Merge remote-tracking branch 'origin/main' into mbg/analysis-kinds/warn-on-multiple

lib/upload-lib.js

@@ -203,7 +203,7 @@ var require_file_command = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.issueFileCommand = issueFileCommand;
     exports2.prepareKeyValueMessage = prepareKeyValueMessage;
-    var crypto2 = __importStar2(require("crypto"));
+    var crypto3 = __importStar2(require("crypto"));
     var fs14 = __importStar2(require("fs"));
     var os2 = __importStar2(require("os"));
     var utils_1 = require_utils();
@@ -220,7 +220,7 @@ var require_file_command = __commonJS({
       });
     }
     function prepareKeyValueMessage(key, value) {
-      const delimiter = `ghadelimiter_${crypto2.randomUUID()}`;
+      const delimiter = `ghadelimiter_${crypto3.randomUUID()}`;
       const convertedValue = (0, utils_1.toCommandValue)(value);
       if (key.includes(delimiter)) {
         throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`);
@@ -4287,11 +4287,11 @@ var require_util2 = __commonJS({
     var { isUint8Array } = require("node:util/types");
     var { webidl } = require_webidl();
     var supportedHashes = [];
-    var crypto2;
+    var crypto3;
     try {
-      crypto2 = require("node:crypto");
+      crypto3 = require("node:crypto");
       const possibleRelevantHashes = ["sha256", "sha384", "sha512"];
-      supportedHashes = crypto2.getHashes().filter((hash2) => possibleRelevantHashes.includes(hash2));
+      supportedHashes = crypto3.getHashes().filter((hash2) => possibleRelevantHashes.includes(hash2));
     } catch {
     }
     function responseURL(response) {
@@ -4564,7 +4564,7 @@ var require_util2 = __commonJS({
       }
     }
     function bytesMatch(bytes, metadataList) {
-      if (crypto2 === void 0) {
+      if (crypto3 === void 0) {
         return true;
       }
       const parsedMetadata = parseMetadata(metadataList);
@@ -4579,7 +4579,7 @@ var require_util2 = __commonJS({
       for (const item of metadata) {
         const algorithm = item.algo;
         const expectedValue = item.hash;
-        let actualValue = crypto2.createHash(algorithm).update(bytes).digest("base64");
+        let actualValue = crypto3.createHash(algorithm).update(bytes).digest("base64");
         if (actualValue[actualValue.length - 1] === "=") {
           if (actualValue[actualValue.length - 2] === "=") {
             actualValue = actualValue.slice(0, -2);
@@ -5643,8 +5643,8 @@ var require_body = __commonJS({
     var { multipartFormDataParser } = require_formdata_parser();
     var random;
     try {
-      const crypto2 = require("node:crypto");
-      random = (max) => crypto2.randomInt(0, max);
+      const crypto3 = require("node:crypto");
+      random = (max) => crypto3.randomInt(0, max);
     } catch {
       random = (max) => Math.floor(Math.random(max));
     }
@@ -17052,13 +17052,13 @@ var require_frame = __commonJS({
     "use strict";
     var { maxUnsigned16Bit } = require_constants5();
     var BUFFER_SIZE = 16386;
-    var crypto2;
+    var crypto3;
     var buffer = null;
     var bufIdx = BUFFER_SIZE;
     try {
-      crypto2 = require("node:crypto");
+      crypto3 = require("node:crypto");
     } catch {
-      crypto2 = {
+      crypto3 = {
         // not full compatibility, but minimum.
         randomFillSync: function randomFillSync(buffer2, _offset, _size) {
           for (let i = 0; i < buffer2.length; ++i) {
@@ -17071,7 +17071,7 @@ var require_frame = __commonJS({
     function generateMask() {
       if (bufIdx === BUFFER_SIZE) {
         bufIdx = 0;
-        crypto2.randomFillSync(buffer ??= Buffer.allocUnsafe(BUFFER_SIZE), 0, BUFFER_SIZE);
+        crypto3.randomFillSync(buffer ??= Buffer.allocUnsafe(BUFFER_SIZE), 0, BUFFER_SIZE);
       }
       return [buffer[bufIdx++], buffer[bufIdx++], buffer[bufIdx++], buffer[bufIdx++]];
     }
@@ -17143,9 +17143,9 @@ var require_connection = __commonJS({
     var { Headers, getHeadersList } = require_headers();
     var { getDecodeSplit } = require_util2();
     var { WebsocketFrameSend } = require_frame();
-    var crypto2;
+    var crypto3;
     try {
-      crypto2 = require("node:crypto");
+      crypto3 = require("node:crypto");
     } catch {
     }
     function establishWebSocketConnection(url2, protocols, client, ws, onEstablish, options) {
@@ -17165,7 +17165,7 @@ var require_connection = __commonJS({
         const headersList = getHeadersList(new Headers(options.headers));
         request2.headersList = headersList;
       }
-      const keyValue = crypto2.randomBytes(16).toString("base64");
+      const keyValue = crypto3.randomBytes(16).toString("base64");
       request2.headersList.append("sec-websocket-key", keyValue);
       request2.headersList.append("sec-websocket-version", "13");
       for (const protocol of protocols) {
@@ -17195,7 +17195,7 @@ var require_connection = __commonJS({
             return;
           }
           const secWSAccept = response.headersList.get("Sec-WebSocket-Accept");
-          const digest = crypto2.createHash("sha1").update(keyValue + uid).digest("base64");
