Apply consistent YAML formatting

.github/ISSUE_TEMPLATE/config.yml

@@ -2,4 +2,4 @@ blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
     url: https://support.github.com/request
-    about: Contact Support 
+    about: Contact Support

.github/actions/check-codescanning-config/action.yml

@@ -1,7 +1,7 @@
 name: Check Code-Scanning Config
 description: |
-    Checks the code scanning configuration file generated by the
-    action to ensure it contains the expected contents
+  Checks the code scanning configuration file generated by the
+  action to ensure it contains the expected contents
 inputs:
   languages:
     required: false
@@ -52,7 +52,7 @@ runs:
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/codescanning-config-cli-test
       env:
-        CODEQL_ACTION_TEST_MODE: 'true'
+        CODEQL_ACTION_TEST_MODE: "true"
 
     - name: Install dependencies
       shell: bash
@@ -62,7 +62,7 @@ runs:
       working-directory: ${{ github.action_path }}
       shell: bash
       env:
-        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
+        EXPECTED_CONFIG_FILE_CONTENTS: "${{ inputs.expected-config-file-contents }}"
       run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
     - name: Clean up
       shell: bash

.github/actions/query-filter-test/action.yml

@@ -54,7 +54,7 @@ runs:
     - name: Check SARIF
       uses: ./../action/.github/actions/check-sarif
       with:
-        sarif-file:  ${{ inputs.sarif-file }}
+        sarif-file: ${{ inputs.sarif-file }}
         queries-run: ${{ inputs.queries-run}}
         queries-not-run: ${{ inputs.queries-not-run}}
     - name: Cleanup after test

.github/actions/release-branches/action.yml

@@ -1,11 +1,11 @@
-name: 'Release branches'
-description: 'Determine branches for release & backport'
+name: "Release branches"
+description: "Determine branches for release & backport"
 inputs:
   major_version:
-    description: 'The version as extracted from the package.json file'
+    description: "The version as extracted from the package.json file"
     required: true
   latest_tag:
-    description: 'The most recent tag published to the repository'
+    description: "The most recent tag published to the repository"
     required: true
 outputs:
   backport_source_branch:

.github/actions/release-initialise/action.yml

@@ -1,17 +1,16 @@
-name: 'Prepare release job'
-description: 'Prepare for updating a release branch'
+name: "Prepare release job"
+description: "Prepare for updating a release branch"
 
 runs:
   using: "composite"
   steps:
-
     - name: Dump environment
       run: env
       shell: bash
 
     - name: Dump GitHub context
       env:
-        GITHUB_CONTEXT: '${{ toJson(github) }}'
+        GITHUB_CONTEXT: "${{ toJson(github) }}"
       run: echo "$GITHUB_CONTEXT"
       shell: bash
 
@@ -19,7 +18,7 @@ runs:
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
-        cache: 'npm'
+        cache: "npm"
 
     - name: Install JavaScript dependencies
       shell: bash

.github/workflows/__all-platform-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'true'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "true"
+          setup-kotlin: "true"
       - id: init
         uses: ./../action/init
         with:

.github/workflows/__analysis-kinds.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -73,8 +73,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: javascript
@@ -82,16 +82,16 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
-          post-processed-sarif-path: '${{ runner.temp }}/post-processed'
+          post-processed-sarif-path: "${{ runner.temp }}/post-processed"
 
       - name: Upload SARIF files
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: '${{ runner.temp }}/results/*.sarif'
+          path: "${{ runner.temp }}/results/*.sarif"
           retention-days: 7
 
       - name: Upload post-processed SARIF
@@ -99,7 +99,7 @@ jobs:
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: '${{ runner.temp }}/post-processed'
+          path: "${{ runner.temp }}/post-processed"
           retention-days: 7
           if-no-files-found: error
 
@@ -107,16 +107,16 @@ jobs:
         if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
-          EXPECT_PRESENT: 'false'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          EXPECT_PRESENT: "false"
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
-          EXPECT_PRESENT: 'true'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
+          EXPECT_PRESENT: "true"
         with:
           script: ${{ env.CHECK_SCRIPT }}
     env:

