Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris

fix: decode SARIF location URIs in diff-informed alert filtering

.github/workflows/__all-platform-bundle.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: All-platform bundle
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__analysis-kinds.yml

@@ -34,28 +34,28 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: risk-assessment
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds

.github/workflows/__analyze-ref-input.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__autobuild-action.yml

@@ -44,11 +44,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: autobuild-action
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__autobuild-working-dir.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Autobuild working directory
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-autobuild.yml

@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Build mode autobuild
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-manual.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode manual
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-none.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode none
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-rollback.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode rollback
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__bundle-from-nightly.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: 'Bundle: From nightly'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__bundle-from-toolcache.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: toolcache
     name: 'Bundle: From toolcache'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__bundle-toolcache.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: 'Bundle: Caching checks'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Clean up database cluster directory
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__config-export.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Config export
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__config-input.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Config input
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cpp-deptrace-disabled.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'C/C++: disabling autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cpp-deptrace-enabled.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__diagnostics-export.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Diagnostic export
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__diagnostics-without-db.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Diagnostic export without database
     if: github.triggering_actor != 'dependabot[bot]'
@@ -108,7 +108,7 @@ jobs:
       contents: read
       security-events: read
     timeout-minutes: 5
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/__export-file-baseline-information.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Export file baseline information
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__extractor-ram-threads.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Extractor ram and threads options test
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__global-proxy.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Proxy test
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-custom-queries.yml

@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Go: Custom queries'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: 'Go: diagnostic when Go is changed after init step'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: 'Go: diagnostic when `file` is not installed'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: 'Go: workaround for indirect tracing'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-tracing-autobuilder.yml

@@ -46,25 +46,25 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'Go: tracing with autobuilder step'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -46,25 +46,25 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'Go: tracing with custom build steps'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -46,25 +46,25 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'Go: tracing with legacy workflow'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__init-with-registries.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Download using registries'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__javascript-source-root.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Custom source root
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__job-run-uuid-sarif.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Job run UUID added to SARIF
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__language-aliases.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Language aliases
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__local-bundle.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Local CodeQL bundle
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__multi-language-autodetect.yml

@@ -58,37 +58,37 @@ jobs:
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
           - os: macos-15-xlarge
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
           - os: macos-15-xlarge
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Multi-language repository
     if: github.triggering_actor != 'dependabot[bot]'
@@ -121,7 +121,7 @@ jobs:
         # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13.15'
 

.github/workflows/__overlay-init-fallback.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Overlay database init fallback
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-config-inputs-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Config and input'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-config-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Config file'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-inputs-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Action input'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__per-language-bundle-validation.yml

@@ -35,40 +35,40 @@ jobs:
       matrix:
         include:
           - language: actions
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             expected-extractors: actions javascript
           - language: cpp
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: manual
             build-command: gcc -o main main.c
           - language: csharp
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: none
           - language: go
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: autobuild
           - language: java
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: none
           - language: javascript
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: python
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: ruby
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: rust
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: swift
-            os: macos-latest-xlarge
+            os: macos-26-xlarge
             version: linked
             build-mode: autobuild
     name: Per-language bundles

.github/workflows/__remote-config.yml

@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Remote config file
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__resolve-environment-action.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Resolve environment
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__ruby.yml

@@ -34,17 +34,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest
+          - os: macos-26
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: Ruby analysis
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__rust.yml

@@ -36,13 +36,13 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.1
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Rust analysis
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__split-workflow.yml

@@ -54,17 +54,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest
+          - os: macos-26
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: Split workflow
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__start-proxy.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: Start proxy
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__submit-sarif-failure.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Submit SARIF after failure
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__swift-autobuild.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Swift analysis using autobuild
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__swift-custom-build.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Swift analysis using a custom build command
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__unset-environment.yml

@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Test unsetting environment variables
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__unsupported-macos.yml

@@ -0,0 +1,135 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Unsupported macOS
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: unsupported-macos-${{github.ref}}
+jobs:
+  unsupported-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: xcode-27
+            version: linked
+          - os: xcode-27
+            version: nightly-latest
+    name: Unsupported macOS
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Check xcode_select_link
+        run: |
+          readlink /private/var/db/xcode_select_link
+          file -h /private/var/db/xcode_select_link
+
+      - uses: ./../action/init
+        id: init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+          CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+        # can't cope with that unless we introduce a different testing environment. Since this step
+        # would just fail on `xcode-27` anyway, we just skip it instead.
+        if: false
+        uses: ./analyze
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  unsupported-macos-sarif-checks:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - unsupported-macos
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__upload-sarif.yml

@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`

.github/workflows/__with-checkout-path.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Use a custom `checkout_path`
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
   check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       versions: ${{ steps.compare.outputs.versions }}
 
@@ -106,7 +106,7 @@ jobs:
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     strategy:
       fail-fast: false

.github/workflows/codescanning-config-cli.yml

@@ -41,11 +41,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: linked
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: default
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set

.github/workflows/debug-artifacts-failure-safe.yml

@@ -47,7 +47,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
 
     steps:
       - name: Dump GitHub event
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/debug-artifacts-safe.yml

@@ -45,7 +45,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
 
     steps:
       - name: Check out repository
@@ -84,7 +84,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/post-release-mergeback.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       baseBranch:
-        description: 'The base branch to merge into'
+        description: "The base branch to merge into"
         default: main
         required: false
 
@@ -24,7 +24,7 @@ defaults:
 
 jobs:
   merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     if: github.repository == 'github/codeql-action'
     env:
@@ -41,16 +41,16 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "${GITHUB_CONTEXT}"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
+          fetch-depth: 0 # ensure we have all tags and can push commits
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install JavaScript dependencies
         run: npm ci

.github/workflows/pr-checks.yml

@@ -25,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-26, windows-2025]
         node-version: [20, 24]
     permissions:
       contents: read
@@ -71,7 +71,7 @@ jobs:
         run: npm test
 
       - name: Lint
-        if: always() && matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-2025'
         run: npm run lint-ci
 
       - name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
         # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
         # rather than the event. The same results are uploaded by the `pull_request` run and again
         # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -93,7 +93,7 @@ jobs:
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
 
     concurrency:
@@ -126,10 +126,15 @@ jobs:
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
 
+      - name: Typecheck pr-checks scripts
+        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        working-directory: pr-checks
+        run: npm run typecheck
+
       - name: Run pr-checks tests
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         working-directory: pr-checks
-        run: npx tsx --test
+        run: npm run test
 
       - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}

.github/workflows/prepare-release.yml

@@ -29,7 +29,7 @@ defaults:
 jobs:
   prepare:
     name: "Release info"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.repository == 'github/codeql-action'
 
     permissions:

.github/workflows/python312-windows.yml

@@ -29,10 +29,10 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: windows-latest
+    runs-on: windows-2025
 
     steps:
-    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: 3.12
 

.github/workflows/query-filters.yml

@@ -25,7 +25,7 @@ jobs:
     name: Query Filters Tests
     if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:

.github/workflows/rebuild.yml

@@ -12,7 +12,7 @@ defaults:
 jobs:
   rebuild:
     name: Rebuild Action
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
     env:
@@ -33,7 +33,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Remove label
         if: github.event_name == 'pull_request'

.github/workflows/rollback-release.yml

@@ -34,7 +34,7 @@ jobs:
   rollback:
     name: "Create rollback release"
     if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
 
     # Don't set the deployment environment for test runs

.github/workflows/test-codeql-bundle-all.yml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: nightly-latest
     name: 'CodeQL Bundle All'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/update-bundle.yml

@@ -20,7 +20,7 @@ defaults:
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests
@@ -113,11 +113,12 @@ jobs:
           echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
           echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"
 
-      - name: Create changelog note
+      - name: Create changenote
         run: |
           npx tsx pr-checks/bundle-changelog.ts
 
-      - name: Push changelog note
+      - name: Push changenote
         run: |
-          git commit -am "Add changelog note"
+          git add unreleased-change-notes
+          git commit -m "Add changenote"
           git push

.github/workflows/update-release-branch.yml

@@ -26,7 +26,7 @@ jobs:
   update:
     name: "Update release branch"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event_name == 'workflow_dispatch'
     needs: [prepare]
     env:
@@ -79,7 +79,7 @@ jobs:
   backport:
     name: "Create backport"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     needs: [prepare]
     if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}

CHANGELOG.md

@@ -6,6 +6,13 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 No user facing changes.
 
+## 4.39.2 - 03 Nov 2026
+
+- Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)
+- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)
+- Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See [this blog post for more information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/). The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). This check will be rolled out following this release of the CodeQL Action. [#4221](https://github.com/github/codeql-action/pull/4221)
+- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze` Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#4243](https://github.com/github/codeql-action/pull/4243)
+
 ## 4.39.1 - 21 Oct 2026
 
 - Update default CodeQL bundle version to [2.27.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#4256](https://github.com/github/codeql-action/pull/4256)

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.3",
-  "cliVersion": "2.27.3",
-  "priorBundleVersion": "codeql-bundle-v2.27.2",
-  "priorCliVersion": "2.27.2"
+  "bundleVersion": "codeql-bundle-v2.27.4",
+  "cliVersion": "2.27.4",
+  "priorBundleVersion": "codeql-bundle-v2.27.3",
+  "priorCliVersion": "2.27.3"
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.2",
+  "version": "4.39.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.2",
+      "version": "4.39.3",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -33,7 +33,7 @@
         "js-yaml": "^5.5.0",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
-        "node-forge": "^1.4.0",
+        "node-forge": "^1.4.1",
         "semver": "^7.8.5",
         "undici": "^7.30.1",
         "uuid": "^14.0.3"
@@ -50,14 +50,14 @@
         "@types/node-forge": "^1.3.14",
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.8.0",
-        "@types/sinon": "^22.0.0",
+        "@types/sinon": "^22.0.1",
         "ava": "^6.4.1",
         "esbuild": "^0.28.2",
         "eslint": "^9.39.5",
         "eslint-import-resolver-typescript": "^4.4.5",
         "eslint-plugin-github": "^6.1.2",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.3.15",
+        "eslint-plugin-jsdoc": "^65.4.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^13.0.6",
         "globals": "^17.13.0",
@@ -67,14 +67,6 @@
         "typescript-eslint": "^8.72.0"
       }
     },
-    "node_modules/@aashutoshrathi/word-wrap": {
-      "version": "1.2.6",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/@actions/artifact": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-5.0.3.tgz",
@@ -958,18 +950,89 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@es-joy/escodegen": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/escodegen/-/escodegen-4.2.0.tgz",
+      "integrity": "sha512-jWqqS3StW6vGwJeT8yu6alS4nipOBi3kD/pR63+9hG2NfGafCJ4viDME15mVf+fyupyptcUJDXfv63gFF5Gzfg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@es-joy/estraverse": "^7.1.1",
+        "@es-joy/jsdoccomment": "^0.62.0",
+        "esprima": "^4.0.1",
+        "esutils": "^2.0.3",
+        "optionator": "^0.9.4"
+      },
+      "bin": {
+        "escodegen": "bin/escodegen.js",
+        "esgenerate": "bin/esgenerate.js"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "optionalDependencies": {
+        "source-map": "~0.7.6"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/@es-joy/jsdoccomment": {
+      "version": "0.62.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.62.0.tgz",
+      "integrity": "sha512-yWi6sm7INEwnfS7IJvE0dU+RTrwzLPFcY7e7eGpu/l5Q9lWfQ2ROwZ0qVnc242jw2TUPsfHX3XMIISkGBv57RQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.8",
+        "@typescript-eslint/types": "^8.44.1",
+        "comment-parser": "1.4.1",
+        "esquery": "^1.6.0",
+        "jsdoc-type-pratt-parser": "~5.9.0"
+      },
+      "engines": {
+        "node": ">=20.11.0"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/comment-parser": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.1.tgz",
+      "integrity": "sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/jsdoc-type-pratt-parser": {
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-5.9.2.tgz",
+      "integrity": "sha512-TYzkACp/wPvDJLRY7qpHXtrhgwoAaojIOnLaaVNi+AbPU2u1kkjfKd9hXXTq0qSAGsyYXvwUXt99h9I5iCmjjw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/@es-joy/estraverse": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/@es-joy/estraverse/-/estraverse-7.1.1.tgz",
+      "integrity": "sha512-h2d737iS0LFAqypZOmXizu54qAbHofI/RpD30Zom03O6BCXKHuFevWKPcGarZbGq82h7qSBb5G6kLdhTMO+caw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.98.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.98.0.tgz",
-      "integrity": "sha512-QS+b7I2aaSM+gZfDz1b9E4B367JJ2qTjFXRKF289iKkh9sYdZ21Q5MiF/Duzouy3J0C4VhM3I/8f2F4+zT8gYQ==",
+      "version": "0.100.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.100.0.tgz",
+      "integrity": "sha512-QuIT5kMg3XWN22Wa1rcXmR/GkfSg6Ygs/ikMiHihdSpu+o3O59LygkFV9srKa5xHplBFwNd5ZCo3bywL4k7qMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.70.0",
+        "@typescript-eslint/types": "^8.72.0",
         "comment-parser": "1.4.9",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~9.2.2"
+        "jsdoc-type-pratt-parser": "~9.3.0"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
@@ -2681,20 +2744,15 @@
       "license": "MIT"
     },
     "node_modules/@types/sinon": {
-      "version": "22.0.0",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.0.tgz",
-      "integrity": "sha512-TDbVpbccc2HfiqHR09Argj3mHV1KMW7sCCKj52fsl8lbRLkEn7fB1966EWhOKWUBcqfBueZuPoA7/OK1CKiy3g==",
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.1.tgz",
+      "integrity": "sha512-MThluJXPmpBY+Z5S3565F2z+hjkCXnBrr36j2mitVQ7JUtxA+A+YQhs+0Q6J8jxb0SVJvydO+6NWfj9EBzpiBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/sinonjs__fake-timers": "*"
+        "@sinonjs/fake-timers": "^15.4.0"
       }
     },
-    "node_modules/@types/sinonjs__fake-timers": {
-      "version": "8.1.2",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -5366,15 +5424,16 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.3.15",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.15.tgz",
-      "integrity": "sha512-cpU66X+daaX2X6cndE0grdLAIlodysI3KuUEdrJd6FvQHuuYOOvMRAdy8ToYjyJrsoUv0fXkMclA5RM5kaipMw==",
+      "version": "65.4.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.4.0.tgz",
+      "integrity": "sha512-bRiU6LfCFmLL7GuePKvA6ZIcXLonhZGCg2TgQLmkcExeVdAirQp2Hsf3xeSUTmlKwAAsREVEOLbZYD8F7oA69g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/jsdoccomment": "~0.98.0",
+        "@es-joy/escodegen": "^4.2.0",
+        "@es-joy/jsdoccomment": "~0.100.0",
         "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.70.1",
+        "@typescript-eslint/utils": "^8.72.0",
         "are-docs-informative": "^0.1.1",
         "comment-parser": "1.4.9",
         "debug": "^4.4.3",
@@ -7170,36 +7229,18 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.2.tgz",
-      "integrity": "sha512-eFY7Rlscvv/BpY6UsVsjKwMhu1tJO/F4U/vC9g3yeRy/JqszuO1UP6Vdq+85G+3FP6fEw/sWR8a5ftPFY86csw==",
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.3.0.tgz",
+      "integrity": "sha512-JZ8lKMCZXDlM1jAjAK5tTmtFJtgv6iFQQfjE3Fza6jBRACUueaEXLY17n1u05JO1lcPkNxgP+ddEDtiPsk5ktg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.9",
-        "@types/node": "^26.4.0"
+        "@types/estree": "^1.0.9"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
       }
     },
-    "node_modules/jsdoc-type-pratt-parser/node_modules/@types/node": {
-      "version": "26.6.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
-      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.9.0"
-      }
-    },
-    "node_modules/jsdoc-type-pratt-parser/node_modules/undici-types": {
-      "version": "8.9.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
-      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -8157,9 +8198,9 @@
       }
     },
     "node_modules/node-forge": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.1.tgz",
+      "integrity": "sha512-w5/MfWaeMrpR/5ba6fZyAUTLSuE6aYz7H/3cYrqwZEmf5eQS3IaaLgJt4MBv7HglGFWmV22K8h4U18RJQmw/ow==",
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
         "node": ">= 6.13.0"
@@ -8360,16 +8401,18 @@
       }
     },
     "node_modules/optionator": {
-      "version": "0.9.3",
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@aashutoshrathi/word-wrap": "^1.2.3",
         "deep-is": "^0.1.3",
         "fast-levenshtein": "^2.0.6",
         "levn": "^0.4.1",
         "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0"
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -9293,6 +9336,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/source-map": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true,
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -10326,6 +10380,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.39.2",
+  "version": "4.39.3",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -13,7 +13,8 @@
     "test": "npm run ava -- src/",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh"
+    "update-pr-checks": "./pr-checks/sync.sh",
+    "typecheck": "tsc --noEmit"
   },
   "license": "MIT",
   "workspaces": [
@@ -41,7 +42,7 @@
     "js-yaml": "^5.5.0",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
-    "node-forge": "^1.4.0",
+    "node-forge": "^1.4.1",
     "semver": "^7.8.5",
     "undici": "^7.30.1",
     "uuid": "^14.0.3"
@@ -58,14 +59,14 @@
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.8.0",
-    "@types/sinon": "^22.0.0",
+    "@types/sinon": "^22.0.1",
     "ava": "^6.4.1",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.3.15",
+    "eslint-plugin-jsdoc": "^65.4.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
     "globals": "^17.13.0",