+          const digest = crypto3.createHash("sha1").update(keyValue + uid).digest("base64");
           if (secWSAccept !== digest) {
             failWebsocketConnection(ws, "Incorrect hash received in Sec-WebSocket-Accept header.");
             return;
@@ -21993,16 +21993,16 @@ var require_attribute = __commonJS({
       var result = new ValidatorResult(instance, schema2, options, ctx);
       var self2 = this;
       schema2.allOf.forEach(function(v, i) {
-        var valid3 = self2.validateSchema(instance, v, options, ctx);
-        if (!valid3.valid) {
+        var valid4 = self2.validateSchema(instance, v, options, ctx);
+        if (!valid4.valid) {
           var id = v.$id || v.id;
           var msg = id || v.title && JSON.stringify(v.title) || v["$ref"] && "<" + v["$ref"] + ">" || "[subschema " + i + "]";
           result.addError({
             name: "allOf",
-            argument: { id: msg, length: valid3.errors.length, valid: valid3 },
-            message: "does not match allOf schema " + msg + " with " + valid3.errors.length + " error[s]:"
+            argument: { id: msg, length: valid4.errors.length, valid: valid4 },
+            message: "does not match allOf schema " + msg + " with " + valid4.errors.length + " error[s]:"
           });
-          result.importErrors(valid3);
+          result.importErrors(valid4);
         }
       });
       return result;
@@ -22291,8 +22291,8 @@ var require_attribute = __commonJS({
       if (typeof schema2.exclusiveMinimum === "boolean") return;
       if (!this.types.number(instance)) return;
       var result = new ValidatorResult(instance, schema2, options, ctx);
-      var valid3 = instance > schema2.exclusiveMinimum;
-      if (!valid3) {
+      var valid4 = instance > schema2.exclusiveMinimum;
+      if (!valid4) {
         result.addError({
           name: "exclusiveMinimum",
           argument: schema2.exclusiveMinimum,
@@ -22305,8 +22305,8 @@ var require_attribute = __commonJS({
       if (typeof schema2.exclusiveMaximum === "boolean") return;
       if (!this.types.number(instance)) return;
       var result = new ValidatorResult(instance, schema2, options, ctx);
-      var valid3 = instance < schema2.exclusiveMaximum;
-      if (!valid3) {
+      var valid4 = instance < schema2.exclusiveMaximum;
+      if (!valid4) {
         result.addError({
           name: "exclusiveMaximum",
           argument: schema2.exclusiveMaximum,
@@ -27657,11 +27657,11 @@ var require_valid = __commonJS({
   "node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
     var parse2 = require_parse2();
-    var valid3 = (version, options) => {
+    var valid4 = (version, options) => {
       const v = parse2(version, options);
       return v ? v.version : null;
     };
-    module2.exports = valid3;
+    module2.exports = valid4;
   }
 });
 
@@ -27804,8 +27804,8 @@ var require_rcompare = __commonJS({
   "node_modules/semver/functions/rcompare.js"(exports2, module2) {
     "use strict";
     var compare3 = require_compare();
-    var rcompare = (a, b, loose) => compare3(b, a, loose);
-    module2.exports = rcompare;
+    var rcompare3 = (a, b, loose) => compare3(b, a, loose);
+    module2.exports = rcompare3;
   }
 });
 
@@ -29021,7 +29021,7 @@ var require_semver2 = __commonJS({
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse2 = require_parse2();
-    var valid3 = require_valid();
+    var valid4 = require_valid();
     var clean3 = require_clean();
     var inc = require_inc();
     var diff = require_diff();
@@ -29030,7 +29030,7 @@ var require_semver2 = __commonJS({
     var patch = require_patch();
     var prerelease = require_prerelease();
     var compare3 = require_compare();
-    var rcompare = require_rcompare();
+    var rcompare3 = require_rcompare();
     var compareLoose = require_compare_loose();
     var compareBuild = require_compare_build();
     var sort = require_sort();
@@ -29059,7 +29059,7 @@ var require_semver2 = __commonJS({
     var subset = require_subset();
     module2.exports = {
       parse: parse2,
-      valid: valid3,
+      valid: valid4,
       clean: clean3,
       inc,
       diff,
@@ -29068,7 +29068,7 @@ var require_semver2 = __commonJS({
       patch,
       prerelease,
       compare: compare3,
-      rcompare,
+      rcompare: rcompare3,
       compareLoose,
       compareBuild,
       sort,
@@ -32371,7 +32371,7 @@ var require_internal_hash_files = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.hashFiles = hashFiles;
-    var crypto2 = __importStar2(require("crypto"));
+    var crypto3 = __importStar2(require("crypto"));
     var core14 = __importStar2(require_core());
     var fs14 = __importStar2(require("fs"));
     var stream2 = __importStar2(require("stream"));
@@ -32384,7 +32384,7 @@ var require_internal_hash_files = __commonJS({
         const writeDelegate = verbose ? core14.info : core14.debug;
         let hasMatch = false;
         const githubWorkspace = currentWorkspace ? currentWorkspace : (_d = process.env["GITHUB_WORKSPACE"]) !== null && _d !== void 0 ? _d : process.cwd();
-        const result = crypto2.createHash("sha256");