.github/workflows/__analyze-ref-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -91,7 +91,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__autobuild-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -69,8 +69,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: csharp
@@ -78,12 +78,12 @@ jobs:
       - uses: ./../action/autobuild
         env:
           # Explicitly disable the CLR tracer.
-          COR_ENABLE_PROFILING: ''
-          COR_PROFILER: ''
-          COR_PROFILER_PATH_64: ''
-          CORECLR_ENABLE_PROFILING: ''
-          CORECLR_PROFILER: ''
-          CORECLR_PROFILER_PATH_64: ''
+          COR_ENABLE_PROFILING: ""
+          COR_PROFILER: ""
+          COR_PROFILER_PATH_64: ""
+          CORECLR_ENABLE_PROFILING: ""
+          CORECLR_PROFILER: ""
+          CORECLR_PROFILER_PATH_64: ""
       - uses: ./../action/analyze
       - name: Check database
         run: |

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
 defaults:
   run:
     shell: bash
@@ -72,8 +72,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__autobuild-working-dir.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__build-mode-autobuild.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -92,7 +92,7 @@ jobs:
         id: init
         with:
           build-mode: autobuild
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-manual.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,13 +80,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           build-mode: manual
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-none.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,13 +53,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-rollback.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -63,7 +63,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__bundle-from-nightly.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From nightly'
+name: "PR Check - Bundle: From nightly"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -36,7 +36,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: linked
-    name: 'Bundle: From nightly'
+    name: "Bundle: From nightly"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - id: init
         uses: ./../action/init
         env:

.github/workflows/__bundle-from-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From toolcache'
+name: "PR Check - Bundle: From toolcache"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -36,7 +36,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: toolcache
-    name: 'Bundle: From toolcache'
+    name: "Bundle: From toolcache"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -60,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Check toolcache contains CodeQL
         continue-on-error: true
         run: |

.github/workflows/__bundle-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: Caching checks'
+name: "PR Check - Bundle: Caching checks"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: linked
           - os: windows-2025
             version: linked
-    name: 'Bundle: Caching checks'
+    name: "Bundle: Caching checks"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -64,8 +64,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Add a file to the database cluster directory
         run: |
           mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
@@ -62,7 +62,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__config-export.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: javascript
@@ -62,18 +62,18 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check config properties appear in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
         with:
           script: |
             const fs = require('fs');

.github/workflows/__config-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -60,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Copy queries into workspace
         run: |
           cp -a ../action/queries .

.github/workflows/__cpp-deptrace-disabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)'
+name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    name: "C/C++: disabling autoinstalling dependencies (Linux)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)'
+name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -38,7 +38,7 @@ jobs:
             version: linked
           - os: macos-26
             version: nightly-latest
-    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    name: "C/C++: autoinstalling dependencies is skipped (macOS)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: autoinstalling dependencies (Linux)'
+name: "PR Check - C/C++: autoinstalling dependencies (Linux)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'C/C++: autoinstalling dependencies (Linux)'
+    name: "C/C++: autoinstalling dependencies (Linux)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__diagnostics-export.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -62,8 +62,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -82,18 +82,18 @@ jobs:
             --ready-for-status-page
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
 
       - name: Check diagnostics appear in SARIF
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
         run: |
           cd ../action
           npx tsx ./pr-checks/check-diagnostics.ts

.github/workflows/__diagnostics-without-db.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -67,8 +67,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Initialise failing analysis
         id: init
         uses: ./../action/init
@@ -87,11 +87,11 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
 
       - name: Check diagnostics appear on disk
         env:
-          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
+          DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
         run: |
           cd ../action
           npx tsx ./pr-checks/diagnostics-without-db.ts

.github/workflows/__export-file-baseline-information.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -100,12 +100,12 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__extractor-ram-threads.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: java

.github/workflows/__global-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'false'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "false"
       - name: Block direct internet access to force proxy usage
         run: |
           apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1

