ github.event.reason }}
-          SENDER: ${{ github.event.sender.login }}
+          USER: ${{ github.event.pull_request.user.login }}
         run: |
-          echo "@$SENDER The pull request was removed from the merge queue (\`$REASON\`)." \
+          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
             "Please resolve any issues if required and enqueue the PR again." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

From 49bbf2b590d4c553b85f57a1027767333ae43d05 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Fri, 23 Oct 2026 13:30:18 +0100
Subject: [PATCH 03/19] Ping the user who enqueued a PR when it's removed from
 the merge queue

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/pr-dequeued.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-dequeued.yml b/.github/workflows/pr-dequeued.yml
index 0c47c9dc7..25260c7aa 100644
--- a/.github/workflows/pr-dequeued.yml
+++ b/.github/workflows/pr-dequeued.yml
@@ -21,8 +21,23 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REASON: ${{ github.event.reason }}
-          USER: ${{ github.event.pull_request.user.login }}
         run: |
-          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
+          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
+          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
+          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
+          enqueuer=$(gh api graphql \
+            -F number="$PR_NUMBER" \
+            -f query='
+              query($number: Int!) {
+                repository(owner: "github", name: "codeql-action") {
+                  pullRequest(number: $number) {
+                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
+                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
+                    }
+                  }
+                }
+              }' \
+            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
+          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
             "Please resolve any issues if required and enqueue the PR again." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

From fc9487df66b626f63fcde9944cbe8ec6d53525ed Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 00:23:30 +0000
Subject: [PATCH 04/19] Update supported GitHub Enterprise Server versions

---
 lib/entry-points.js        | 2 +-
 src/api-compatibility.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index 7cea6c0b6..2e8b97e41 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -169371,7 +169371,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.23";
-var minimumVersion = "3.18";
+var minimumVersion = "3.19";
 
 // src/json/index.ts
 function parseString(data) {
diff --git a/src/api-compatibility.json b/src/api-compatibility.json
index c1122fb2a..83ff180db 100644
--- a/src/api-compatibility.json
+++ b/src/api-compatibility.json
@@ -1 +1 @@
-{"maximumVersion":"3.23","minimumVersion":"3.18"}
+{"maximumVersion":"3.23","minimumVersion":"3.19"}

From b63386c3d837cbc23d61b46863530ff01b622ada Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 12:48:51 +0000
Subject: [PATCH 05/19] Update `setup-kotlin` to the latest version

---
 .github/actions/prepare-test/action.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml
index 5e2b5028f..4eb840d2d 100644
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -6,11 +6,11 @@ inputs:
     required: true
   use-all-platform-bundle:
     description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
+    default: "false"
     required: false
   setup-kotlin:
     description: "If true, we setup kotlin"
-    default: 'true'
+    default: "true"
     required: true
 outputs:
   tools-url:
@@ -73,7 +73,7 @@ runs:
           exit 1
         fi
 
-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
+    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
         version: 1.8.21

From b913bf6353dc29e7f1ab45d4de642092f88d5410 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 12:51:54 +0000
Subject: [PATCH 06/19] Point Dependabot at subdirectories in `.github/actions`

---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0e0dd0cce..ae4a4476e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,7 +26,7 @@ updates:
   - package-ecosystem: github-actions
     directories:
       - "/.github/workflows"
-      - "/.github/actions"
+      - "/.github/actions/*/"
     schedule:
       interval: weekly
     cooldown:

From ce7d3f77388f81bd5b1be6172533542b055f88de Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:04:50 +0000
Subject: [PATCH 07/19] Install newer Kotlin version

---
 .github/actions/prepare-test/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml
index 4eb840d2d..e2a55a24e 100644
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -76,4 +76,4 @@ runs:
     - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
-        version: 1.8.21
+        version: 2.1.20

From dd68f130c6e73ecc739579bdc27ccfae957da78a Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:10:50 +0000
Subject: [PATCH 08/19] Install a newer Ruby version

