Set shell: bash by default on all workflows

.github/workflows/__all-platform-bundle.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   all-platform-bundle:
     strategy:
@@ -70,7 +73,6 @@ jobs:
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__analyze-ref-input.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   analyze-ref-input:
     strategy:
@@ -74,7 +77,6 @@ jobs:
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:

.github/workflows/__autobuild-action.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   autobuild-action:
     strategy:
@@ -67,7 +70,6 @@ jobs:
           CORECLR_PROFILER_PATH_64: ''
       - uses: ./../action/analyze
       - name: Check database
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d csharp ]]; then

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Java to install
         required: false
         default: '17'
+defaults:
+  run:
+    shell: bash
 jobs:
   autobuild-direct-tracing-with-working-dir:
     strategy:
@@ -70,7 +73,6 @@ jobs:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
       - name: Test setup
-        shell: bash
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
           cp -a ../action/tests/java-repo autobuild-dir
@@ -82,7 +84,6 @@ jobs:
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Check that indirect tracing is disabled
-        shell: bash
         run: |
           if [[ ! -z "${CODEQL_RUNNER}" ]]; then
             echo "Expected indirect tracing to be disabled, but the" \

.github/workflows/__autobuild-direct-tracing.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Java to install
         required: false
         default: '17'
+defaults:
+  run:
+    shell: bash
 jobs:
   autobuild-direct-tracing:
     strategy:
@@ -70,7 +73,6 @@ jobs:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
       - name: Set up Java test repo configuration
-        shell: bash
         run: |
           mv * .github ../action/tests/multi-language-repo/
           mv ../action/tests/multi-language-repo/.github/workflows .github
@@ -85,7 +87,6 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
       - name: Check that indirect tracing is disabled
-        shell: bash
         run: |
           if [[ ! -z "${CODEQL_RUNNER}" ]]; then
             echo "Expected indirect tracing to be disabled, but the" \

.github/workflows/__build-mode-autobuild.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   build-mode-autobuild:
     strategy:

.github/workflows/__build-mode-manual.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   build-mode-manual:
     strategy:
@@ -81,7 +84,6 @@ jobs:
           fi
 
       - name: Build code
-        shell: bash
         run: ./build.sh
 
       - uses: ./../action/analyze

.github/workflows/__build-mode-none.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   build-mode-none:
     strategy:

.github/workflows/__build-mode-rollback.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   build-mode-rollback:
     strategy:

.github/workflows/__bundle-toolcache.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   bundle-toolcache:
     strategy:

.github/workflows/__bundle-zstd.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   bundle-zstd:
     strategy:

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   cleanup-db-cluster-dir:
     strategy:

.github/workflows/__config-export.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   config-export:
     strategy:

.github/workflows/__config-input.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   config-input:
     strategy:

.github/workflows/__cpp-deptrace-disabled.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   cpp-deptrace-disabled:
     strategy:
@@ -53,7 +56,6 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
-        shell: bash
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
       - uses: ./../action/init
@@ -65,7 +67,6 @@ jobs:
           working-directory: autobuild-dir
         env:
           CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: false
-      - shell: bash
         run: |
           if ls /usr/bin/errno; then
             echo "C/C++ autobuild installed errno, but it should not have since auto-install dependencies is disabled."

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   cpp-deptrace-enabled-on-macos:
     strategy:
@@ -51,7 +54,6 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
-        shell: bash
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
       - uses: ./../action/init
@@ -63,7 +65,6 @@ jobs:
           working-directory: autobuild-dir
         env:
           CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-      - shell: bash
         run: |
           if ! ls /usr/bin/errno; then
             echo "As expected, CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES is a no-op on macOS"

.github/workflows/__cpp-deptrace-enabled.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   cpp-deptrace-enabled:
     strategy:
@@ -53,7 +56,6 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
-        shell: bash
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
       - uses: ./../action/init
@@ -65,7 +67,6 @@ jobs:
           working-directory: autobuild-dir
         env:
           CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-      - shell: bash
         run: |
           if ! ls /usr/bin/errno; then
             echo "Did not autoinstall errno"

.github/workflows/__diagnostics-export.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   diagnostics-export:
     strategy:
@@ -64,7 +67,6 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Add test diagnostics
-        shell: bash
         env:
           CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
         run: |