pr-checks/bundle-changelog.test.ts

@@ -10,17 +10,13 @@ import { afterEach, beforeEach, describe, it } from "node:test";
 
 import {
   CLI_VERSION_ENV_VAR,
+  getChangenote,
   getCLIVersion,
   getPRNumber,
   getPRUrl,
   PR_URL_ENV_VAR,
-  updateChangelog,
 } from "./bundle-changelog";
-import {
-  EMPTY_CHANGELOG,
-  NO_CHANGES_STR,
-  UNRELEASED_PLACEHOLDER,
-} from "./changelog";
+import { isValidChangenoteContent } from "./changelog/validate";
 
 let testDir: string;
 
@@ -85,58 +81,15 @@ describe("getPRNumber", async () => {
   });
 });
 
-const testChangelog = `${EMPTY_CHANGELOG.trimEnd()}
-
-## 4.23.7
-
-- Other change
-
-## 4.23.6
-
-${NO_CHANGES_STR}`;
-
-const expectedChangelog = `# CodeQL Action Changelog
-
-## ${UNRELEASED_PLACEHOLDER}
-
-- Update default CodeQL bundle version to
-
-## 4.23.7
-
-- Other change
-
-## 4.23.6
-
-${NO_CHANGES_STR}`;
-
-describe("updateChangelog", async () => {
-  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
-    const result = updateChangelog(EMPTY_CHANGELOG, "");
-    assert.ok(!result.includes(NO_CHANGES_STR));
-  });
-
-  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
-    const result = updateChangelog(
-      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
-      "",
+describe("getChangenote", async () => {
+  await it("returns a note linking to the bundle release and the PR", async () => {
+    assert.equal(
+      getChangenote("1.2.3", testPrUrl),
+      "- Update default CodeQL bundle version to [1.2.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v1.2.3). [#42](https://github.com/github/codeql-action/pulls/42)\n",
     );
-    assert.ok(result.includes(NO_CHANGES_STR));
   });
 
-  await it("throws if there are no sections", async () => {
-    assert.throws(() => {
-      updateChangelog(
-        "# CodeQL Action Changelog",
-        "- Update default CodeQL bundle version to",
-      );
-    });
-  });
-
-  await it("adds note at the end of the first section", async () => {
-    const result = updateChangelog(
-      testChangelog,
-      "- Update default CodeQL bundle version to",
-    );
-    assert.deepEqual(result, expectedChangelog);
+  await it("returns valid changenote content", async () => {
+    assert.ok(isValidChangenoteContent(getChangenote("1.2.3", testPrUrl)));
   });
 });

pr-checks/bundle-changelog.ts

@@ -1,17 +1,13 @@
 #!/usr/bin/env npx tsx
 
 /**
- * Updates the changelog with a change note for an updated CodeQL CLI bundle.
+ * Creates a changenote file for an update to the default CodeQL CLI bundle.
  */
 
 import * as fs from "node:fs";
+import * as path from "node:path";
 