---
 .github/workflows/__rubocop-multi-language.yml | 3 ++-
 pr-checks/checks/rubocop-multi-language.yml    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
index c3348db6c..f2c1c3e40 100644
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -56,7 +56,8 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
-          ruby-version: 2.6
+          ruby-version: 3.4
+
       - name: Install Code Scanning integration
         run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
       - name: Install dependencies
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
index eec3aa833..cc0e493a8 100644
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -7,7 +7,8 @@ steps:
   - name: Set up Ruby
     uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
     with:
-      ruby-version: 2.6
+      ruby-version: 3.4
+
   - name: Install Code Scanning integration
     run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
   - name: Install dependencies

From eac0005d0c1946432e5427f1fa0eb3abfccb84ee Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:15:15 +0000
Subject: [PATCH 09/19] Temporarily switch old CLI checks to older Ubuntu
 runner

---
 .github/workflows/__go-tracing-autobuilder.yml |  2 +-
 .../__go-tracing-custom-build-steps.yml        |  2 +-
 .../workflows/__go-tracing-legacy-workflow.yml |  2 +-
 .../workflows/__multi-language-autodetect.yml  |  2 +-
 .github/workflows/__rust.yml                   |  2 +-
 .../workflows/debug-artifacts-failure-safe.yml | 18 +++++++++---------
 .github/workflows/debug-artifacts-safe.yml     | 18 +++++++++---------
 pr-checks/sync.ts                              | 12 ++++++++----
 8 files changed, 31 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml
index fb471c5ea..a36cc43a7 100644
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml
index b3b043def..05fedfb03 100644
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml
index 20bdea695..276d4cfda 100644
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml
index a388e5734..d54b24a1e 100644
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml
index f26b4eb2e..d3b5a8a5b 100644
--- a/.github/workflows/__rust.yml
+++ b/.github/workflows/__rust.yml
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.22.1
diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index c61bd6b17..dd4e98797 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -6,13 +6,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -30,10 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
     name: Upload debug artifacts after failure in analyze
     continue-on-error: true
     env:
@@ -43,7 +43,7 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
@@ -60,7 +60,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 6d162d9c0..1e723a45c 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -5,13 +5,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -29,10 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -41,7 +41,7 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: ubuntu-latest
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -56,7 +56,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 1729f5409..afbc7fc43 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -442,10 +442,14 @@ function generateJobMatrix(
           : [operatingSystemConfig["runner-image"]];
 
       for (const runnerImage of runnerImagesForOs) {
-        matrix.push({
-          os: runnerImage,
-          version,
-        });
+        if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {
+          matrix.push({ os: "ubuntu-24.04", version });
+        } else {
+          matrix.push({
+            os: runnerImage,
+            version,
+          });
+        }
       }
     }
   }

From ab743b6301b244dcdfa64cde84442cc86b5ebf11 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:29:56 +0000
Subject: [PATCH 10/19] Install newer version of `code-scanning-rubocop`

---
 .github/workflows/__rubocop-multi-language.yml | 5 ++++-
 pr-checks/checks/rubocop-multi-language.yml    | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
index f2c1c3e40..612856133 100644
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -59,15 +59,18 @@ jobs:
           ruby-version: 3.4
 
       - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+        run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
+
       - name: Install dependencies
         run: bundle install
+
       - name: RuboCop run
         run: |
           bash -c "
             bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
             [[ $? -ne 2 ]]
           "
+
       - uses: ./../action/upload-sarif
         with:
           sarif_file: rubocop.sarif
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
index cc0e493a8..0839d38b0 100644
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -10,15 +10,18 @@ steps:
       ruby-version: 3.4
 
   - name: Install Code Scanning integration
-    run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+    run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
+
   - name: Install dependencies
     run: bundle install
+
   - name: RuboCop run
     run: |
       bash -c "
         bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
         [[ $? -ne 2 ]]
       "
+
   - uses: ./../action/upload-sarif
     with:
       sarif_file: rubocop.sarif

From 171607b66f68b1dc4e7dc4358bdf3ad2b4009abb Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:45:49 +0000
Subject: [PATCH 11/19] Remove Rubocop workflow