+        const result = crypto3.createHash("sha256");
         let count = 0;
         try {
           for (var _e = true, _f = __asyncValues2(globber.globGenerator()), _g; _g = yield _f.next(), _a = _g.done, !_a; _e = true) {
@@ -32400,7 +32400,7 @@ var require_internal_hash_files = __commonJS({
               writeDelegate(`Skip directory '${file}'.`);
               continue;
             }
-            const hash2 = crypto2.createHash("sha256");
+            const hash2 = crypto3.createHash("sha256");
             const pipeline = util.promisify(stream2.pipeline);
             yield pipeline(fs14.createReadStream(file), hash2);
             result.write(hash2.digest());
@@ -32649,8 +32649,8 @@ var require_semver3 = __commonJS({
         return null;
       }
     }
-    exports2.valid = valid3;
-    function valid3(version, options) {
+    exports2.valid = valid4;
+    function valid4(version, options) {
       var v = parse2(version, options);
       return v ? v.version : null;
     }
@@ -32950,8 +32950,8 @@ var require_semver3 = __commonJS({
       var versionB = new SemVer(b, loose);
       return versionA.compare(versionB) || versionA.compareBuild(versionB);
     }
-    exports2.rcompare = rcompare;
-    function rcompare(a, b, loose) {
+    exports2.rcompare = rcompare3;
+    function rcompare3(a, b, loose) {
       return compare3(b, a, loose);
     }
     exports2.sort = sort;
@@ -33776,10 +33776,10 @@ var require_cacheUtils = __commonJS({
     var exec = __importStar2(require_exec());
     var glob = __importStar2(require_glob());
     var io6 = __importStar2(require_io());
-    var crypto2 = __importStar2(require("crypto"));
+    var crypto3 = __importStar2(require("crypto"));
     var fs14 = __importStar2(require("fs"));
     var path12 = __importStar2(require("path"));
-    var semver9 = __importStar2(require_semver3());
+    var semver10 = __importStar2(require_semver3());
     var util = __importStar2(require("util"));
     var constants_1 = require_constants7();
     var versionSalt = "1.0";
@@ -33800,7 +33800,7 @@ var require_cacheUtils = __commonJS({
           }
           tempDirectory = path12.join(baseLocation, "actions", "temp");
         }
-        const dest = path12.join(tempDirectory, crypto2.randomUUID());
+        const dest = path12.join(tempDirectory, crypto3.randomUUID());
         yield io6.mkdirP(dest);
         return dest;
       });
@@ -33872,7 +33872,7 @@ var require_cacheUtils = __commonJS({
     function getCompressionMethod() {
       return __awaiter2(this, void 0, void 0, function* () {
         const versionOutput = yield getVersion("zstd", ["--quiet"]);
-        const version = semver9.clean(versionOutput);
+        const version = semver10.clean(versionOutput);
         core14.debug(`zstd version: ${version}`);
         if (versionOutput === "") {
           return constants_1.CompressionMethod.Gzip;
@@ -33908,7 +33908,7 @@ var require_cacheUtils = __commonJS({
         components.push("windows-only");
       }
       components.push(versionSalt);
-      return crypto2.createHash("sha256").update(components.join("|")).digest("hex");
+      return crypto3.createHash("sha256").update(components.join("|")).digest("hex");
     }
     function getRuntimeToken() {
       const token = process.env["ACTIONS_RUNTIME_TOKEN"];
@@ -75278,7 +75278,7 @@ var require_cacheHttpClient = __commonJS({
     exports2.getCacheEntry = getCacheEntry;
     exports2.downloadCache = downloadCache;
     exports2.reserveCache = reserveCache;
-    exports2.saveCache = saveCache3;
+    exports2.saveCache = saveCache4;
     var core14 = __importStar2(require_core());
     var http_client_1 = require_lib();
     var auth_1 = require_auth();
@@ -75455,7 +75455,7 @@ Other caches with similar key:`);
         }));
       });
     }
-    function saveCache3(cacheId, archivePath, signedUploadURL, options) {
+    function saveCache4(cacheId, archivePath, signedUploadURL, options) {
       return __awaiter2(this, void 0, void 0, function* () {
         const uploadOptions = (0, options_1.getUploadOptions)(options);
         if (uploadOptions.useAzureSdk) {
@@ -80955,8 +80955,8 @@ var require_cache4 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     exports2.isFeatureAvailable = isFeatureAvailable;
-    exports2.restoreCache = restoreCache3;
-    exports2.saveCache = saveCache3;
+    exports2.restoreCache = restoreCache4;
+    exports2.saveCache = saveCache4;
     var core14 = __importStar2(require_core());
     var path12 = __importStar2(require("path"));
     var utils = __importStar2(require_cacheUtils());
@@ -81013,7 +81013,7 @@ var require_cache4 = __commonJS({
           return !!process.env["ACTIONS_CACHE_URL"];
       }
     }
-    function restoreCache3(paths_1, primaryKey_1, restoreKeys_1, options_1) {
+    function restoreCache4(paths_1, primaryKey_1, restoreKeys_1, options_1) {
       return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
         const cacheServiceVersion = (0, config_1.getCacheServiceVersion)();
         core14.debug(`Cache service version: ${cacheServiceVersion}`);