.github/workflows/__export-file-baseline-information.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   export-file-baseline-information:
     strategy:
@@ -73,7 +76,6 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -85,7 +87,6 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           expected_baseline_languages="c csharp go java kotlin javascript python ruby"

.github/workflows/__extractor-ram-threads.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   extractor-ram-threads:
     strategy:
@@ -54,7 +57,6 @@ jobs:
           ram: 230
           threads: 1
       - name: Assert Results
-        shell: bash
         run: |
           if [ "${CODEQL_RAM}" != "230" ]; then
             echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"

.github/workflows/__go-custom-queries.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-custom-queries:
     strategy:
@@ -71,7 +74,6 @@ jobs:
           config-file: ./.github/codeql/custom-queries.yml
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-indirect-tracing-workaround-diagnostic:
     strategy:
@@ -72,7 +75,6 @@ jobs:
         with:
           go-version: '1.20'
       - name: Build code
-        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
         with:

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-indirect-tracing-workaround-no-file-program:
     strategy:
@@ -73,7 +76,6 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
         with:

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-indirect-tracing-workaround:
     strategy:
@@ -68,10 +71,8 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
-      - shell: bash
         run: |
           if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then
             echo "Expected the workaround for indirect tracing of static binaries to trigger, but the" \

.github/workflows/__go-tracing-autobuilder.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-tracing-autobuilder:
     strategy:
@@ -99,7 +102,6 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/autobuild
       - uses: ./../action/analyze
-      - shell: bash
         run: |
           if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
             echo "Expected the Go autobuilder to be run, but the" \

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-tracing-custom-build-steps:
     strategy:
@@ -98,10 +101,8 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
-      - shell: bash
         run: |
           # Once we start running Bash 4.2 in all environments, we can replace the
           # `! -z` flag with the more elegant `-v` which confirms that the variable

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   go-tracing-legacy-workflow:
     strategy:
@@ -98,7 +101,6 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
-      - shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d go ]]; then

.github/workflows/__init-with-registries.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   init-with-registries:
     strategy:
@@ -78,7 +81,6 @@ jobs:
               token: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Verify packages installed
-        shell: bash
         run: |
           PRIVATE_PACK="$HOME/.codeql/packages/codeql-testing/private-pack"
           CODEQL_PACK1="$HOME/.codeql/packages/codeql-testing/codeql-pack1"
@@ -100,7 +102,6 @@ jobs:
           fi
 
       - name: Verify qlconfig.yml file was created
-        shell: bash
         run: |
           QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
           echo "Expected qlconfig.yml file to be created at $QLCONFIG_PATH"
@@ -115,7 +116,6 @@ jobs:
       - name: Verify contents of qlconfig.yml
     # yq is not available on windows
         if: runner.os != 'Windows'
-        shell: bash
         run: |
           QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
           cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'

.github/workflows/__javascript-source-root.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   javascript-source-root:
     strategy:
@@ -53,7 +56,6 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Move codeql-action
-        shell: bash
         run: |
           mkdir ../new-source-root
           mv * ../new-source-root
@@ -66,7 +68,6 @@ jobs:
         with:
           skip-queries: true
       - name: Assert database exists
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d javascript ]]; then

.github/workflows/__job-run-uuid-sarif.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   job-run-uuid-sarif:
     strategy:
@@ -63,7 +66,6 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)

.github/workflows/__language-aliases.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   language-aliases:
     strategy:

.github/workflows/__multi-language-autodetect.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   multi-language-autodetect:
     strategy:
@@ -94,7 +97,6 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Use Xcode 16
-        shell: bash
         if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"
 
@@ -107,7 +109,6 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
       - name: Build code
-        shell: bash
         run: ./build.sh
 
       - uses: ./../action/analyze
@@ -116,7 +117,6 @@ jobs:
           upload-database: false
 
       - name: Check language autodetect for all languages excluding Swift
-        shell: bash
         run: |
           CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
           if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -156,7 +156,6 @@ jobs:
 
       - name: Check language autodetect for Swift on macOS
         if: runner.os == 'macOS'
-        shell: bash
         run: |
           SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
           if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then

.github/workflows/__overlay-init-fallback.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   overlay-init-fallback:
     strategy:
@@ -61,7 +64,6 @@ jobs:
         with:
           upload-database: false
       - name: Check database
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases/actions"
           if ! grep -q 'overlayBaseDatabase: false' codeql-database.yml ; then