---
 .../workflows/__rubocop-multi-language.yml    | 78 -------------------
 pr-checks/checks/rubocop-multi-language.yml   | 27 -------
 2 files changed, 105 deletions(-)
 delete mode 100644 .github/workflows/__rubocop-multi-language.yml
 delete mode 100644 pr-checks/checks/rubocop-multi-language.yml

diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
deleted file mode 100644
index 612856133..000000000
--- a/.github/workflows/__rubocop-multi-language.yml
+++ /dev/null
@@ -1,78 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - RuboCop multi-language
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}
-jobs:
-  rubocop-multi-language:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: default
-    name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-        with:
-          ruby-version: 3.4
-
-      - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
-
-      - name: Install dependencies
-        run: bundle install
-
-      - name: RuboCop run
-        run: |
-          bash -c "
-            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-            [[ $? -ne 2 ]]
-          "
-
-      - uses: ./../action/upload-sarif
-        with:
-          sarif_file: rubocop.sarif
-    env:
-      CODEQL_ACTION_TEST_MODE: true
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
deleted file mode 100644
index 0839d38b0..000000000
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: "RuboCop multi-language"
-description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
-# This check doesn't use CodeQL, so the `version` matrix variable is unused.
-versions:
-  - default
-steps:
-  - name: Set up Ruby
-    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-    with:
-      ruby-version: 3.4
-
-  - name: Install Code Scanning integration
-    run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
-
-  - name: Install dependencies
-    run: bundle install
-
-  - name: RuboCop run
-    run: |
-      bash -c "
-        bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-        [[ $? -ne 2 ]]
-      "
-
-  - uses: ./../action/upload-sarif
-    with:
-      sarif_file: rubocop.sarif

From 34b4917832d4628b18fa4a53cb09fec2677d4207 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 14:26:53 +0000
Subject: [PATCH 12/19] Add comment to `sync.ts`

---
 pr-checks/sync.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index afbc7fc43..25b462358 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -442,6 +442,9 @@ function generateJobMatrix(
           : [operatingSystemConfig["runner-image"]];
 
       for (const runnerImage of runnerImagesForOs) {
+        // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
+        // We could install that older version on the newer runners, or use the older runner.
+        // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
         if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {
           matrix.push({ os: "ubuntu-24.04", version });
         } else {

From 63b184d4bcdf843072170158e7f3902930d3a50d Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 14:33:26 +0000
Subject: [PATCH 13/19] Improve `sync.ts` version typing so that check constant
 becomes an error once removed

---
 pr-checks/sync.ts | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 25b462358..7824ef890 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -137,6 +137,14 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 
+// A type representing version identifiers.
+type Version =
+  | "default"
+  | "linked"
+  | "nightly-latest"
+  // This is an approximation, but sufficient validation for our needs here.
+  | `stable-v${number}.${number}.${number}`;
+
 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
   // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
@@ -159,7 +167,10 @@ const defaultTestVersions = [
   "linked",
   // A nightly build directly from the our private repo, built in the last 24 hours.
   "nightly-latest",
-];
+] as const satisfies Version[];
+
+/** A type representing the default test versions. */
+type DefaultTestVersion = (typeof defaultTestVersions)[number];
 
 /** The default versions we use for languages / frameworks, if not specified as a workflow input. */
 const defaultLanguageVersions = {
@@ -445,7 +456,13 @@ function generateJobMatrix(
         // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
         // We could install that older version on the newer runners, or use the older runner.
         // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-        if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {
+        // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
+        // is removed from `defaultTestVersions`.
+        const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
+        if (
+          runnerImage === "ubuntu-latest" &&
+          version === requiresOlderRunnerImage
+        ) {
           matrix.push({ os: "ubuntu-24.04", version });
         } else {
           matrix.push({

From bfac910f062c231a0c79c6b518252b3e5c1e1433 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Mon, 26 Oct 2026 16:43:13 +0000
Subject: [PATCH 14/19] Update CodeQL deprecation warning for GHES 3.18

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 lib/entry-points.js                              | 6 +++---
 src/codeql.ts                                    | 6 +++---
 unreleased-change-notes/ghes-3-18-deprecation.md | 1 +
 3 files changed, 7 insertions(+), 6 deletions(-)
 create mode 100644 unreleased-change-notes/ghes-3-18-deprecation.md

diff --git a/lib/entry-points.js b/lib/entry-points.js
index 2e8b97e41..196ca5584 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -176948,9 +176948,9 @@ async function getCombinedTracerConfig(logger2, codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.20.7";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.22.4";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 function isDiskConfigurationError(e) {
   if (!(e instanceof Error)) {
diff --git a/src/codeql.ts b/src/codeql.ts
index 28ba2243e..c1a8f4f34 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -260,17 +260,17 @@ const CODEQL_MINIMUM_VERSION = "2.20.7";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.22.4";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
diff --git a/unreleased-change-notes/ghes-3-18-deprecation.md b/unreleased-change-notes/ghes-3-18-deprecation.md
new file mode 100644
index 000000000..0e33d3932
--- /dev/null
+++ b/unreleased-change-notes/ghes-3-18-deprecation.md
@@ -0,0 +1 @@
+- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)

From 4a890e46e0120cbc79363f096897ef7861ea7831 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Mon, 26 Oct 2026 16:43:21 +0000
Subject: [PATCH 15/19] Remove GHES 3.18 from compatibility table

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index 8c4fc4663..d738adcab 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 

From 8fb8b475a9e826e5dafd0d7d8e4623b75d23364e Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 10:20:12 +0000
Subject: [PATCH 16/19] Consistently use JSDocs in `sync.ts`

---
 pr-checks/sync.ts | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 7824ef890..c205e94a7 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -137,7 +137,7 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 
-// A type representing version identifiers.
+/** A type representing version identifiers. */
 type Version =
   | "default"
   | "linked"
@@ -145,7 +145,7 @@ type Version =
   // This is an approximation, but sufficient validation for our needs here.
   | `stable-v${number}.${number}.${number}`;
 
-// The default set of CodeQL Bundle versions to use for the PR checks.
+/** The default set of CodeQL Bundle versions to use for the PR checks. */
 const defaultTestVersions = [
   // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
   "stable-v2.20.7",
@@ -324,9 +324,11 @@ const languageSetups: LanguageSetups = {
   },
 };
 
-// This is essentially an arbitrary version of `yq`, which happened to be the one that
-// `choco` fetched when we moved away from using that here.
-// See https://github.com/github/codeql-action/pull/3423
+/**
+ * This is essentially an arbitrary version of `yq`, which happened to be the one that
+ * `choco` fetched when we moved away from using that here.
+ * See https://github.com/github/codeql-action/pull/3423
+ */
 const YQ_VERSION = "v4.50.1";
 
 const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");

From 0b8f4560ec77a80d118a37596c7573e5dbd0a20b Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 10:23:02 +0000
Subject: [PATCH 17/19] Add comment for the Kotlin version

---
 .github/actions/prepare-test/action.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml
index e2a55a24e..4c11ec492 100644
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -76,4 +76,7 @@ runs:
     - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
+        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
+        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
+        # version on the `ubuntu-latest` runners and CodeQL.
         version: 2.1.20

From bcc1fbe153f97bb8a2de9b8a418983821c22a678 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 11:18:33 +0000
Subject: [PATCH 18/19] Add comment to `debug-artifacts` workflows

---
 .github/workflows/debug-artifacts-failure-safe.yml | 5 +++++
 .github/workflows/debug-artifacts-safe.yml         | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index dd4e98797..4f9082acd 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -43,7 +43,12 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
     runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 1e723a45c..610e1aab8 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -41,7 +41,12 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
     runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

From 2908c78a829e4056d419fed8aadbf64237c9023e Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 11:19:11 +0000
Subject: [PATCH 19/19] Remove Rubocop from deflake workflow

---
 .github/workflows/deflake.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml
index 158dc6c96..27024b378 100644
--- a/.github/workflows/deflake.yml
+++ b/.github/workflows/deflake.yml
@@ -60,7 +60,6 @@ on:
       - "PR Check - Proxy test"
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
       - "PR Check - Ruby analysis"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"