@@ -81157,7 +81157,7 @@ var require_cache4 = __commonJS({
         return void 0;
       });
     }
-    function saveCache3(paths_1, key_1, options_1) {
+    function saveCache4(paths_1, key_1, options_1) {
       return __awaiter2(this, arguments, void 0, function* (paths, key, options, enableCrossOsArchive = false) {
         const cacheServiceVersion = (0, config_1.getCacheServiceVersion)();
         core14.debug(`Cache service version: ${cacheServiceVersion}`);
@@ -81394,7 +81394,7 @@ var require_manifest = __commonJS({
     exports2._findMatch = _findMatch;
     exports2._getOsVersion = _getOsVersion;
     exports2._readLinuxVersionFile = _readLinuxVersionFile;
-    var semver9 = __importStar2(require_semver2());
+    var semver10 = __importStar2(require_semver2());
     var core_1 = require_core();
     var os2 = require("os");
     var cp = require("child_process");
@@ -81408,7 +81408,7 @@ var require_manifest = __commonJS({
         for (const candidate of candidates) {
           const version = candidate.version;
           (0, core_1.debug)(`check ${version} satisfies ${versionSpec}`);
-          if (semver9.satisfies(version, versionSpec) && (!stable || candidate.stable === stable)) {
+          if (semver10.satisfies(version, versionSpec) && (!stable || candidate.stable === stable)) {
             file = candidate.files.find((item) => {
               (0, core_1.debug)(`${item.arch}===${archFilter} && ${item.platform}===${platFilter}`);
               let chk = item.arch === archFilter && item.platform === platFilter;
@@ -81417,7 +81417,7 @@ var require_manifest = __commonJS({
                 if (osVersion === item.platform_version) {
                   chk = true;
                 } else {
-                  chk = semver9.satisfies(osVersion, item.platform_version);
+                  chk = semver10.satisfies(osVersion, item.platform_version);
                 }
               }
               return chk;
@@ -81671,13 +81671,13 @@ var require_tool_cache = __commonJS({
     exports2.evaluateVersions = evaluateVersions;
     var core14 = __importStar2(require_core());
     var io6 = __importStar2(require_io());
-    var crypto2 = __importStar2(require("crypto"));
+    var crypto3 = __importStar2(require("crypto"));
     var fs14 = __importStar2(require("fs"));
     var mm = __importStar2(require_manifest());
     var os2 = __importStar2(require("os"));
     var path12 = __importStar2(require("path"));
     var httpm = __importStar2(require_lib());
-    var semver9 = __importStar2(require_semver2());
+    var semver10 = __importStar2(require_semver2());
     var stream2 = __importStar2(require("stream"));
     var util = __importStar2(require("util"));
     var assert_1 = require("assert");
@@ -81696,7 +81696,7 @@ var require_tool_cache = __commonJS({
     var userAgent2 = "actions/tool-cache";
     function downloadTool2(url2, dest, auth2, headers) {
       return __awaiter2(this, void 0, void 0, function* () {
-        dest = dest || path12.join(_getTempDirectory(), crypto2.randomUUID());
+        dest = dest || path12.join(_getTempDirectory(), crypto3.randomUUID());
         yield io6.mkdirP(path12.dirname(dest));
         core14.debug(`Downloading ${url2}`);
         core14.debug(`Destination ${dest}`);
@@ -81950,7 +81950,7 @@ var require_tool_cache = __commonJS({
     }
     function cacheDir(sourceDir, tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        version = semver9.clean(version) || version;
+        version = semver10.clean(version) || version;
         arch2 = arch2 || os2.arch();
         core14.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core14.debug(`source dir: ${sourceDir}`);
@@ -81968,7 +81968,7 @@ var require_tool_cache = __commonJS({
     }
     function cacheFile(sourceFile, targetFile, tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        version = semver9.clean(version) || version;
+        version = semver10.clean(version) || version;
         arch2 = arch2 || os2.arch();
         core14.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core14.debug(`source file: ${sourceFile}`);
@@ -81998,7 +81998,7 @@ var require_tool_cache = __commonJS({
       }
       let toolPath = "";
       if (versionSpec) {
-        versionSpec = semver9.clean(versionSpec) || "";
+        versionSpec = semver10.clean(versionSpec) || "";
         const cachePath = path12.join(_getCacheDirectory(), toolName, versionSpec, arch2);
         core14.debug(`checking cache: ${cachePath}`);
         if (fs14.existsSync(cachePath) && fs14.existsSync(`${cachePath}.complete`)) {
@@ -82070,7 +82070,7 @@ var require_tool_cache = __commonJS({
     function _createExtractFolder(dest) {
       return __awaiter2(this, void 0, void 0, function* () {
         if (!dest) {
-          dest = path12.join(_getTempDirectory(), crypto2.randomUUID());
+          dest = path12.join(_getTempDirectory(), crypto3.randomUUID());
         }
         yield io6.mkdirP(dest);
         return dest;
@@ -82078,7 +82078,7 @@ var require_tool_cache = __commonJS({
     }