.github/workflows/__go-custom-queries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: Custom queries'
+name: "PR Check - Go: Custom queries"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -58,7 +58,7 @@ jobs:
             version: linked
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Go: Custom queries'
+    name: "Go: Custom queries"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -93,5 +93,5 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: diagnostic when Go is changed after init step'
+name: "PR Check - Go: diagnostic when Go is changed after init step"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -46,7 +46,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: default
-    name: 'Go: diagnostic when Go is changed after init step'
+    name: "Go: diagnostic when Go is changed after init step"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -75,17 +75,17 @@ jobs:
       # Deliberately change Go after the `init` step
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.20'
+          go-version: "1.20"
       - name: Build code
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: diagnostic when `file` is not installed'
+name: "PR Check - Go: diagnostic when `file` is not installed"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -46,7 +46,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: default
-    name: 'Go: diagnostic when `file` is not installed'
+    name: "Go: diagnostic when `file` is not installed"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove `file` program
         run: |
           echo $(which file)
@@ -81,12 +81,12 @@ jobs:
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: workaround for indirect tracing'
+name: "PR Check - Go: workaround for indirect tracing"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -46,7 +46,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: default
-    name: 'Go: workaround for indirect tracing'
+    name: "Go: workaround for indirect tracing"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with autobuilder step'
+name: "PR Check - Go: tracing with autobuilder step"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -66,7 +66,7 @@ jobs:
             version: nightly-latest
           - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with autobuilder step'
+    name: "Go: tracing with autobuilder step"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -106,5 +106,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with custom build steps'
+name: "PR Check - Go: tracing with custom build steps"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -66,7 +66,7 @@ jobs:
             version: nightly-latest
           - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with custom build steps'
+    name: "Go: tracing with custom build steps"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with legacy workflow'
+name: "PR Check - Go: tracing with legacy workflow"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -66,7 +66,7 @@ jobs:
             version: nightly-latest
           - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with legacy workflow'
+    name: "Go: tracing with legacy workflow"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -100,5 +100,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go.yml

@@ -19,10 +19,10 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 jobs:
   go-custom-queries:
-    name: 'Go: Custom queries'
+    name: "Go: Custom queries"
     permissions:
       contents: read
       security-events: read
@@ -31,7 +31,7 @@ jobs:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-diagnostic:
-    name: 'Go: diagnostic when Go is changed after init step'
+    name: "Go: diagnostic when Go is changed after init step"
     permissions:
       contents: read
       security-events: read
@@ -39,7 +39,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-no-file-program:
-    name: 'Go: diagnostic when `file` is not installed'
+    name: "Go: diagnostic when `file` is not installed"
     permissions:
       contents: read
       security-events: read
@@ -47,7 +47,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround:
-    name: 'Go: workaround for indirect tracing'
+    name: "Go: workaround for indirect tracing"
     permissions:
       contents: read
       security-events: read
@@ -55,7 +55,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-autobuilder:
-    name: 'Go: tracing with autobuilder step'
+    name: "Go: tracing with autobuilder step"
     permissions:
       contents: read
       security-events: read
@@ -63,7 +63,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-custom-build-steps:
-    name: 'Go: tracing with custom build steps'
+    name: "Go: tracing with custom build steps"
     permissions:
       contents: read
       security-events: read
@@ -71,7 +71,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-legacy-workflow:
-    name: 'Go: tracing with legacy workflow'
+    name: "Go: tracing with legacy workflow"
     permissions:
       contents: read
       security-events: read

.github/workflows/__init-with-registries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Download using registries'
+name: "PR Check - Packaging: Download using registries"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: linked
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Download using registries'
+    name: "Packaging: Download using registries"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,12 +55,12 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Init with registries
         uses: ./../action/init
         with:
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: ./.github/codeql/codeql-config-registries.yml
           languages: javascript

.github/workflows/__javascript-source-root.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Move codeql-action
         run: |
           mkdir ../new-source-root

.github/workflows/__job-run-uuid-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -60,12 +60,12 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__language-aliases.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,14 +51,14 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: C#,java-kotlin,typescript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: 'Check languages'
+      - name: "Check languages"
         run: |
           expected_languages="csharp,java,javascript"
           actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

.github/workflows/__linux-arm64.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: ${{ env.LANGUAGES }}