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   packaging-codescanning-config-inputs-js:
     strategy:
@@ -93,7 +96,6 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -109,7 +111,6 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__packaging-config-inputs-js.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   packaging-config-inputs-js:
     strategy:
@@ -93,7 +96,6 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -109,7 +111,6 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__packaging-config-js.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   packaging-config-js:
     strategy:
@@ -92,7 +95,6 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -108,7 +110,6 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__packaging-inputs-js.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   packaging-inputs-js:
     strategy:
@@ -93,7 +96,6 @@ jobs:
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -108,7 +110,6 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__quality-queries.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   quality-queries:
     strategy:

.github/workflows/__remote-config.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   remote-config:
     strategy:
@@ -72,7 +75,6 @@ jobs:
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__resolve-environment-action.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   resolve-environment-action:
     strategy:

.github/workflows/__rubocop-multi-language.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   rubocop-multi-language:
     strategy:
@@ -53,13 +56,10 @@ jobs:
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration
-        shell: bash
         run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
       - name: Install dependencies
-        shell: bash
         run: bundle install
       - name: RuboCop run
-        shell: bash
         run: |
           bash -c "
             bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif

.github/workflows/__ruby.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   ruby:
     strategy:
@@ -67,7 +70,6 @@ jobs:
         with:
           upload-database: false
       - name: Check database
-        shell: bash
         run: |
           RUBY_DB="${{ fromJson(steps.analysis.outputs.db-locations).ruby }}"
           if [[ ! -d "$RUBY_DB" ]]; then

.github/workflows/__rust.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   rust:
     strategy:
@@ -65,7 +68,6 @@ jobs:
         with:
           upload-database: false
       - name: Check database
-        shell: bash
         run: |
           RUST_DB="${{ fromJson(steps.analysis.outputs.db-locations).rust }}"
           if [[ ! -d "$RUST_DB" ]]; then

.github/workflows/__split-workflow.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   split-workflow:
     strategy:
@@ -80,7 +83,6 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -89,7 +91,6 @@ jobs:
           upload-database: false
 
       - name: Assert No Results
-        shell: bash
         run: |
           if [ "$(ls -A $RUNNER_TEMP/results)" ]; then
             echo "Expected results directory to be empty after skipping query execution!"
@@ -100,7 +101,6 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Assert Results
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__start-proxy.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   start-proxy:
     strategy:

.github/workflows/__submit-sarif-failure.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   submit-sarif-failure:
     strategy:

.github/workflows/__swift-autobuild.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   swift-autobuild:
     strategy:
@@ -55,7 +58,6 @@ jobs:
           build-mode: autobuild
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Check working directory
-        shell: bash
         run: pwd
       - uses: ./../action/autobuild
         timeout-minutes: 30
@@ -64,7 +66,6 @@ jobs:
         with:
           upload-database: false
       - name: Check database
-        shell: bash
         run: |
           SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
           if [[ ! -d "$SWIFT_DB" ]]; then

.github/workflows/__swift-custom-build.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   swift-custom-build:
     strategy:
@@ -68,7 +71,6 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Use Xcode 16
-        shell: bash
         if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"
       - uses: ./../action/init
@@ -77,17 +79,14 @@ jobs:
           languages: swift
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Check working directory
-        shell: bash
         run: pwd
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis
         with:
           upload-database: false
       - name: Check database
-        shell: bash
         run: |
           SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
           if [[ ! -d "$SWIFT_DB" ]]; then

.github/workflows/__test-autobuild-working-dir.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   test-autobuild-working-dir:
     strategy:
@@ -49,7 +52,6 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
-        shell: bash
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
           cp -a ../action/tests/java-repo autobuild-dir
@@ -64,7 +66,6 @@ jobs:
           working-directory: autobuild-dir
       - uses: ./../action/analyze
       - name: Check database
-        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d java ]]; then

.github/workflows/__test-local-codeql.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   test-local-codeql:
     strategy:
@@ -64,7 +67,6 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Fetch a CodeQL bundle
-        shell: bash
         env:
           CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
         run: |
@@ -76,7 +78,6 @@ jobs:
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ./codeql-bundle-linux64.tar.zst
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__test-proxy.yml

@@ -24,6 +24,9 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   test-proxy:
     strategy:

.github/workflows/__unset-environment.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   unset-environment:
     strategy:
@@ -73,13 +76,11 @@ jobs:
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
-        shell: bash
         run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
       - uses: ./../action/analyze
         id: analysis
         with:
           upload-database: false
-      - shell: bash
         run: |
           CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
           if [[ ! -d "$CPP_DB" ]] || [[ ! "$CPP_DB" == "${RUNNER_TEMP}/customDbLocation/cpp" ]]; then

.github/workflows/__upload-quality-sarif.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   upload-quality-sarif:
     strategy:
@@ -75,7 +78,6 @@ jobs:
             github.sha }}
           analysis-kinds: code-scanning,code-quality
       - name: Build code
-        shell: bash
         run: ./build.sh
   # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze

.github/workflows/__upload-ref-sha-input.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   upload-ref-sha-input:
     strategy:
@@ -74,7 +77,6 @@ jobs:
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
       - name: Build code
-        shell: bash
         run: ./build.sh
   # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze

.github/workflows/__with-checkout-path.yml

@@ -34,6 +34,9 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
 jobs:
   with-checkout-path:
     strategy:
@@ -68,7 +71,6 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Delete original checkout
-        shell: bash
         run: |
           # delete the original checkout so we don't accidentally use it.
           # Actions does not support deleting the current working directory, so we
@@ -89,7 +91,6 @@ jobs:
           source-root: x/y/z/some-path/tests/multi-language-repo
 
       - name: Build code
-        shell: bash
         working-directory: x/y/z/some-path/tests/multi-language-repo
         run: |
           ./build.sh
@@ -101,7 +102,6 @@ jobs:
           sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
 
       - name: Verify SARIF after upload
-        shell: bash
         run: |
           EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
           EXPECTED_REF="v1.1.0"

.github/workflows/check-expected-release-files.yml

@@ -9,6 +9,10 @@ on:
     # by other workflows.
     types: [opened, synchronize, reopened, ready_for_review]
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   check-expected-release-files:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -13,6 +13,10 @@ on:
     - cron: '30 1 * * 0'
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: bash
+
 env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 

.github/workflows/codescanning-config-cli.yml

@@ -22,6 +22,10 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   code-scanning-config-tests:
     continue-on-error: true

.github/workflows/debug-artifacts-failure-safe.yml

@@ -17,6 +17,11 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   upload-artifacts:
     strategy:
@@ -55,7 +60,6 @@ jobs:
           debug-artifact-name: my-debug-artifacts
           debug-database-name: my-db
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis
@@ -75,7 +79,6 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v5
       - name: Check expected artifacts exist
-        shell: bash
         run: |
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do

.github/workflows/debug-artifacts-safe.yml

@@ -16,6 +16,11 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   upload-artifacts:
     strategy:
@@ -54,7 +59,6 @@ jobs:
           # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
           languages: cpp,csharp,go,java,javascript,python,ruby
       - name: Build code
-        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis
@@ -69,7 +73,6 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v5
       - name: Check expected artifacts exist
-        shell: bash
         run: |
           VERSIONS="stable-v2.20.3 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"

.github/workflows/post-release-mergeback.yml

@@ -18,6 +18,10 @@ on:
     branches:
       - releases/v*
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   merge-back:
     runs-on: ubuntu-latest

.github/workflows/pr-checks.yml

@@ -8,6 +8,10 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   unit-tests:
     name: Unit Tests

.github/workflows/prepare-release.yml

@@ -22,6 +22,10 @@ on:
     paths:
       - .github/workflows/prepare-release.yml
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   prepare:
     name: "Prepare release"

.github/workflows/publish-immutable-action.yml

@@ -4,6 +4,10 @@ on:
   release:
     types: [published]
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   publish:
     runs-on: ubuntu-latest

.github/workflows/python312-windows.yml

@@ -12,6 +12,10 @@ on:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   test-setup-python-scripts:
     env:

.github/workflows/query-filters.yml

@@ -15,6 +15,10 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   query-filters:
     name: Query Filters Tests

.github/workflows/rebuild.yml

@@ -5,6 +5,10 @@ on:
     types: [labeled]
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   rebuild:
     name: Rebuild Action

.github/workflows/rollback-release.yml

@@ -14,6 +14,10 @@ on:
       - .github/workflows/rollback-release.yml
       - .github/actions/prepare-mergeback-branch/**
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   prepare:
     name: "Prepare release"
@@ -53,7 +57,6 @@ jobs:
 