-import {
-  parseChangelog,
-  renderChangelog,
-  UNRELEASED_PLACEHOLDER,
-} from "./changelog";
-import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
+import { CHANGENOTES_DIR, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
 import { getErrorMessage } from "./util";
 
 export const CLI_VERSION_ENV_VAR = "CLI_VERSION";
@@ -58,42 +54,19 @@ export function getPRNumber(prUrl: string) {
 }
 
 /**
- * Updates `changelog` by adding `changelogNote` to the first section.
+ * Returns the contents of the changenote file for an update to the default
+ * CodeQL CLI bundle.
  *
- * @param contents The existing changelog contents.
- * @param changelogNote The note to add to the first section.
+ * @param cliVersion The CodeQL CLI version of the new default bundle.
+ * @param prUrl The URL of the PR that updates the default bundle.
+ * @throws If the PR number can't be determined from `prUrl`.
  */
-export function updateChangelog(contents: string, changelogNote: string) {
-  // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
-  contents = contents.replace(
-    `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`,
-    `## ${UNRELEASED_PLACEHOLDER}\n`,
-  );
+export function getChangenote(cliVersion: string, prUrl: string): string {
+  // The GitHub Release for the new bundle version.
+  const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
 
-  const changelog = parseChangelog(contents);
-
-  if (changelog.sections.length === 0) {
-    throw new Error("The changelog contains no existing sections.");
-  }
-
-  // Add the changelog note to the bottom of the first section.
-  const firstSection = changelog.sections[0];
-  const lastLine = firstSection.bodyLines.pop();
-
-  if (lastLine !== undefined && lastLine.trim() !== "") {
-    // We expect the last line to be empty. If it isn't for some reason,
-    // add it back.
-    firstSection.bodyLines.push(lastLine);
-  }
-
-  firstSection.bodyLines.push(changelogNote);
-
-  // If the last line is empty as expected, then add it back in after the new note.
-  if (lastLine?.trim() === "") {
-    firstSection.bodyLines.push(lastLine);
-  }
-
-  return renderChangelog(changelog);
+  const prNumber = getPRNumber(prUrl);
+  return `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})\n`;
 }
 
 function main() {
@@ -101,22 +74,19 @@ function main() {
     const cliVersion = getCLIVersion();
     const prUrl = getPRUrl();
 
-    // The GitHub Release for the new bundle version.
-    const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
-
-    // Get the PR number from the PR URL.
-    const prNumber = getPRNumber(prUrl);
-    const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`;
-
-    let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
-
-    changelog = updateChangelog(changelog, changelogNote);
-
-    fs.writeFileSync(CHANGELOG_FILE, changelog);
+    // Include the CLI version in the file name so that changenotes for
+    // different bundle updates don't conflict.
+    const changenotePath = path.join(
+      CHANGENOTES_DIR,
+      `update-bundle-${cliVersion}.md`,
+    );
+    fs.writeFileSync(changenotePath, getChangenote(cliVersion, prUrl));
 
     return 0;
   } catch (err) {
-    console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`);
+    console.error(
+      `Failed to create changenote for bundle update: ${getErrorMessage(err)}`,
+    );
     return -1;
   }
 }

pr-checks/checks/all-platform-bundle.yml

@@ -3,7 +3,7 @@ description: "Tests using an all-platform CodeQL Bundle"
 operatingSystems:
   - ubuntu
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
   - windows
 versions:
   - nightly-latest

pr-checks/checks/multi-language-autodetect.yml

@@ -3,7 +3,7 @@ description: "An end-to-end integration test of a multi-language repository usin
 operatingSystems:
   - ubuntu
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
   # Older CodeQL CLI versions only support Swift up to 6.1, which requires Xcode 16. That is
   # not available on macOS 26, so run these versions on macOS 15 where we select Xcode 16
   # below. See https://github.com/actions/runner-images/issues/14167.
@@ -23,7 +23,7 @@ steps:
     # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
     # See https://github.com/github/codeql-action/pull/3212
     if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-    uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
     with:
       python-version: "3.13.15"
 

pr-checks/checks/per-language-bundle-validation.yml

@@ -3,41 +3,41 @@ description: Validates extraction and analysis using each per-language CodeQL bu
 matrix:
   include:
     - language: actions
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       # Actions also needs the JavaScript extractor.
       expected-extractors: actions javascript
     - language: cpp
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: manual
       build-command: gcc -o main main.c
     - language: csharp
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: none
     - language: go
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: autobuild
     - language: java
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: none
     - language: javascript
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: python
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: ruby
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: rust
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: swift
-      os: macos-latest-xlarge
+      os: macos-26-xlarge
       version: linked
       build-mode: autobuild
 installNode: true

pr-checks/checks/swift-autobuild.yml

@@ -4,7 +4,7 @@ versions:
   - nightly-latest
 operatingSystems:
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
 steps:
   - uses: ./../action/init
     id: init

pr-checks/checks/swift-custom-build.yml

@@ -6,7 +6,7 @@ versions:
   - nightly-latest
 operatingSystems:
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
 installGo: true
 installDotNet: true
 env:

pr-checks/checks/unsupported-macos.yml

@@ -0,0 +1,67 @@
+name: "Unsupported macOS"
+description: "Tests that unsupported macOS versions are detected and result in appropriate diagnostics."
+versions:
+  - linked
+  - nightly-latest
+installNode: true
+
+operatingSystems:
+  - os: macos
+    runner-image: xcode-27
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  - name: Check xcode_select_link
+    run: |
+      readlink /private/var/db/xcode_select_link
+      file -h /private/var/db/xcode_select_link
+
+  - uses: ./../action/init
+    id: init
+    continue-on-error: true
+    env:
+      CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+      CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+    # can't cope with that unless we introduce a different testing environment. Since this step
+    # would just fail on `xcode-27` anyway, we just skip it instead.
+    if: false
+    uses: ./analyze
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+validationJobs:
+  unsupported-macos-sarif-checks:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts

pr-checks/package.json

@@ -2,6 +2,11 @@
   "private": true,
   "description": "Dependencies for codeql-action scripts",
   "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "npx tsx --test",
+    "checks": "npm run typecheck && npm run test"
+  },
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@actions/github": "^8.0.1",
@@ -9,7 +14,7 @@
     "@octokit/core": "^7.0.8",
     "@octokit/plugin-paginate-rest": ">=16.0.0",
     "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-    "glob": "^13.0.6",
+    "glob": "^14.0.3",
     "lite-matter": "^0.1.2",
     "mdast-util-from-markdown": "^2.1.0",
     "semver": "^7.8.5",

pr-checks/sync-back.test.ts

@@ -56,9 +56,18 @@ jobs:
 
     const result = scanGeneratedWorkflows(workflowDir);
 