.github/workflows/__local-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst

.github/workflows/__multi-language-autodetect.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -114,8 +114,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Install Python 3.13.15 for older CLI versions
         # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
         # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
@@ -123,7 +123,7 @@ jobs:
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: '3.13.15'
+          python-version: "3.13.15"
 
       - name: Use Xcode 16
         # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
@@ -133,7 +133,7 @@ jobs:
       - uses: ./../action/init
         id: init
         with:
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__overlay-init-fallback.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: actions # Any language without overlay support will do

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config and input passed to the CLI'
+name: "PR Check - Packaging: Config and input passed to the CLI"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config and input passed to the CLI'
+    name: "Packaging: Config and input passed to the CLI"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config and input'
+name: "PR Check - Packaging: Config and input"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config and input'
+    name: "Packaging: Config and input"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config file'
+name: "PR Check - Packaging: Config file"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config file'
+    name: "Packaging: Config file"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,18 +93,18 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging.yml'
+          config-file: ".github/codeql/codeql-config-packaging.yml"
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Action input'
+name: "PR Check - Packaging: Action input"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Action input'
+    name: "Packaging: Action input"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging2.yml'
+          config-file: ".github/codeql/codeql-config-packaging2.yml"
           languages: javascript
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
 
       - name: Check results
         uses: ./../action/.github/actions/check-sarif

.github/workflows/__per-language-bundle-validation.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -95,8 +95,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action

.github/workflows/__remote-config.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__resolve-environment-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go,javascript-typescript

.github/workflows/__ruby.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -61,8 +61,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: ruby

.github/workflows/__rust.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -59,8 +59,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: rust

.github/workflows/__split-workflow.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -90,11 +90,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +103,7 @@ jobs:
       - uses: ./../action/analyze
         with:
           skip-queries: true
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Assert No Results
@@ -114,7 +114,7 @@ jobs:
           fi
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Assert Results
         run: |

.github/workflows/__start-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Setup proxy for registries
         id: proxy
         uses: ./../action/start-proxy
@@ -101,5 +101,5 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
     env:
-      CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
+      CODEQL_ACTION_PROXY_API_REQUESTS: "true"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__submit-sarif-failure.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./init
         with:
@@ -76,7 +76,7 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
     env:
       CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
       CODEQL_ACTION_UPLOAD_FAILED_SARIF: true

.github/workflows/__swift-autobuild.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__swift-custom-build.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -107,5 +107,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__unset-environment.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__unsupported-macos.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -62,8 +62,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Check xcode_select_link
         run: |
           readlink /private/var/db/xcode_select_link
@@ -86,7 +86,7 @@ jobs:
         if: false
         uses: ./analyze
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
     env:
       CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
       CODEQL_ACTION_SKIP_SARIF_UPLOAD: true

.github/workflows/__upload-ref-sha-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -92,12 +92,12 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           upload: never
       - uses: ./../action/upload-sarif
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -87,8 +87,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -99,8 +99,8 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           upload: never
           output: ${{ runner.temp }}/results
 
@@ -109,15 +109,15 @@ jobs:
         uses: ./../action/upload-sarif
         id: upload-sarif
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
-      - name: 'Fail for missing output from `upload-sarif` step for `code-scanning`'
+      - name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
-      - name: 'Fail for missing output from `upload-sarif` step for `code-quality`'
+      - name: "Fail for missing output from `upload-sarif` step for `code-quality`"
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -126,12 +126,12 @@ jobs:
         id: upload-single-sarif-code-scanning
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
-      - name: 'Fail for missing output from `upload-single-sarif-code-scanning` step'
+      - name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
         run: exit 1
       - name: Upload single SARIF file for Code Quality
@@ -139,12 +139,12 @@ jobs:
         id: upload-single-sarif-code-quality
         if: contains(matrix.analysis-kinds, 'code-quality')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
-      - name: 'Fail for missing output from `upload-single-sarif-code-quality` step'
+      - name: "Fail for missing output from `upload-single-sarif-code-quality` step"
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -156,12 +156,12 @@ jobs:
         id: upload-single-non-sarif
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
-      - name: 'Fail for missing output from `upload-single-non-sarif` step'
+      - name: "Fail for missing output from `upload-single-non-sarif` step"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
     env:

.github/workflows/__with-checkout-path.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -81,8 +81,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.

