Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-41f3755806

.github/workflows/__all-platform-bundle.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__analyze-ref-input.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__autobuild-action.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Prepare test

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Java
-        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__build-mode-autobuild.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Java
-        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__build-mode-manual.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__export-file-baseline-information.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__go-custom-queries.yml

@@ -69,7 +69,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__local-bundle.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__multi-language-autodetect.yml

@@ -101,7 +101,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__packaging-config-inputs-js.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__packaging-config-js.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__packaging-inputs-js.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__remote-config.yml

@@ -69,7 +69,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__rubocop-multi-language.yml

@@ -54,7 +54,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1.313.0
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__split-workflow.yml

@@ -77,7 +77,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__swift-custom-build.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__unset-environment.yml

@@ -69,7 +69,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__upload-ref-sha-input.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__upload-sarif.yml

@@ -74,7 +74,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/__with-checkout-path.yml

@@ -68,7 +68,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go

.github/workflows/debug-artifacts-failure-safe.yml

@@ -58,7 +58,7 @@ jobs:
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed

.github/workflows/debug-artifacts-safe.yml

@@ -54,7 +54,7 @@ jobs:
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed

.github/workflows/test-codeql-bundle-all.yml

@@ -46,7 +46,7 @@ jobs:
         version: ${{ matrix.version }}
         use-all-platform-bundle: true
     - name: Install .NET
-      uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
       with:
         dotnet-version: '9.x'
     - id: init

lib/entry-points.js

@@ -150503,16 +150503,13 @@ async function getCodeQLForCmd(cmd, checkVersion) {
     async getVersion() {
       let result = getCachedCodeQlVersion(cmd);
       if (result === void 0) {
-        const output = await runCli(cmd, ["version", "--format=json"], {
-          noStreamStdout: true
-        });
-        try {
-          result = JSON.parse(output);
-        } catch {
-          throw Error(
-            `Invalid JSON output from \`version --format=json\`: ${output}`
-          );
-        }
+        result = await runCliJson(
+          cmd,
+          ["version", "--format=json"],
+          {
+            noStreamStdout: true
+          }
+        );
         cacheCodeQlVersion(cmd, result);
       }
       return result;
@@ -150672,23 +150669,18 @@ async function getCodeQLForCmd(cmd, checkVersion) {
     async resolveLanguages({
       filterToLanguagesWithQueries
     } = { filterToLanguagesWithQueries: false }) {
-      const codeqlArgs = [
+      return runCliJson(cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
         "--extractor-options-verbosity=4",
         "--extractor-include-aliases",
+        // TODO: Unconditionally include `--filter-to-languages-with-queries`
+        //       once CODEQL_MINIMUM_VERSION is at least v2.23.0
+        //       — the first version to support this flag.
         ...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
         ...getExtraOptionsFromEnv(["resolve", "languages"])
-      ];
-      const output = await runCli(cmd, codeqlArgs);
-      try {
-        return JSON.parse(output);
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve languages with --format=betterjson: ${e}`
-        );
-      }
+      ]);
     },
     async resolveBuildEnvironment(workingDir, language) {
       const codeqlArgs = [
@@ -150701,15 +150693,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
       if (workingDir !== void 0) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      const output = await runCli(cmd, codeqlArgs);
-      try {
-        return JSON.parse(output);
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve build-environment: ${e} in
-${output}`
-        );
-      }
+      return await runCliJson(cmd, codeqlArgs);
     },
     async databaseRunQueries(databasePath, flags, queries = []) {
       const codeqlArgs = [
@@ -150875,14 +150859,9 @@ ${output}`
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries
       ];
-      const output = await runCli(cmd, codeqlArgs, { noStreamStdout: true });
-      try {
-        return JSON.parse(output);
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve queries --format=startingpacks: ${e}`
-        );
-      }
+      return await runCliJson(cmd, codeqlArgs, {
+        noStreamStdout: true
+      });
     },
     async resolveDatabase(databasePath) {
       const codeqlArgs = [
@@ -150892,14 +150871,9 @@ ${output}`
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"])
       ];
-      const output = await runCli(cmd, codeqlArgs, { noStreamStdout: true });
-      try {
-        return JSON.parse(output);
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve database --format=json: ${e}`
-        );
-      }
+      return await runCliJson(cmd, codeqlArgs, {
+        noStreamStdout: true
+      });
     },
     async mergeResults(sarifFiles, outputFile, {
       mergeRunsFromEqualCategory = false
@@ -150981,6 +150955,16 @@ async function runCli(cmd, args = [], opts = {}) {
     throw e;
   }
 }
+async function runCliJson(cmd, args = [], opts = {}) {
+  const output = await runCli(cmd, args, opts);
+  try {
+    return JSON.parse(output);
+  } catch (e) {
+    throw Error(
+      `Unexpected output from codeql ${args.join(" ")}: ${getErrorMessage(e)}`
+    );
+  }
+}
 async function writeCodeScanningConfigFile(config, logger) {
   const codeScanningConfigFile = getGeneratedCodeScanningConfigPath(config);
   const augmentedConfig = appendExtraQueryExclusions(
@@ -151525,7 +151509,7 @@ extensions:
 `;
   let data = ranges.map((range2) => {
     const filename = path15.join(checkoutPath, range2.path).replaceAll(path15.sep, "/");
-    return `      - [${dump(filename, { quoteStyle: "single" }).trim()}, ${range2.startLine}, ${range2.endLine}]
+    return `      - [${dump(filename, { forceQuotes: true, quoteStyle: "single" }).trim()}, ${range2.startLine}, ${range2.endLine}]
 `;
   }).join("");
   if (!data) {

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1.313.0
+    uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

pr-checks/sync.ts

@@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Java",
         uses: pinnedUses(
           "actions/setup-java",
-          "ad2b38190b15e4d6bdf0c97fb4fca8412226d287",
-          "v5.3.0",
+          "1bcf9fb12cf4aa7d266a90ae39939e61372fe520",
+          "v5.4.0",
         ),
         with: {
           "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -288,8 +288,8 @@ const languageSetups: LanguageSetups = {
         name: "Install .NET",
         uses: pinnedUses(
           "actions/setup-dotnet",
-          "9a946fdbd5fb07b82b2f5a4466058b876ab72bb2",
-          "v5.3.0",
+          "26b0ec14cb23fa6904739307f278c14f94c95bf1",
+          "v5.4.0",
         ),
         with: {
           "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`,

src/analyze.ts

@@ -285,7 +285,7 @@ extensions:
       // characters are escaped, and that the path is always rendered as a
       // quoted string on a single line.
       return (
-        `      - [${yaml.dump(filename, { quoteStyle: "single" }).trim()}, ` +
+        `      - [${yaml.dump(filename, { forceQuotes: true, quoteStyle: "single" }).trim()}, ` +
         `${range.startLine}, ${range.endLine}]\n`
       );
     })

src/codeql.ts

@@ -514,16 +514,13 @@ async function getCodeQLForCmd(
     async getVersion() {
       let result = util.getCachedCodeQlVersion(cmd);
       if (result === undefined) {
-        const output = await runCli(cmd, ["version", "--format=json"], {
-          noStreamStdout: true,
-        });
-        try {
-          result = JSON.parse(output) as VersionInfo;
-        } catch {
-          throw Error(
-            `Invalid JSON output from \`version --format=json\`: ${output}`,
-          );
-        }
+        result = await runCliJson<VersionInfo>(
+          cmd,
+          ["version", "--format=json"],
+          {
+            noStreamStdout: true,
+          },
+        );
         util.cacheCodeQlVersion(cmd, result);
       }
       return result;
@@ -731,26 +728,20 @@ async function getCodeQLForCmd(
         filterToLanguagesWithQueries: boolean;
       } = { filterToLanguagesWithQueries: false },
     ) {
-      const codeqlArgs = [
+      return runCliJson<ResolveLanguagesOutput>(cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
         "--extractor-options-verbosity=4",
         "--extractor-include-aliases",
+        // TODO: Unconditionally include `--filter-to-languages-with-queries`
+        //       once CODEQL_MINIMUM_VERSION is at least v2.23.0
+        //       — the first version to support this flag.
         ...(filterToLanguagesWithQueries
           ? ["--filter-to-languages-with-queries"]
           : []),
         ...getExtraOptionsFromEnv(["resolve", "languages"]),
-      ];
-      const output = await runCli(cmd, codeqlArgs);
-
-      try {
-        return JSON.parse(output) as ResolveLanguagesOutput;
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve languages with --format=betterjson: ${e}`,
-        );
-      }
+      ]);
     },
     async resolveBuildEnvironment(
       workingDir: string | undefined,
@@ -766,15 +757,7 @@ async function getCodeQLForCmd(
       if (workingDir !== undefined) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      const output = await runCli(cmd, codeqlArgs);
-
-      try {
-        return JSON.parse(output) as ResolveBuildEnvironmentOutput;
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve build-environment: ${e} in\n${output}`,
-        );
-      }
+      return await runCliJson<ResolveBuildEnvironmentOutput>(cmd, codeqlArgs);
     },
     async databaseRunQueries(
       databasePath: string,
@@ -976,15 +959,9 @@ async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries,
       ];
-      const output = await runCli(cmd, codeqlArgs, { noStreamStdout: true });
-
-      try {
-        return JSON.parse(output) as string[];
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve queries --format=startingpacks: ${e}`,
-        );
-      }
+      return await runCliJson<string[]>(cmd, codeqlArgs, {
+        noStreamStdout: true,
+      });
     },
     async resolveDatabase(
       databasePath: string,
@@ -996,15 +973,9 @@ async function getCodeQLForCmd(
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"]),
       ];
-      const output = await runCli(cmd, codeqlArgs, { noStreamStdout: true });
-
-      try {
-        return JSON.parse(output) as ResolveDatabaseOutput;
-      } catch (e) {
-        throw new Error(
-          `Unexpected output from codeql resolve database --format=json: ${e}`,
-        );
-      }
+      return await runCliJson<ResolveDatabaseOutput>(cmd, codeqlArgs, {
+        noStreamStdout: true,
+      });
     },
     async mergeResults(
       sarifFiles: string[],
@@ -1160,6 +1131,30 @@ async function runCli(
   }
 }
 
+/**
+ * Wraps the command executor {@link runCli} and tries to parse the output as JSON.
+ * @param cmd The command to run.
+ * @param args The arguments to pass to the command.
+ * @param opts The options for running the command.
+ * @param opts.stdin Optional string to pass to the command's standard input.
+ * @param opts.noStreamStdout Optional boolean to indicate whether to stream the command's standard output.
+ * @returns The parsed JSON output from the command.
+ */
+async function runCliJson<T>(
+  cmd: string,
+  args: string[] = [],
+  opts: { stdin?: string; noStreamStdout?: boolean } = {},
+): Promise<T> {
+  const output = await runCli(cmd, args, opts);
+  try {
+    return JSON.parse(output) as T;
+  } catch (e) {
+    throw Error(
+      `Unexpected output from codeql ${args.join(" ")}: ${getErrorMessage(e)}`,
+    );
+  }
+}
+
 /**
  * Writes the code scanning configuration that is to be used by the CLI.
  *