       - name: Create tag for testing
         if: github.event_name != 'workflow_dispatch'
-        shell: bash
         run: git tag v0.0.0
 
       # We start by preparing the mergeback branch, mainly so that we have the updated changelog
@@ -96,7 +99,6 @@ jobs:
           echo "::endgroup::"
 
       - name: Create tags
-        shell: bash
         env:
           # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
           # but use `v0.0.0` for testing.
@@ -111,7 +113,6 @@ jobs:
       - name: Push tags
         # skip when testing
         if: github.event_name == 'workflow_dispatch'
-        shell: bash
         env:
           RELEASE_TAG: ${{ needs.prepare.outputs.version }}
           MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
@@ -160,7 +161,6 @@ jobs:
           echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY
 
       - name: Update changelog
-        shell: bash
         env:
           NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
           NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"

.github/workflows/test-codeql-bundle-all.yml

@@ -16,6 +16,9 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
+defaults:
+  run:
+    shell: bash
 jobs:
   test-codeql-bundle-all:
     strategy:
@@ -46,7 +49,6 @@ jobs:
         languages: cpp,csharp,go,java,javascript,python,ruby 
         tools: ${{ steps.prepare-test.outputs.tools-url }}
     - name: Build code
-      shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
     env:

.github/workflows/update-bundle.yml

@@ -13,6 +13,10 @@ on:
     # to filter pre-release attribute.
     types: [published]
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')

.github/workflows/update-proxy-release.yml

@@ -7,6 +7,10 @@ on:
         type: string
         required: true
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   update:
     name: Update code and create PR
@@ -20,7 +24,6 @@ jobs:
     steps:
       - name: Check release tag format
         id: checks
-        shell: bash
         run: |
           if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
@@ -30,7 +33,6 @@ jobs:
           echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
 
       - name: Check that the release exists
-        shell: bash
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         run: |
@@ -46,20 +48,17 @@ jobs:
           ref: main
 
       - name: Update git config
-        shell: bash
         run: |
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
       - name: Update release tag and version
-        shell: bash
         run: |
           NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
           sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
           sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
 
       - name: Compile TypeScript and commit changes
-        shell: bash
         env:
           TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
         run: |
@@ -72,7 +71,6 @@ jobs:
           git commit -m "Update release used by \`start-proxy\` action"
 
       - name: Push changes and open PR
-        shell: bash
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}

.github/workflows/update-release-branch.yml

@@ -11,6 +11,10 @@ on:
     branches:
       - releases/*
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
 
   prepare:

pr-checks/checks/all-platform-bundle.yml

@@ -12,6 +12,5 @@ steps:
       languages: cpp,csharp,go,java,javascript,python,ruby
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze

pr-checks/checks/analyze-ref-input.yml

@@ -9,7 +9,6 @@ steps:
       languages: cpp,csharp,java,javascript,python
       config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze
     with:

pr-checks/checks/autobuild-action.yml

@@ -17,7 +17,6 @@ steps:
       CORECLR_PROFILER_PATH_64: ""
   - uses: ./../action/analyze
   - name: Check database
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/codeql_databases"
       if [[ ! -d csharp ]]; then

pr-checks/checks/autobuild-direct-tracing-with-working-dir.yml

@@ -10,7 +10,6 @@ env:
   CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
 steps:
   - name: Test setup
-    shell: bash
     run: |
       # Make sure that Gradle build succeeds in autobuild-dir ...
       cp -a ../action/tests/java-repo autobuild-dir
@@ -22,7 +21,6 @@ steps:
       languages: java
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Check that indirect tracing is disabled
-    shell: bash
     run: |
       if [[ ! -z "${CODEQL_RUNNER}" ]]; then
         echo "Expected indirect tracing to be disabled, but the" \

pr-checks/checks/autobuild-direct-tracing.yml

@@ -7,7 +7,6 @@ env:
   CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
 steps:
   - name: Set up Java test repo configuration
-    shell: bash
     run: |
       mv * .github ../action/tests/multi-language-repo/
       mv ../action/tests/multi-language-repo/.github/workflows .github
@@ -22,7 +21,6 @@ steps:
       tools: ${{ steps.prepare-test.outputs.tools-url }}
 