.github/workflows/codeql.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Sunday.
-    - cron: '30 1 * * 0'
+    - cron: "30 1 * * 0"
   workflow_dispatch:
 
 defaults:
@@ -32,41 +32,41 @@ jobs:
       security-events: read
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up default CodeQL bundle
-      id: setup-default
-      uses: ./setup-codeql
-    - name: Set up linked CodeQL bundle
-      id: setup-linked
-      uses: ./setup-codeql
-      with:
-        tools: linked
-    - name: Compare default and linked CodeQL bundle versions
-      id: compare
-      env:
-        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-      run: |
-        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up default CodeQL bundle
+        id: setup-default
+        uses: ./setup-codeql
+      - name: Set up linked CodeQL bundle
+        id: setup-linked
+        uses: ./setup-codeql
+        with:
+          tools: linked
+      - name: Compare default and linked CodeQL bundle versions
+        id: compare
+        env:
+          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+        run: |
+          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
 
-        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-        # required status check.
-        #
-        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-        # the same as running with `tools: null`.
-        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-          VERSIONS_JSON='[null]'
-        else
-          VERSIONS_JSON='[null, "linked"]'
-        fi
+          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+          # required status check.
+          #
+          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+          # the same as running with `tools: null`.
+          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+            VERSIONS_JSON='[null]'
+          else
+            VERSIONS_JSON='[null, "linked"]'
+          fi
 
-        # Output a JSON-encoded list with the distinct versions to test against.
-        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+          # Output a JSON-encoded list with the distinct versions to test against.
+          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
 
   analyze-javascript:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -74,7 +74,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
+        os:
+          - ubuntu-22.04
+          - ubuntu-24.04
+          - windows-2022
+          - windows-2025
+          - macos-14-xlarge
+          - macos-15-xlarge
         tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
     runs-on: ${{ matrix.os }}
 
@@ -83,26 +89,26 @@ jobs:
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      id: init
-      with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config-javascript.yml
-        tools: ${{ matrix.tools }}
-    # confirm steps.init.outputs.codeql-path points to the codeql binary
-    - name: Print CodeQL Version
-      run: >
-        "$CODEQL" version --format=json
-      env:
-        CODEQL: ${{steps.init.outputs.codeql-path}}
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        id: init
+        with:
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config-javascript.yml
+          tools: ${{ matrix.tools }}
+      # confirm steps.init.outputs.codeql-path points to the codeql binary
+      - name: Print CodeQL Version
+        run: >
+          "$CODEQL" version --format=json
+        env:
+          CODEQL: ${{steps.init.outputs.codeql-path}}
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:javascript"
+          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -119,21 +125,21 @@ jobs:
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: none
-        config: >
-          paths-ignore:
-            - lib
-            - tests
-          queries:
-            - uses: security-and-quality
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:${{ matrix.language }}"
-        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config: >
+            paths-ignore:
+              - lib
+              - tests
+            queries:
+              - uses: security-and-quality
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}

.github/workflows/codescanning-config-cli.yml

@@ -10,13 +10,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -41,187 +41,187 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-26.04
-          version: linked
-        - os: ubuntu-26.04
-          version: default
-        - os: ubuntu-26.04
-          version: nightly-latest
+          - os: ubuntu-26.04
+            version: linked
+          - os: ubuntu-26.04
+            version: default
+          - os: ubuntu-26.04
+            version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
     name: Code Scanning Configuration tests
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Set up Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-      with:
-        node-version: 24
-        cache: 'npm'
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: "npm"
 
-    - name: Install dependencies
-      run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
 