     function _createToolPath(tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const folderPath = path12.join(_getCacheDirectory(), tool, semver9.clean(version) || version, arch2 || "");
+        const folderPath = path12.join(_getCacheDirectory(), tool, semver10.clean(version) || version, arch2 || "");
         core14.debug(`destination ${folderPath}`);
         const markerPath = `${folderPath}.complete`;
         yield io6.rmRF(folderPath);
@@ -82088,30 +82088,30 @@ var require_tool_cache = __commonJS({
       });
     }
     function _completeToolPath(tool, version, arch2) {
-      const folderPath = path12.join(_getCacheDirectory(), tool, semver9.clean(version) || version, arch2 || "");
+      const folderPath = path12.join(_getCacheDirectory(), tool, semver10.clean(version) || version, arch2 || "");
       const markerPath = `${folderPath}.complete`;
       fs14.writeFileSync(markerPath, "");
       core14.debug("finished caching tool");
     }
     function isExplicitVersion(versionSpec) {
-      const c = semver9.clean(versionSpec) || "";
+      const c = semver10.clean(versionSpec) || "";
       core14.debug(`isExplicit: ${c}`);
-      const valid3 = semver9.valid(c) != null;
-      core14.debug(`explicit? ${valid3}`);
-      return valid3;
+      const valid4 = semver10.valid(c) != null;
+      core14.debug(`explicit? ${valid4}`);
+      return valid4;
     }
     function evaluateVersions(versions, versionSpec) {
       let version = "";
       core14.debug(`evaluating ${versions.length} versions`);
       versions = versions.sort((a, b) => {
-        if (semver9.gt(a, b)) {
+        if (semver10.gt(a, b)) {
           return 1;
         }
         return -1;
       });
       for (let i = versions.length - 1; i >= 0; i--) {
         const potential = versions[i];
-        const satisfied = semver9.satisfies(potential, versionSpec);
+        const satisfied = semver10.satisfies(potential, versionSpec);
         if (satisfied) {
           version = potential;
           break;
@@ -88630,6 +88630,32 @@ async function runTool(cmd, args = [], opts = {}) {
   }
   return stdout;
 }
+function getPullRequestBranches() {
+  const pullRequest = github.context.payload.pull_request;
+  if (pullRequest) {
+    return {
+      base: pullRequest.base.ref,
+      // We use the head label instead of the head ref here, because the head
+      // ref lacks owner information and by itself does not uniquely identify
+      // the head branch (which may be in a forked repository).
+      head: pullRequest.head.label
+    };
+  }
+  const codeScanningRef = process.env.CODE_SCANNING_REF;
+  const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
+  if (codeScanningRef && codeScanningBaseBranch) {
+    return {
+      base: codeScanningBaseBranch,
+      // PR analysis under Default Setup analyzes the PR head commit instead of
+      // the merge commit, so we can use the provided ref directly.
+      head: codeScanningRef
+    };
+  }
+  return void 0;
+}
+function isAnalyzingPullRequest() {
+  return getPullRequestBranches() !== void 0;
+}
 var qualityCategoryMapping = {
   "c#": "csharp",
   cpp: "c-cpp",
@@ -88856,6 +88882,11 @@ async function getAnalysisKey() {
   core5.exportVariable("CODEQL_ACTION_ANALYSIS_KEY" /* ANALYSIS_KEY */, analysisKey);
   return analysisKey;
 }
+async function getAutomationID() {
+  const analysis_key = await getAnalysisKey();
+  const environment = getRequiredInput("matrix");
+  return computeAutomationID(analysis_key, environment);
+}
 function computeAutomationID(analysis_key, environment) {
   let automationID = `${analysis_key}/`;
   const matrix = parseMatrixInput(environment);
@@ -88870,6 +88901,18 @@ function computeAutomationID(analysis_key, environment) {
   }
   return automationID;
 }
+async function listActionsCaches(keyPrefix, ref) {
+  const repositoryNwo = getRepositoryNwo();
+  return await getApiClient().paginate(
+    "GET /repos/{owner}/{repo}/actions/caches",
+    {
+      owner: repositoryNwo.owner,
+      repo: repositoryNwo.repo,
+      key: keyPrefix,
+      ref
+    }
+  );
+}
 function isEnablementError(msg) {
   return [
     /Code Security must be enabled/i,
@@ -89413,6 +89456,16 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
     minimumVersion: void 0
   },
+  ["overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
+    minimumVersion: void 0
+  },
+  ["overlay_analysis_match_codeql_version_dry_run" /* OverlayAnalysisMatchCodeqlVersionDryRun */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN",
+    minimumVersion: void 0
+  },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -89787,7 +89840,13 @@ var path6 = __toESM(require("path"));
 var core9 = __toESM(require_core());
 
 // src/caching-utils.ts
+var crypto2 = __toESM(require("crypto"));
 var core7 = __toESM(require_core());
+var cacheKeyHashLength = 16;
+function createCacheKeyHash(components) {
+  const componentsJson = JSON.stringify(components);
+  return crypto2.createHash("sha256").update(componentsJson).digest("hex").substring(0, cacheKeyHashLength);
+}
 
 // src/config/db-config.ts
 var jsonschema = __toESM(require_lib2());
@@ -89902,6 +89961,16 @@ function writeDiagnostic(config, language, diagnostic) {
     logger.debug(JSON.stringify(diagnostic));
   }
 }
+function makeTelemetryDiagnostic(id, name, attributes) {
+  return makeDiagnostic(id, name, {
+    attributes,
+    visibility: {
+      cliSummaryTable: false,
+      statusPage: false,
+      telemetry: true
+    }
+  });
+}
 
 // src/diff-informed-analysis-utils.ts
 var fs5 = __toESM(require("fs"));
@@ -89955,6 +90024,17 @@ var builtin_default = {
 
 // src/languages/index.ts
 var builtInLanguageSet = new Set(builtin_default.languages);
+function isBuiltInLanguage(language) {
+  return builtInLanguageSet.has(language);
+}
+function parseBuiltInLanguage(language) {
+  language = language.trim().toLowerCase();
+  language = builtin_default.aliases[language] ?? language;
+  if (isBuiltInLanguage(language)) {
+    return language;
+  }
+  return void 0;
+}
 
 // src/overlay/status.ts
 var actionsCache = __toESM(require_cache4());
@@ -90034,7 +90114,7 @@ var fs9 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));
 var toolcache3 = __toESM(require_tool_cache());
 var import_fast_deep_equal = __toESM(require_fast_deep_equal());
-var semver8 = __toESM(require_semver2());
+var semver9 = __toESM(require_semver2());
 
 // node_modules/uuid/dist-node/stringify.js
 var byteToHex = [];
@@ -90080,6 +90160,68 @@ function _v4(options, buf, offset) {
 }
 var v4_default = v4;
 
+// src/overlay/caching.ts
+var actionsCache3 = __toESM(require_cache4());
+var semver6 = __toESM(require_semver2());
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
+var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
+var CACHE_VERSION = 1;
+var CACHE_PREFIX = "codeql-overlay-base-database";
+async function getCacheKeyPrefixBase(parsedLanguages) {
+  const languagesComponent = [...parsedLanguages].sort().join("_");
+  const cacheKeyComponents = {
+    automationID: await getAutomationID()
+    // Add more components here as needed in the future
+  };
+  const componentsHash = createCacheKeyHash(cacheKeyComponents);
+  return `${CACHE_PREFIX}-${CACHE_VERSION}-${componentsHash}-${languagesComponent}-`;
+}
+async function getCodeQlVersionsForOverlayBaseDatabases(rawLanguages, logger) {
+  const languages = rawLanguages.map(parseBuiltInLanguage);
+  if (languages.includes(void 0)) {
+    logger.warning(
+      "One or more provided languages are not recognized as built-in languages. Skipping searching for overlay-base databases in cache."
+    );
+    return void 0;
+  }
+  const dedupedLanguages = [
+    ...new Set(languages.filter((l) => l !== void 0))
+  ];
+  const cacheKeyPrefix = await getCacheKeyPrefixBase(dedupedLanguages);
+  logger.debug(
+    `Searching for overlay-base databases in Actions cache with prefix ${cacheKeyPrefix}`
+  );
+  const caches = await listActionsCaches(cacheKeyPrefix);
+  if (caches.length === 0) {
+    logger.info("No overlay-base databases found in Actions cache.");
+    return [];
+  }
+  logger.info(
+    `Found ${caches.length} overlay-base ${caches.length === 1 ? "database" : "databases"} in the Actions cache.`
+  );
+  const versionRegex = /^([\d.]+)-/;
+  const versionSet = /* @__PURE__ */ new Set();
+  for (const cache of caches) {
+    if (!cache.key) continue;
+    const suffix = cache.key.substring(cacheKeyPrefix.length);
+    const match = suffix.match(versionRegex);
+    if (match && semver6.valid(match[1])) {
+      versionSet.add(match[1]);
+    }
+  }
+  if (versionSet.size === 0) {
+    logger.info(
+      "Could not parse any CodeQL versions from overlay-base database cache keys."
+    );
+    return [];
+  }
+  const versions = [...versionSet].sort(semver6.rcompare);
+  logger.info(
+    `Found overlay databases for the following CodeQL versions in the Actions cache: ${versions.join(", ")}`
+  );
+  return versions;
+}
+
 // src/tar.ts
 var import_child_process = require("child_process");
 var fs7 = __toESM(require("fs"));
@@ -90087,7 +90229,7 @@ var stream = __toESM(require("stream"));
 var import_toolrunner = __toESM(require_toolrunner());
 var io4 = __toESM(require_io());
 var toolcache = __toESM(require_tool_cache());
-var semver6 = __toESM(require_semver2());
+var semver7 = __toESM(require_semver2());
 var MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 var MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
 async function getTarVersion() {
@@ -90129,9 +90271,9 @@ async function isZstdAvailable(logger) {
       case "gnu":
         return {
           available: foundZstdBinary && // GNU tar only uses major and minor version numbers
-          semver6.gte(
-            semver6.coerce(version),
-            semver6.coerce(MIN_REQUIRED_GNU_TAR_VERSION)
+          semver7.gte(
+            semver7.coerce(version),
+            semver7.coerce(MIN_REQUIRED_GNU_TAR_VERSION)
           ),
           foundZstdBinary,
           version: tarVersion
@@ -90140,7 +90282,7 @@ async function isZstdAvailable(logger) {
         return {
           available: foundZstdBinary && // Do a loose comparison since these version numbers don't contain
           // a patch version number.
-          semver6.gte(version, MIN_REQUIRED_BSD_TAR_VERSION),
+          semver7.gte(version, MIN_REQUIRED_BSD_TAR_VERSION),
           foundZstdBinary,
           version: tarVersion
         };
@@ -90247,7 +90389,7 @@ var core10 = __toESM(require_core());
 var import_http_client = __toESM(require_lib());
 var toolcache2 = __toESM(require_tool_cache());
 var import_follow_redirects = __toESM(require_follow_redirects());
-var semver7 = __toESM(require_semver2());
+var semver8 = __toESM(require_semver2());
 var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024;
 var TOOLCACHE_TOOL_NAME = "CodeQL";
 function makeDownloadFirstToolsDownloadDurations(downloadDurationMs, extractionDurationMs) {
@@ -90377,7 +90519,7 @@ function getToolcacheDirectory(version) {
   return path7.join(
     getRequiredEnvParam("RUNNER_TOOL_CACHE"),
     TOOLCACHE_TOOL_NAME,
-    semver7.clean(version) || version,
+    semver8.clean(version) || version,
     os.arch() || ""
   );
 }
@@ -90502,13 +90644,13 @@ function tryGetTagNameFromUrl(url2, logger) {
   return match[1];
 }
 function convertToSemVer(version, logger) {
-  if (!semver8.valid(version)) {
+  if (!semver9.valid(version)) {
     logger.debug(
       `Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`
     );
     version = `0.0.0-${version}`;
   }
-  const s = semver8.clean(version);
+  const s = semver9.clean(version);
   if (!s) {
     throw new Error(`Bundle version ${version} is not in SemVer format.`);
   }
@@ -90540,7 +90682,84 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) {
   }
   return void 0;
 }
-async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, variant, tarSupportsZstd, features, logger) {
+async function getEnabledVersionsWithOverlayBaseDatabases(defaultCliVersion, rawLanguages, features, logger) {
+  if (rawLanguages === void 0 || rawLanguages.length === 0) {
+    return [];
+  }
+  const isEnabled = await features.getValue(
+    "overlay_analysis_match_codeql_version" /* OverlayAnalysisMatchCodeqlVersion */
+  );
+  const isDryRun = !isEnabled && await features.getValue("overlay_analysis_match_codeql_version_dry_run" /* OverlayAnalysisMatchCodeqlVersionDryRun */);
+  if (!isEnabled && !isDryRun) {
+    return [];
+  }
+  let cachedVersions;
+  try {
+    cachedVersions = await getCodeQlVersionsForOverlayBaseDatabases(
+      rawLanguages,
+      logger
+    );
+  } catch (e) {
+    logger.warning(
+      `Could not list overlay-base databases in the Actions cache while choosing a default CodeQL CLI version, falling back to the highest enabled version. Details: ${getErrorMessage(e)}`
+    );
+    return [];
+  }
+  if (cachedVersions === void 0 || cachedVersions.length === 0) {
+    return [];
+  }
+  const cachedVersionsSet = new Set(cachedVersions);
+  const overlayVersions = defaultCliVersion.enabledVersions.filter(
+    (v) => cachedVersionsSet.has(v.cliVersion)
+  );
+  if (overlayVersions.length === 0) {
+    return [];
+  }
+  const isCachedVersionDifferent = overlayVersions[0].cliVersion !== defaultCliVersion.enabledVersions[0].cliVersion;
+  if (isCachedVersionDifferent) {
+    addNoLanguageDiagnostic(
+      void 0,
+      makeTelemetryDiagnostic(
+        "codeql-action/overlay-aware-default-codeql-version",
+        "Overlay-aware default CodeQL version selection",
+        {
+          cachedVersions,
+          enabledVersions: defaultCliVersion.enabledVersions.map(
+            (v) => v.cliVersion
+          ),
+          isDryRun,
+          overlayAwareVersion: overlayVersions[0].cliVersion
+        }
+      )
+    );
+  }
+  if (isDryRun) {
+    logger.debug(
+      `Overlay-aware default CodeQL version selection is running in dry-run mode. Would have used version ${overlayVersions[0].cliVersion}.`
+    );
+    return [];
+  }
+  return overlayVersions;
+}
+async function resolveDefaultCliVersion(defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) {
+  if (!useOverlayAwareDefaultCliVersion || !isAnalyzingPullRequest()) {
+    return defaultCliVersion.enabledVersions[0];
+  }
+  const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases(
+    defaultCliVersion,
+    rawLanguages,
+    features,
+    logger
+  );
+  if (overlayVersions.length > 0) {
+    logger.info(
+      `Using CodeQL version ${overlayVersions[0].cliVersion} since this is the highest enabled version that has a cached overlay-base database.`
+    );
+    return overlayVersions[0];
+  }
+  return defaultCliVersion.enabledVersions[0];
+}
+async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, apiDetails, variant, tarSupportsZstd, features, logger) {
   if (toolsInput && !isReservedToolsValue(toolsInput) && !toolsInput.startsWith("http")) {
     logger.info(`Using CodeQL CLI from local path ${toolsInput}`);
     const compressionMethod2 = inferCompressionMethod(toolsInput);
@@ -90634,21 +90853,35 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
           );
         }
       }
-      cliVersion2 = defaultCliVersion.cliVersion;
-      tagName = defaultCliVersion.tagName;
+      const version = await resolveDefaultCliVersion(
+        defaultCliVersion,
+        rawLanguages,
+        useOverlayAwareDefaultCliVersion,
+        features,
+        logger
+      );
+      cliVersion2 = version.cliVersion;
+      tagName = version.tagName;
     }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
     url2 = toolsInput;
     if (tagName) {
       const bundleVersion3 = tryGetBundleVersionFromTagName(tagName, logger);
-      if (bundleVersion3 && semver8.valid(bundleVersion3)) {
+      if (bundleVersion3 && semver9.valid(bundleVersion3)) {
         cliVersion2 = convertToSemVer(bundleVersion3, logger);
       }
     }
   } else {
-    cliVersion2 = defaultCliVersion.cliVersion;
-    tagName = defaultCliVersion.tagName;
+    const version = await resolveDefaultCliVersion(
+      defaultCliVersion,
+      rawLanguages,
+      useOverlayAwareDefaultCliVersion,
+      features,
+      logger
+    );
+    cliVersion2 = version.cliVersion;
+    tagName = version.tagName;
   }
   const bundleVersion2 = tagName && tryGetBundleVersionFromTagName(tagName, logger);
   const humanReadableVersion = cliVersion2 ?? (bundleVersion2 && convertToSemVer(bundleVersion2, logger)) ?? tagName ?? url2 ?? "unknown";
@@ -90845,7 +91078,7 @@ function getCanonicalToolcacheVersion(cliVersion2, bundleVersion2, logger) {
   }
   return cliVersion2;
 }
-async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger) {
+async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) {
   if (!await isBinaryAccessible("tar", logger)) {
     throw new ConfigurationError(
       "Could not find tar in PATH, so unable to extract CodeQL bundle."
@@ -90855,6 +91088,8 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau
   const source = await getCodeQLSource(
     toolsInput,
     defaultCliVersion,
+    rawLanguages,
+    useOverlayAwareDefaultCliVersion,
     apiDetails,
     variant,
     zstdAvailability.available,
@@ -90913,7 +91148,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau
 async function useZstdBundle(cliVersion2, tarSupportsZstd) {
   return (
     // In testing, gzip performs better than zstd on Windows.
-    process.platform !== "win32" && tarSupportsZstd && semver8.gte(cliVersion2, CODEQL_VERSION_ZSTD_BUNDLE)
+    process.platform !== "win32" && tarSupportsZstd && semver9.gte(cliVersion2, CODEQL_VERSION_ZSTD_BUNDLE)
   );
 }
 function getTempExtractionDir(tempDir) {
@@ -90945,7 +91180,7 @@ async function getNightlyToolsUrl(logger) {
   }
 }
 function getLatestToolcacheVersion(logger) {
-  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver8.compare(b, a));
+  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver9.compare(b, a));
   logger.debug(
     `Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
       allVersions
@@ -90982,7 +91217,7 @@ var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
 var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
 var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
-async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger, checkVersion) {
+async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) {
   try {
     const {
       codeqlFolder,
@@ -90996,6 +91231,8 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
       tempDir,
       variant,
       defaultCliVersion,
+      rawLanguages,
+      useOverlayAwareDefaultCliVersion,
       features,
       logger
     );
@@ -92717,7 +92954,7 @@ var core12 = __toESM(require_core());
 var toolrunner4 = __toESM(require_toolrunner());
 var github2 = __toESM(require_github());
 var io5 = __toESM(require_io());
-async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger) {
+async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) {
   logger.startGroup("Setup CodeQL tools");
   const {
     codeql,
@@ -92731,6 +92968,8 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe
     tempDir,
     variant,
     defaultCliVersion,
+    rawLanguages,
+    useOverlayAwareDefaultCliVersion,
     features,
     logger,
     true
@@ -92879,9 +93118,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
       url: getRequiredEnvParam("GITHUB_SERVER_URL"),
       apiURL: getRequiredEnvParam("GITHUB_API_URL")
     };
-    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
-      gitHubVersion.type
-    );
+    const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     const initCodeQLResult = await initCodeQL(
       void 0,
       // There is no tools input on the upload action
@@ -92889,6 +93126,10 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
       tempDir,
       gitHubVersion.type,
       codeQLDefaultVersionInfo,
+      void 0,
+      // rawLanguages: upload-lib does not run analysis
+      false,
+      // useOverlayAwareDefaultCliVersion: upload-lib does not run analysis
       features,
       logger
     );
@@ -92904,7 +93145,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
   return readSarifFile(outputFile);
 }
 function populateRunAutomationDetails(sarifFile, category, analysis_key, environment) {
-  const automationID = getAutomationID(category, analysis_key, environment);
+  const automationID = getAutomationID2(category, analysis_key, environment);
   if (automationID !== void 0) {
     for (const run of sarifFile.runs || []) {
       if (run.automationDetails === void 0) {
@@ -92917,7 +93158,7 @@ function populateRunAutomationDetails(sarifFile, category, analysis_key, environ
   }
   return sarifFile;
 }
-function getAutomationID(category, analysis_key, environment) {
+function getAutomationID2(category, analysis_key, environment) {
   if (category !== void 0) {
     let automationID = category;
     if (!automationID.endsWith("/")) {