   - name: Check that indirect tracing is disabled
-    shell: bash
     run: |
       if [[ ! -z "${CODEQL_RUNNER}" ]]; then
         echo "Expected indirect tracing to be disabled, but the" \

pr-checks/checks/build-mode-manual.yml

@@ -22,7 +22,6 @@ steps:
       fi
 
   - name: Build code
-    shell: bash
     run: ./build.sh
 
   - uses: ./../action/analyze

pr-checks/checks/cpp-deptrace-disabled.yml

@@ -6,7 +6,6 @@ env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:
   - name: Test setup
-    shell: bash
     run: |
       cp -a ../action/tests/cpp-autobuild autobuild-dir
   - uses: ./../action/init
@@ -18,7 +17,6 @@ steps:
       working-directory: autobuild-dir
     env:
       CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: false
-  - shell: bash
     run: |
       if ls /usr/bin/errno; then
         echo "C/C++ autobuild installed errno, but it should not have since auto-install dependencies is disabled."

pr-checks/checks/cpp-deptrace-enabled-on-macos.yml

@@ -6,7 +6,6 @@ env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:
   - name: Test setup
-    shell: bash
     run: |
       cp -a ../action/tests/cpp-autobuild autobuild-dir
   - uses: ./../action/init
@@ -18,7 +17,6 @@ steps:
       working-directory: autobuild-dir
     env:
       CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-  - shell: bash
     run: |
       if ! ls /usr/bin/errno; then
         echo "As expected, CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES is a no-op on macOS"

pr-checks/checks/cpp-deptrace-enabled.yml

@@ -6,7 +6,6 @@ env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:
   - name: Test setup
-    shell: bash
     run: |
       cp -a ../action/tests/cpp-autobuild autobuild-dir
   - uses: ./../action/init
@@ -18,7 +17,6 @@ steps:
       working-directory: autobuild-dir
     env:
       CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-  - shell: bash
     run: |
       if ! ls /usr/bin/errno; then
         echo "Did not autoinstall errno"

pr-checks/checks/diagnostics-export.yml

@@ -10,7 +10,6 @@ steps:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Add test diagnostics
-    shell: bash
     env:
       CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
     run: |

pr-checks/checks/export-file-baseline-information.yml

@@ -11,7 +11,6 @@ steps:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze
     with:
@@ -23,7 +22,6 @@ steps:
       path: "${{ runner.temp }}/results/javascript.sarif"
       retention-days: 7
   - name: Check results
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
       expected_baseline_languages="c csharp go java kotlin javascript python ruby"

pr-checks/checks/extractor-ram-threads.yml

@@ -9,7 +9,6 @@ steps:
       ram: 230
       threads: 1
   - name: Assert Results
-    shell: bash
     run: |
       if [ "${CODEQL_RAM}" != "230" ]; then
         echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"

pr-checks/checks/go-custom-queries.yml

@@ -16,6 +16,5 @@ steps:
       config-file: ./.github/codeql/custom-queries.yml
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze

pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml

@@ -16,7 +16,6 @@ steps:
     with:
       go-version: "1.20"
   - name: Build code
-    shell: bash
     run: go build main.go
   - uses: ./../action/analyze
     with:

pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml

@@ -17,7 +17,6 @@ steps:
       languages: go
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: go build main.go
   - uses: ./../action/analyze
     with:

pr-checks/checks/go-indirect-tracing-workaround.yml

@@ -12,10 +12,8 @@ steps:
       languages: go
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: go build main.go
   - uses: ./../action/analyze
-  - shell: bash
     run: |
       if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then
         echo "Expected the workaround for indirect tracing of static binaries to trigger, but the" \

pr-checks/checks/go-tracing-autobuilder.yml

@@ -12,7 +12,6 @@ steps:
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - uses: ./../action/autobuild
   - uses: ./../action/analyze
-  - shell: bash
     run: |
       if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
         echo "Expected the Go autobuilder to be run, but the" \

pr-checks/checks/go-tracing-custom-build-steps.yml

@@ -9,10 +9,8 @@ steps:
       languages: go
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: go build main.go
   - uses: ./../action/analyze
-  - shell: bash
     run: |
       # Once we start running Bash 4.2 in all environments, we can replace the
       # `! -z` flag with the more elegant `-v` which confirms that the variable

pr-checks/checks/go-tracing-legacy-workflow.yml

@@ -11,7 +11,6 @@ steps:
       languages: go
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - uses: ./../action/analyze
-  - shell: bash
     run: |
       cd "$RUNNER_TEMP/codeql_databases"
       if [[ ! -d go ]]; then

pr-checks/checks/init-with-registries.yml

@@ -29,7 +29,6 @@ steps:
             token: "${{ secrets.GITHUB_TOKEN }}"
 