-    - name: Empty file
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: "{}"
-        # Request multiple languages so later checks can reuse the combined bundle.
-        languages: javascript,python
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Empty file
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: "{}"
+          # Request multiple languages so later checks can reuse the combined bundle.
+          languages: javascript,python
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Packs from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+      - name: Packs from input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
             }
-          }
-        languages: javascript
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: javascript
+          packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Queries and packs from config overriden by input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql/javascript-queries"]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Packs from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+            }
+          languages: javascript
+          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Queries and packs from config merging with input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Queries from input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+            }
+          languages: javascript
+          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Multi-language packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-              "ruby": ["codeql/ruby-queries"]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript,ruby
-        config-file-test: .github/codeql/multi-language-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Queries from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Other config properties
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "name": "Config using all properties",
-            "packs": ["codeql/javascript-queries" ],
-            "disable-default-queries": true,
-            "paths-ignore": ["xxx"],
-            "paths": ["yyy"]
-          }
-        languages: javascript
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/other-config-properties.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Queries and packs from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+              }
+            }
+          languages: javascript
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config overriden by input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+              "packs": ["codeql/javascript-queries"]
+            }
+          languages: javascript
+          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: codeql/javascript-queries
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config merging with input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
+              },
+              "queries": [
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+              ]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: + codeql/javascript-queries
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Multi-language packs from config
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
+                "ruby": ["codeql/ruby-queries"]
+              },
+              "queries": [
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+              ]
+            }
+          languages: javascript,ruby
+          config-file-test: .github/codeql/multi-language-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Other config properties
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "name": "Config using all properties",
+              "packs": ["codeql/javascript-queries" ],
+              "disable-default-queries": true,
+              "paths-ignore": ["xxx"],
+              "paths": ["yyy"]
+            }
+          languages: javascript
+          packs: + codeql/javascript-queries
+          config-file-test: .github/codeql/other-config-properties.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/publish-immutable-action.yml

@@ -1,10 +1,10 @@
-name: 'Publish Immutable Action Version'
+name: "Publish Immutable Action Version"
 
 on:
   push:
     tags:
       # Match version tags, but not the major version tags.
-      - 'v[0-9]+.**'
+      - "v[0-9]+.**"
 
 defaults:
   run:

.github/workflows/python312-windows.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Monday.
-    - cron: '0 0 * * 1'
+    - cron: "0 0 * * 1"
   workflow_dispatch:
 
 concurrency:
@@ -32,22 +32,22 @@ jobs:
     runs-on: windows-2025
 
     steps:
-    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
-      with:
-        python-version: 3.12
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: 3.12
 
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Prepare test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: default
+      - name: Prepare test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: default
 
-    - name: Initialize CodeQL
-      uses: ./../action/init
-      with:
-        tools: linked
-        languages: python
+      - name: Initialize CodeQL
+        uses: ./../action/init
+        with:
+          tools: linked
+          languages: python
 
-    - name: Analyze
-      uses: ./../action/analyze
+      - name: Analyze
+        uses: ./../action/analyze

.github/workflows/query-filters.yml

@@ -3,13 +3,13 @@ name: Query filters tests
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -29,47 +29,47 @@ jobs:
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Install Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-      with:
-        node-version: 24
-        cache: npm
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: npm
 
-    - name: Install dependencies
-      run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: linked
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: linked
 
-    - name: Check SARIF for default queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters1.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for default queries with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip
+          queries-not-run: js/path-injection
+          config-file: ./.github/codeql/codeql-config-query-filters1.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Check SARIF for query packs with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters2.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for query packs with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip,javascript/example/empty-or-one-block
+          queries-not-run: js/path-injection
+          config-file: ./.github/codeql/codeql-config-query-filters2.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Check SARIF for query packs and local queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-        config-file: ./.github/codeql/codeql-config-query-filters3.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for query packs and local queries with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
+          queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
+          config-file: ./.github/codeql/codeql-config-query-filters3.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/test-codeql-bundle-all.yml