-    assert.equal(result["actions/checkout"], "v4");
-    assert.equal(result["actions/setup-node"], "v5");
-    assert.equal(result["actions/setup-go"], "v6");
+    assert.deepEqual(
+      result.actionVersions["actions/checkout"],
+      new Set(["v4"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["actions/setup-node"],
+      new Set(["v5"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["actions/setup-go"],
+      new Set(["v6"]),
+    );
   });
 
   await it("scanning workflows with version comments", () => {
@@ -78,12 +87,18 @@ jobs:
 
     const result = scanGeneratedWorkflows(workflowDir);
 
-    assert.equal(result["actions/checkout"], "v4");
-    assert.equal(
-      result["ruby/setup-ruby"],
-      "44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
+    assert.deepEqual(
+      result.actionVersions["actions/checkout"],
+      new Set(["v4"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["ruby/setup-ruby"],
+      new Set(["44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0"]),
+    );
+    assert.deepEqual(
+      result.actionVersions["actions/setup-python"],
+      new Set(["v6 # Latest Python"]),
     );
-    assert.equal(result["actions/setup-python"], "v6 # Latest Python");
   });
 
   await it("ignores local actions", () => {
@@ -103,9 +118,15 @@ jobs:
 
     const result = scanGeneratedWorkflows(workflowDir);
 
-    assert.equal(result["actions/checkout"], "v4");
-    assert.equal("./.github/actions/local-action" in result, false);
-    assert.equal("./another-local-action" in result, false);
+    assert.deepEqual(
+      result.actionVersions["actions/checkout"],
+      new Set(["v4"]),
+    );
+    assert.equal(
+      "./.github/actions/local-action" in result.actionVersions,
+      false,
+    );
+    assert.equal("./another-local-action" in result.actionVersions, false);
   });
 });
 
@@ -128,8 +149,8 @@ const steps = [
     fs.writeFileSync(syncTsPath, syncTsContent);
 
     const actionVersions = {
-      "actions/setup-node": "v5",
-      "actions/setup-go": "v6",
+      "actions/setup-node": new Set(["v5"]),
+      "actions/setup-go": new Set(["v6"]),
     };
 
     const result = updateSyncTs(syncTsPath, actionVersions);
@@ -155,7 +176,7 @@ const steps = [
     fs.writeFileSync(syncTsPath, syncTsContent);
 
     const actionVersions = {
-      "actions/setup-node": "v5 # Latest version",
+      "actions/setup-node": new Set(["v5 # Latest version"]),
     };
 
     const result = updateSyncTs(syncTsPath, actionVersions);
@@ -182,7 +203,7 @@ const steps = [
     fs.writeFileSync(syncTsPath, syncTsContent);
 
     const actionVersions = {
-      "actions/setup-node": "v5",
+      "actions/setup-node": new Set(["v5"]),
     };
 
     const result = updateSyncTs(syncTsPath, actionVersions);
@@ -206,7 +227,9 @@ const steps = [
     fs.writeFileSync(syncTsPath, syncTsContent);
 
     const actionVersions = {
-      "actions/setup-node": "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0",
+      "actions/setup-node": new Set([
+        "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0",
+      ]),
     };
 
     const result = updateSyncTs(syncTsPath, actionVersions);
@@ -244,8 +267,9 @@ steps:
       "actions/checkout": "v4",
       "actions/setup-node": "v5 # Latest",
     };
+    const byWorkflow = { ["test.yml"]: actionVersions };
 
-    const result = updateTemplateFiles(checksDir, actionVersions);
+    const result = updateTemplateFiles(checksDir, byWorkflow);
     assert.equal(result.length, 1);
     assert.ok(result.includes(templatePath));
 
@@ -269,8 +293,9 @@ steps:
     const actionVersions = {
       "ruby/setup-ruby": "55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
     };
+    const byWorkflow = { ["test.yml"]: actionVersions };
 
-    const result = updateTemplateFiles(checksDir, actionVersions);
+    const result = updateTemplateFiles(checksDir, byWorkflow);
     assert.equal(result.length, 1);
 
     const updatedContent = fs.readFileSync(templatePath, "utf8");

pr-checks/sync-back.ts

@@ -27,16 +27,39 @@ const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
 const WORKFLOW_DIR = path.join(REPO_ROOT, ".github", "workflows");
 const SYNC_TS_PATH = path.join(PR_CHECKS_DIR, "sync.ts");
 
+/** Type alias for action names. */
+type ActionName = string;
+
+/** Type alias for action versions. May include a comment. */
+type ActionVersion = string;
+
+/** Mappings of {@link ActionName}s to {@link ActionVersion}s. */
+type ActionVersions = Record<ActionName, ActionVersion>;
+
+/** Mappings of workflow names to {@link ActionVersions}. */
+type ActionVersionsByWorkflow = Record<string, ActionVersions>;
+
+/** The result of {@link scanGeneratedWorkflows}. */
+type ScanWorkflowResult = {
+  /** A mapping of {@link ActionName}s to all encountered {@link ActionVersion}s. */
+  actionVersions: Record<ActionName, Set<ActionVersion>>;
+
+  /** A mapping of workflow names to {@link ActionVersions}. */
+  actionVersionsByWorkflow: ActionVersionsByWorkflow;
+};
+
 /**
  * Scan generated workflow files to extract the latest action versions.
  *
  * @param workflowDir - Path to .github/workflows directory
- * @returns Map from action names to their latest versions (including comments)
+ *
+ * @returns A {@link ScanWorkflowResult} object containing information about the extracted action versions.
  */
 export function scanGeneratedWorkflows(
   workflowDir: string,
-): Record<string, string> {
-  const actionVersions: Record<string, string> = {};
+): ScanWorkflowResult {
+  const actionVersionsByWorkflow: ActionVersionsByWorkflow = {};
+  const actionVersions: Record<ActionName, Set<ActionVersion>> = {};
 
   const generatedFiles = fs
     .readdirSync(workflowDir)
@@ -46,6 +69,10 @@ export function scanGeneratedWorkflows(
   for (const filePath of generatedFiles) {
     const content = fs.readFileSync(filePath, "utf8");
 
+    // Get the basename of the workflow and drop the leading `__` from it.
+    const workflowName = path.basename(filePath).slice(2);
+    actionVersionsByWorkflow[workflowName] = {};
+
     // Find all action uses in the file, including potential comments
     // This pattern captures: action_name@version_with_possible_comment
     const pattern = /uses:\s+([^/\s]+\/[^@\s]+)@([^@\n]+)/g;
@@ -57,13 +84,26 @@ export function scanGeneratedWorkflows(
 
       // Only track non-local actions (those with / but not starting with ./)
       if (!actionName.startsWith("./")) {
-        // Assume that version numbers are consistent (this should be the case on a Dependabot update PR)
-        actionVersions[actionName] = versionWithComment;
+        // Record the version of the action for this workflow.
+        actionVersionsByWorkflow[workflowName][actionName] = versionWithComment;
+
+        // Record this version for the action so that we can write it to `sync.ts` if needed.
+        // Usually we'd expect there to be exactly one version per action across all workflows,
+        // but sometimes these can go out-of-sync if e.g. a workflow is added in a branch and a
+        // Dependabot PR is merged in the meantime that changes the version of an action that is
+        // used in the new workflow. Different versions of the same action across different
+        // workflows is not fundamentally a problem, but we may need to pick one for `sync.ts`
+        // so we warn there if we have multiple versions of an action.
+        if (actionVersions[actionName] === undefined) {
+          actionVersions[actionName] = new Set([versionWithComment]);
+        } else if (!actionVersions[actionName].has(versionWithComment)) {
+          actionVersions[actionName].add(versionWithComment);
+        }
       }
     }
   }
 
-  return actionVersions;
+  return { actionVersions, actionVersionsByWorkflow };
 }
 
 /**
@@ -79,7 +119,7 @@ export function scanGeneratedWorkflows(
  */
 export function updateSyncTs(
   syncTsPath: string,
-  actionVersions: Record<string, string>,
+  actionVersions: Record<ActionName, Set<ActionVersion>>,
 ): boolean {
   if (!fs.existsSync(syncTsPath)) {
     throw new Error(`Could not find ${syncTsPath}`);
@@ -89,9 +129,18 @@ export function updateSyncTs(
   const originalContent = content;
 
   // Update hardcoded action versions
-  for (const [actionName, versionWithComment] of Object.entries(
+  for (const [actionName, versionsWithComments] of Object.entries(
     actionVersions,
   )) {
+    // We usually expect `versionsWithComments` to contain one version. If there are multiple,
+    // we arbitrarily pick one and warn about it.
+    const versionsWithCommentsArray = Array.from(versionsWithComments);
+    const versionWithComment = versionsWithCommentsArray[0];
+    if (versionsWithComments.size > 1) {
+      console.warn(
+        `Inconsistent versions for ${actionName}. Arbitrarily picking '${versionWithComment}'. All found: ${versionsWithCommentsArray.join(", ")}`,
+      );
+    }
     // Split the scanned value into the ref (e.g. a commit SHA) and the optional
     // trailing version comment (e.g. `v6.0.3`).
     const ref = versionWithComment.includes("#")
@@ -138,12 +187,12 @@ export function updateSyncTs(
  * Update action versions in template files in pr-checks/checks/
  *
  * @param checksDir - Path to pr-checks/checks directory
- * @param actionVersions - Map of action names to versions (may include comments)
+ * @param actionVersionsByWorkflow - Map of workflows to maps of action names to versions (may include comments)
  * @returns List of files that were modified
  */
 export function updateTemplateFiles(
   checksDir: string,
-  actionVersions: Record<string, string>,
+  actionVersionsByWorkflow: ActionVersionsByWorkflow,
 ): string[] {
   const modifiedFiles: string[] = [];
 
@@ -156,6 +205,16 @@ export function updateTemplateFiles(
     let content = fs.readFileSync(filePath, "utf8");
     const originalContent = content;
 
+    const workflowName = path.basename(filePath);
+    const actionVersions = actionVersionsByWorkflow[workflowName];
+
+    if (actionVersions === undefined) {
+      console.info(
+        `Found no action versions for workflow template '${filePath}'.`,
+      );
+      continue;
+    }
+
     // Update action versions
     for (const [actionName, versionWithComment] of Object.entries(
       actionVersions,
@@ -191,12 +250,15 @@ function main(): number {
   const verbose = values.verbose ?? false;
 
   console.info("Scanning generated workflows for latest action versions...");
-  const actionVersions = scanGeneratedWorkflows(WORKFLOW_DIR);
+  const { actionVersions, actionVersionsByWorkflow } =
+    scanGeneratedWorkflows(WORKFLOW_DIR);
 
   if (verbose) {
     console.info("Found action versions:");
-    for (const [action, version] of Object.entries(actionVersions)) {
-      console.info(`  ${action}@${version}`);
+    for (const [action, versions] of Object.entries(actionVersions)) {
+      for (const version of versions) {
+        console.info(`  ${action}@${version}`);
+      }
     }
   }
 
@@ -215,7 +277,10 @@ function main(): number {
   }
 
   // Update template files
-  const templateModified = updateTemplateFiles(CHECKS_DIR, actionVersions);
+  const templateModified = updateTemplateFiles(
+    CHECKS_DIR,
+    actionVersionsByWorkflow,
+  );
   modifiedFiles.push(...templateModified);
 
   if (modifiedFiles.length > 0) {

pr-checks/sync.ts

@@ -43,6 +43,13 @@ type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;
 /** An operating system identifier. */
 type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows";
 
+/** Mapping from {@link OperatingSystemIdentifier} to default runner image labels. */
+const DEFAULT_RUNNER_IMAGES: Record<OperatingSystemIdentifier, string> = {
+  ubuntu: "ubuntu-26.04",
+  macos: "macos-26",
+  windows: "windows-2025",
+};
+
 /**
  * Represents an operating system matrix entry for a generated PR check workflow.
  *
@@ -296,8 +303,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Python",
         uses: pinnedUses(
           "actions/setup-python",
-          "5fda3b95a4ea91299a34e894583c3862153e4b97",
-          "v7.0.0",
+          "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0",
+          "v7.1.0",
         ),
         with: {
           "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`,
@@ -414,12 +421,6 @@ function generateJobMatrix(
       );
     }
 
-    const defaultRunnerImages = [
-      "ubuntu-latest",
-      "macos-latest",
-      "windows-latest",
-    ];
-
     for (const operatingSystemConfig of operatingSystems) {
       const operatingSystem =
         typeof operatingSystemConfig === "string"
@@ -449,7 +450,7 @@ function generateJobMatrix(
       const runnerImagesForOs =
         typeof operatingSystemConfig === "string" ||
         operatingSystemConfig["runner-image"] === undefined
-          ? defaultRunnerImages.filter((image) =>
+          ? Object.values(DEFAULT_RUNNER_IMAGES).filter((image) =>
               image.startsWith(operatingSystem),
             )
           : [operatingSystemConfig["runner-image"]];
@@ -462,7 +463,7 @@ function generateJobMatrix(
         // is removed from `defaultTestVersions`.
         const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
         if (
-          runnerImage === "ubuntu-latest" &&
+          runnerImage === DEFAULT_RUNNER_IMAGES["ubuntu"] &&
           version === requiresOlderRunnerImage
         ) {
           matrix.push({ os: "ubuntu-24.04", version });
@@ -666,16 +667,18 @@ function generateValidationJob(
   // Add the generated steps in front of the ones from the specification.
   specSteps.items.unshift(...checkoutStep, ...steps);
 
+  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if: baseCondition,
     needs: [checkName],
     permissions: {
       contents: "read",
       "security-events": "read",
     },
     "timeout-minutes": 5,
-    "runs-on": "ubuntu-latest",
+    "runs-on": DEFAULT_RUNNER_IMAGES["ubuntu"],
     steps: specSteps,
   };
 

pr-checks/tsconfig.json

@@ -9,5 +9,12 @@
     "noEmit": true
   },
   "include": ["./**/*.ts", "../src/**/*.ts"],
-  "exclude": ["node_modules"]
+  "exclude": [
+    "node_modules",
+    "../src/testdata/**",
+    "../src/**/*.test.ts",
+    "../src/testing-utils.ts",
+    "../src/json/testing-util.ts",
+    "../src/feature-flags/testing-util.ts"
+  ]
 }

src/action-common.ts

@@ -1,3 +1,5 @@
+import * as os from "os";
+
 import * as core from "@actions/core";
 
 import { ActionsEnv, getActionsEnv } from "./actions-util";
@@ -13,6 +15,8 @@ import {
 } from "./status-report";
 import { getEnv, getErrorMessage, wrapError } from "./util";
 
+export type { Logger } from "./logging";
+
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
   /** The name of the Action. */
@@ -23,6 +27,8 @@ export interface BaseState {
   platform: NodeJS.Platform;
   /** The architecture of the host. */
   arch: NodeJS.Architecture;
+  /** The version of the operating system. */
+  osRelease: string;
 }
 
 /** Describes different state features that an Action may have. */
@@ -173,6 +179,7 @@ export async function runInActions(action: Action) {
       startedAt,
       platform: process.platform,
       arch: process.arch,
+      osRelease: os.release(),
       logger,
       env,
       actions: actionsEnv,

src/actions-util.test.ts

@@ -11,8 +11,8 @@ import {
 } from "./actions-util";
 import { computeAutomationID } from "./api-client";
 import { EnvVar } from "./environment";
-import { RecordingLogger, setupTests } from "./testing-utils";
-import { initializeEnvironment, withTmpDir } from "./util";
+import { getTestEnv, RecordingLogger, setupTests } from "./testing-utils";
+import { withTmpDir } from "./util";
 
 setupTests(test);
 
@@ -227,8 +227,9 @@ test.serial(
 );
 
 test.serial("initializeEnvironment", (t) => {
-  initializeEnvironment("1.2.3");
-  t.deepEqual(process.env[EnvVar.VERSION], "1.2.3");
+  const env = getTestEnv();
+  env.initialise("1.2.3");
+  t.deepEqual(env.getOptional(EnvVar.VERSION), "1.2.3");
 });
 
 test.serial("fixCodeQualityCategory", (t) => {

src/actions-util.ts

@@ -364,7 +364,7 @@ const MAX_STDERR_BUFFER_SIZE = 20000;
  * @throws A {@link CommandInvocationError} if the tool exits with a non-zero status code.
  */
 export async function runTool(
-  env: Env,
+  env: ReadOnlyEnv,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},

src/analyze-action.ts

@@ -233,7 +233,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
   let databaseUploadResults: DatabaseUploadResult[] = [];
 
   try {
-    util.initializeEnvironment(actionsUtil.getActionVersion());
+    action.env.initialise(actionsUtil.getActionVersion());
 
     // Make inputs accessible in the `post` step, details at
     // https://github.com/github/codeql-action/issues/2553

src/api-client.test.ts

@@ -7,7 +7,7 @@ import { ProxyAgent } from "undici";
 import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
 import { DO_NOT_RETRY_STATUSES } from "./api-client";
-import { ActionsEnvVars, RegistryProxyVars } from "./environment";
+import { ActionsEnvVars, RegistryProxyVars, getEnv } from "./environment";
 import { GITHUB_DOTCOM_API_URL, GITHUB_DOTCOM_URL } from "./github";
 import {
   callee,
@@ -21,7 +21,7 @@ import * as util from "./util";
 setupTests(test);
 
 test.beforeEach(() => {
-  util.initializeEnvironment(actionsUtil.getActionVersion());
+  getEnv().initialise(actionsUtil.getActionVersion());
 });
 
 test.serial("getApiClient", async (t) => {

src/autobuild-action.ts

@@ -10,7 +10,7 @@ import { getGitHubVersion } from "./api-client";
 import { determineAutobuildLanguages, runAutobuild } from "./autobuild";
 import { getCodeQL } from "./codeql";
 import { Config, getConfig } from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, type Env } from "./environment";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 import {
@@ -26,7 +26,6 @@ import {
   checkDiskUsage,
   checkGitHubVersionInRange,
   ConfigurationError,
-  initializeEnvironment,
   wrapError,
 } from "./util";
 
@@ -38,6 +37,7 @@ interface AutobuildStatusReport extends StatusReportBase {
 }
 
 async function sendCompletedStatusReport(
+  env: Env,
   config: Config | undefined,
   logger: Logger,
   startedAt: Date,
@@ -45,7 +45,7 @@ async function sendCompletedStatusReport(
   failingLanguage?: string,
   cause?: Error,
 ) {
-  initializeEnvironment(getActionVersion());
+  env.initialise(getActionVersion());
 
   const status = getActionsStatus(cause, failingLanguage);
   const statusReportBase = await createStatusReportBase(
@@ -129,6 +129,7 @@ async function run({
       `We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. ${error.message}`,
     );
     await sendCompletedStatusReport(
+      env,
       config,
       logger,
       startedAt,
@@ -141,7 +142,13 @@ async function run({
 
   env.export(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
 
-  await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
+  await sendCompletedStatusReport(
+    env,
+    config,
+    logger,
+    startedAt,
+    languages ?? [],
+  );
 }
 
 /** Defines the `autobuild` Action. */

src/codeql.test.ts

@@ -21,6 +21,7 @@ import {
 import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
+import { getEnv } from "./environment";
 import { BuiltInLanguage } from "./languages";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -38,14 +39,13 @@ import {
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
-import { initializeEnvironment } from "./util";
 
 setupTests(test);
 
 let stubConfig: Config;
 
 test.beforeEach(() => {
-  initializeEnvironment("1.2.3");
+  getEnv().initialise("1.2.3");
 
   stubConfig = createTestConfig({
     languages: [BuiltInLanguage.cpp],

src/codeql.ts

@@ -4,6 +4,7 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as yaml from "js-yaml";
+import * as semver from "semver";
 
 import {
   CommandInvocationError,
@@ -19,6 +20,7 @@ import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
 import { EnvVar, getEnv, Env, ReadOnlyEnv } from "./environment";
+import { getErrorMessage, isDiskConfigurationError } from "./errors";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -34,7 +36,9 @@ import { ToolsDownloadStatusReport } from "./tools-download";
 import { ToolsFeature, isSupportedToolsFeature } from "./tools-features";
 import { shouldEnableIndirectTracing } from "./tracer-config";
 import * as util from "./util";
-import { BuildMode, CleanupLevel, getErrorMessage } from "./util";
+import { BuildMode, CleanupLevel } from "./util";
+
+export { isDiskConfigurationError } from "./errors";
 
 type Options = Array<string | number | boolean>;
 
@@ -70,6 +74,11 @@ export interface CodeQL {
    * Get a string containing the semver version of the CodeQL executable.
    */
   getVersion(): Promise<VersionInfo>;
+  /**
+   * Determines whether the CLI installation represented by this {@link CodeQL} instance
+   * has at least the {@link requiredVersion}.
+   */
+  isVersionAtLeast(requiredVersion: string): Promise<boolean>;
   /**
    * Print version information about CodeQL.
    */
@@ -275,26 +284,6 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 
-/**
- * Decides whether `e` is a disk-related error outside of our control
- * that should be classified as a `ConfigurationError`.
- *
- * @param e The error to check.
- * @returns True if the error should be treated as a `ConfigurationError` or false if not.
- */
-export function isDiskConfigurationError(e: unknown): boolean {
-  if (!(e instanceof Error)) {
-    return false;
-  }
-
-  return (
-    // out of disk space
-    e.message.includes("ENOSPC") ||
-    // access denied
-    e.message.includes("EACCES")
-  );
-}
-
 /**
  * Set up CodeQL CLI access.
  *
@@ -403,9 +392,9 @@ export function setCodeQL(codeql: Partial<CodeQL>): void {
   cachedCodeQL = createStubCodeQL(codeql);
 }
 
-function resolveFunction<T>(
+function resolveFunction<K extends keyof CodeQL, T extends CodeQL[K]>(
   partialCodeql: Partial<CodeQL>,
-  methodName: string,
+  methodName: K,
   defaultImplementation?: T,
 ): T {
   if (typeof partialCodeql[methodName] !== "function") {
@@ -415,7 +404,7 @@ function resolveFunction<T>(
     const dummyMethod = () => {
       throw new Error(`CodeQL ${methodName} method not correctly defined`);
     };
-    return dummyMethod as T;
+    return dummyMethod as unknown as T;
   }
   return partialCodeql[methodName] as T;
 }
@@ -432,6 +421,19 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
     getVersion: resolveFunction(partialCodeql, "getVersion", async () => ({
       version: "1.0.0",
     })),
+    isVersionAtLeast: resolveFunction(
+      partialCodeql,
+      "isVersionAtLeast",
+      async (requiredVersion) => {
+        return (
+          !!partialCodeql.getVersion &&
+          semver.gte(
+            (await partialCodeql.getVersion()).version,
+            requiredVersion,
+          )
+        );
+      },
+    ),
     printVersion: resolveFunction(partialCodeql, "printVersion"),
     supportsFeature: resolveFunction(
       partialCodeql,
@@ -525,6 +527,9 @@ export async function getCodeQLForCmd(
       }
       return result;
     },
+    async isVersionAtLeast(requiredVersion: string) {
+      return semver.gte((await this.getVersion()).version, requiredVersion);
+    },
     async printVersion() {
       // Reuse the cached version information rather than invoking the CLI again.
       core.info(JSON.stringify(await this.getVersion(), null, 2));
@@ -1062,7 +1067,7 @@ export async function getCodeQLForCmd(
   // CodeQL object is created.
   if (
     checkVersion &&
-    !(await util.codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION))
+    !(await codeql.isVersionAtLeast(CODEQL_MINIMUM_VERSION))
   ) {
     throw new util.ConfigurationError(
       `Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${
@@ -1072,7 +1077,7 @@ export async function getCodeQLForCmd(
   } else if (
     checkVersion &&
     env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
-    !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
+    !(await codeql.isVersionAtLeast(CODEQL_NEXT_MINIMUM_VERSION))
   ) {
     const result = await codeql.getVersion();
     core.warning(
@@ -1166,7 +1171,7 @@ export function getExtraOptions(
 }
 
 async function runCli(
-  env: Env,
+  env: ReadOnlyEnv,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
@@ -1193,7 +1198,7 @@ async function runCli(
  * @returns The parsed JSON output from the command.
  */
 async function runCliJson<T>(
-  env: Env,
+  env: ReadOnlyEnv,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},

src/config-utils.ts

@@ -82,7 +82,6 @@ import {
   GitHubVersion,
   ConfigurationError,
   BuildMode,
-  codeQlVersionAtLeast,
   cloneObject,
   isDefined,
   checkDiskUsage,
@@ -654,10 +653,7 @@ async function runnerHasSufficientMemory(
   logger: Logger,
 ): Promise<boolean> {
   if (
-    await codeQlVersionAtLeast(
-      codeql,
-      CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE,
-    )
+    await codeql.isVersionAtLeast(CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE)
   ) {
     logger.debug(
       `Skipping memory check for overlay analysis because CodeQL version is at least ${CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE}.`,
@@ -901,7 +897,7 @@ async function validateOverlayDatabaseMode(
     );
     return new Failure(OverlayDisabledReason.IncompatibleBuildMode);
   }
-  if (!(await codeQlVersionAtLeast(codeql, CODEQL_OVERLAY_MINIMUM_VERSION))) {
+  if (!(await codeql.isVersionAtLeast(CODEQL_OVERLAY_MINIMUM_VERSION))) {
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because ` +
         `the CodeQL CLI is older than ${CODEQL_OVERLAY_MINIMUM_VERSION}. ` +

src/database-upload.test.ts

@@ -15,6 +15,7 @@ import {
   cleanupAndUploadDatabases,
   uploadBundledDatabase,
 } from "./database-upload";
+import { getEnv } from "./environment";
 import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
@@ -31,18 +32,12 @@ import {
   setupActionsVars,
   setupTests,
 } from "./testing-utils";
-import {
-  CleanupLevel,
-  GitHubVariant,
-  HTTPError,
-  initializeEnvironment,
-  withTmpDir,
-} from "./util";
+import { CleanupLevel, GitHubVariant, HTTPError, withTmpDir } from "./util";
 
 setupTests(test);
 
 test.beforeEach(() => {
-  initializeEnvironment("1.2.3");
+  getEnv().initialise("1.2.3");
 });
 
 const testRepoName: RepositoryNwo = { owner: "github", repo: "example" };

src/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.3",
-  "cliVersion": "2.27.3",
-  "priorBundleVersion": "codeql-bundle-v2.27.2",
-  "priorCliVersion": "2.27.2"
+  "bundleVersion": "codeql-bundle-v2.27.4",
+  "cliVersion": "2.27.4",
+  "priorBundleVersion": "codeql-bundle-v2.27.3",
+  "priorCliVersion": "2.27.3"
 }