   - name: Verify packages installed
-    shell: bash
     run: |
       PRIVATE_PACK="$HOME/.codeql/packages/codeql-testing/private-pack"
       CODEQL_PACK1="$HOME/.codeql/packages/codeql-testing/codeql-pack1"
@@ -51,7 +50,6 @@ steps:
       fi
 
   - name: Verify qlconfig.yml file was created
-    shell: bash
     run: |
       QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
       echo "Expected qlconfig.yml file to be created at $QLCONFIG_PATH"
@@ -66,7 +64,6 @@ steps:
   - name: Verify contents of qlconfig.yml
     # yq is not available on windows
     if: runner.os != 'Windows'
-    shell: bash
     run: |
       QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
       cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'

pr-checks/checks/javascript-source-root.yml

@@ -4,7 +4,6 @@ versions: ["linked", "default", "nightly-latest"] # This feature is not compatib
 operatingSystems: ["ubuntu"]
 steps:
   - name: Move codeql-action
-    shell: bash
     run: |
       mkdir ../new-source-root
       mv * ../new-source-root
@@ -17,7 +16,6 @@ steps:
     with:
       skip-queries: true
   - name: Assert database exists
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/codeql_databases"
       if [[ ! -d javascript ]]; then

pr-checks/checks/job-run-uuid-sarif.yml

@@ -18,7 +18,6 @@ steps:
       path: "${{ runner.temp }}/results/javascript.sarif"
       retention-days: 7
   - name: Check results
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
       actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)

pr-checks/checks/multi-language-autodetect.yml

@@ -4,7 +4,6 @@ operatingSystems: ["macos", "ubuntu"]
 installGo: true
 steps:
   - name: Use Xcode 16
-    shell: bash
     if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
     run: sudo xcode-select -s "/Applications/Xcode_16.app"
 
@@ -16,7 +15,6 @@ steps:
       tools: ${{ steps.prepare-test.outputs.tools-url }}
 
   - name: Build code
-    shell: bash
     run: ./build.sh
 
   - uses: ./../action/analyze
@@ -25,7 +23,6 @@ steps:
       upload-database: false
 
   - name: Check language autodetect for all languages excluding Swift
-    shell: bash
     run: |
       CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
       if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -65,7 +62,6 @@ steps:
 
   - name: Check language autodetect for Swift on macOS
     if: runner.os == 'macOS'
-    shell: bash
     run: |
       SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
       if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then

pr-checks/checks/overlay-init-fallback.yml

@@ -14,7 +14,6 @@ steps:
     with:
       upload-database: false
   - name: Check database
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/codeql_databases/actions"
       if ! grep -q 'overlayBaseDatabase: false' codeql-database.yml ; then

pr-checks/checks/packaging-codescanning-config-inputs-js.yml

@@ -11,7 +11,6 @@ steps:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze
     with:
@@ -26,7 +25,6 @@ steps:
       queries-not-run: foo,bar
 
   - name: Assert Results
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
       # We should have 4 hits from these rules

pr-checks/checks/packaging-config-inputs-js.yml

@@ -11,7 +11,6 @@ steps:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze
     with:
@@ -26,7 +25,6 @@ steps:
       queries-not-run: foo,bar
 
   - name: Assert Results
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
       # We should have 4 hits from these rules

pr-checks/checks/packaging-config-js.yml

@@ -10,7 +10,6 @@ steps:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze
     with:
@@ -25,7 +24,6 @@ steps:
       queries-not-run: foo,bar
 
   - name: Assert Results
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
       # We should have 4 hits from these rules

pr-checks/checks/packaging-inputs-js.yml

@@ -11,7 +11,6 @@ steps:
       packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Build code
-    shell: bash
     run: ./build.sh
   - uses: ./../action/analyze
     with:
@@ -25,7 +24,6 @@ steps:
       queries-not-run: foo,bar
 
   - name: Assert Results
-    shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
       # We should have 4 hits from these rules