@@ -1,17 +1,17 @@
-name: 'PR Check - CodeQL Bundle All'
+name: "PR Check - CodeQL Bundle All"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -27,9 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-26.04
-          version: nightly-latest
-    name: 'CodeQL Bundle All'
+          - os: ubuntu-26.04
+            version: nightly-latest
+    name: "CodeQL Bundle All"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -37,26 +37,26 @@ jobs:
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-        use-all-platform-bundle: true
-    - name: Install .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '9.x'
-    - id: init
-      uses: ./../action/init
-      with:
-        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - name: Build code
-      run: ./build.sh
-    - uses: ./../action/analyze
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: true
+      - name: Install .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "9.x"
+      - id: init
+        uses: ./../action/init
+        with:
+          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
+          languages: cpp,csharp,go,java,javascript,python,ruby
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Build code
+        run: ./build.sh
+      - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/update-bundle.yml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "$GITHUB_CONTEXT"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -44,7 +44,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/update-release-branch.yml

@@ -38,43 +38,43 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-    - uses: ./.github/actions/release-initialise
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+      - uses: ./.github/actions/release-initialise
 
-    # when the workflow has been manually triggered on main,
-    # we know that we definitely want the release branch to exist
-    - name: Ensure release branch exists
-      run: |
-        echo "MAJOR_VERSION ${MAJOR_VERSION}"
-        RELEASE_BRANCH=releases/${MAJOR_VERSION}
-        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-            echo "Branch $RELEASE_BRANCH already exists"
-            echo ""
-        else
-            echo "Creating $RELEASE_BRANCH branch"
-            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-            git push --set-upstream origin ${RELEASE_BRANCH}
-            git branch --show-current
-            echo ""
-        fi
-        echo "Returning to branch: ${REF_NAME}"
-        git checkout ${REF_NAME}
+      # when the workflow has been manually triggered on main,
+      # we know that we definitely want the release branch to exist
+      - name: Ensure release branch exists
+        run: |
+          echo "MAJOR_VERSION ${MAJOR_VERSION}"
+          RELEASE_BRANCH=releases/${MAJOR_VERSION}
+          if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
+              echo "Branch $RELEASE_BRANCH already exists"
+              echo ""
+          else
+              echo "Creating $RELEASE_BRANCH branch"
+              git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
+              git push --set-upstream origin ${RELEASE_BRANCH}
+              git branch --show-current
+              echo ""
+          fi
+          echo "Returning to branch: ${REF_NAME}"
+          git checkout ${REF_NAME}
 
-    - name: Update current release branch
-      if: github.event_name == 'workflow_dispatch'
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${REF_NAME}
-        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch '${{ env.REF_NAME }}' \
-          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-          --is-primary-release \
-          --conductor ${GITHUB_ACTOR}
+      - name: Update current release branch
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo SOURCE_BRANCH=${REF_NAME}
+          echo TARGET_BRANCH=releases/${MAJOR_VERSION}
+          npx tsx ./pr-checks/update-release-branch.ts \
+            --repository-nwo ${{ github.repository }} \
+            --source-branch '${{ env.REF_NAME }}' \
+            --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
+            --is-primary-release \
+            --conductor ${GITHUB_ACTOR}
 
   backport:
     name: "Create backport"
@@ -94,28 +94,28 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - name: Generate token
-      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-      id: app-token
-      with:
-        app-id: ${{ vars.AUTOMATION_APP_ID }}
-        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+      - name: Generate token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        id: app-token
+        with:
+          app-id: ${{ vars.AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-        token: ${{ steps.app-token.outputs.token }}
-    - uses: ./.github/actions/release-initialise
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+          token: ${{ steps.app-token.outputs.token }}
+      - uses: ./.github/actions/release-initialise
 
-    - name: Update older release branch
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${SOURCE_BRANCH}
-        echo TARGET_BRANCH=${TARGET_BRANCH}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch ${SOURCE_BRANCH} \
-          --target-branch ${TARGET_BRANCH} \
-          --conductor ${GITHUB_ACTOR}
+      - name: Update older release branch
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo SOURCE_BRANCH=${SOURCE_BRANCH}
+          echo TARGET_BRANCH=${TARGET_BRANCH}
+          npx tsx ./pr-checks/update-release-branch.ts \
+            --repository-nwo ${{ github.repository }} \
+            --source-branch ${SOURCE_BRANCH} \
+            --target-branch ${TARGET_BRANCH} \
+            --conductor ${GITHUB_ACTOR}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci