Merge pull request #4284 from github/update-bundle/codeql-bundle-v2.27.4

Update default bundle to 2.27.4

.github/workflows/__all-platform-bundle.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: All-platform bundle
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__analysis-kinds.yml

@@ -34,28 +34,28 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: risk-assessment
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds

.github/workflows/__analyze-ref-input.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__autobuild-action.yml

@@ -44,11 +44,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: autobuild-action
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__autobuild-working-dir.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Autobuild working directory
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-autobuild.yml

@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Build mode autobuild
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-manual.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode manual
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-none.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode none
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__build-mode-rollback.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode rollback
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__bundle-from-nightly.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: 'Bundle: From nightly'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__bundle-from-toolcache.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: toolcache
     name: 'Bundle: From toolcache'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__bundle-toolcache.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: 'Bundle: Caching checks'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Clean up database cluster directory
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__config-export.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Config export
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__config-input.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Config input
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cpp-deptrace-disabled.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'C/C++: disabling autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__cpp-deptrace-enabled.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__diagnostics-export.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Diagnostic export
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__diagnostics-without-db.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Diagnostic export without database
     if: github.triggering_actor != 'dependabot[bot]'
@@ -108,7 +108,7 @@ jobs:
       contents: read
       security-events: read
     timeout-minutes: 5
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/__export-file-baseline-information.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Export file baseline information
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__extractor-ram-threads.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Extractor ram and threads options test
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__global-proxy.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Proxy test
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-custom-queries.yml

@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Go: Custom queries'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: 'Go: diagnostic when Go is changed after init step'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: 'Go: diagnostic when `file` is not installed'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: 'Go: workaround for indirect tracing'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-tracing-autobuilder.yml

@@ -46,25 +46,25 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'Go: tracing with autobuilder step'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -46,25 +46,25 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'Go: tracing with custom build steps'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -46,25 +46,25 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: 'Go: tracing with legacy workflow'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__init-with-registries.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Download using registries'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__javascript-source-root.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Custom source root
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__job-run-uuid-sarif.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Job run UUID added to SARIF
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__language-aliases.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Language aliases
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__local-bundle.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Local CodeQL bundle
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__multi-language-autodetect.yml

@@ -58,37 +58,37 @@ jobs:
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
           - os: macos-15-xlarge
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
           - os: macos-15-xlarge
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.25.6
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.25.6
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Multi-language repository
     if: github.triggering_actor != 'dependabot[bot]'
@@ -121,7 +121,7 @@ jobs:
         # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13.15'
 

.github/workflows/__overlay-init-fallback.yml

@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Overlay database init fallback
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-config-inputs-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Config and input'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-config-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Config file'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__packaging-inputs-js.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: 'Packaging: Action input'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__per-language-bundle-validation.yml

@@ -35,40 +35,40 @@ jobs:
       matrix:
         include:
           - language: actions
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             expected-extractors: actions javascript
           - language: cpp
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: manual
             build-command: gcc -o main main.c
           - language: csharp
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: none
           - language: go
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: autobuild
           - language: java
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: none
           - language: javascript
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: python
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: ruby
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: rust
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: swift
-            os: macos-latest-xlarge
+            os: macos-26-xlarge
             version: linked
             build-mode: autobuild
     name: Per-language bundles

.github/workflows/__remote-config.yml

@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Remote config file
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__resolve-environment-action.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Resolve environment
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__ruby.yml

@@ -34,17 +34,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest
+          - os: macos-26
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: Ruby analysis
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__rust.yml

@@ -36,13 +36,13 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.1
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Rust analysis
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__split-workflow.yml

@@ -54,17 +54,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest
+          - os: macos-26
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: Split workflow
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__start-proxy.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: Start proxy
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__submit-sarif-failure.yml

@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Submit SARIF after failure
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__swift-autobuild.yml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Swift analysis using autobuild
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__swift-custom-build.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Swift analysis using a custom build command
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__unset-environment.yml

@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Test unsetting environment variables
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__unsupported-macos.yml

@@ -0,0 +1,135 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Unsupported macOS
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: unsupported-macos-${{github.ref}}
+jobs:
+  unsupported-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: xcode-27
+            version: linked
+          - os: xcode-27
+            version: nightly-latest
+    name: Unsupported macOS
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Check xcode_select_link
+        run: |
+          readlink /private/var/db/xcode_select_link
+          file -h /private/var/db/xcode_select_link
+
+      - uses: ./../action/init
+        id: init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+          CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+        # can't cope with that unless we introduce a different testing environment. Since this step
+        # would just fail on `xcode-27` anyway, we just skip it instead.
+        if: false
+        uses: ./analyze
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  unsupported-macos-sarif-checks:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - unsupported-macos
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/__upload-sarif.yml

@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`

.github/workflows/__with-checkout-path.yml

@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Use a custom `checkout_path`
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
   check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       versions: ${{ steps.compare.outputs.versions }}
 
@@ -106,7 +106,7 @@ jobs:
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     strategy:
       fail-fast: false

.github/workflows/codescanning-config-cli.yml

@@ -41,11 +41,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: linked
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: default
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set

.github/workflows/debug-artifacts-failure-safe.yml

@@ -47,7 +47,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
 
     steps:
       - name: Dump GitHub event
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/debug-artifacts-safe.yml

@@ -45,7 +45,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
 
     steps:
       - name: Check out repository
@@ -84,7 +84,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/post-release-mergeback.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       baseBranch:
-        description: 'The base branch to merge into'
+        description: "The base branch to merge into"
         default: main
         required: false
 
@@ -24,7 +24,7 @@ defaults:
 
 jobs:
   merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     if: github.repository == 'github/codeql-action'
     env:
@@ -41,16 +41,16 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "${GITHUB_CONTEXT}"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
+          fetch-depth: 0 # ensure we have all tags and can push commits
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install JavaScript dependencies
         run: npm ci

.github/workflows/pr-checks.yml

@@ -25,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-26, windows-2025]
         node-version: [20, 24]
     permissions:
       contents: read
@@ -71,7 +71,7 @@ jobs:
         run: npm test
 
       - name: Lint
-        if: always() && matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-2025'
         run: npm run lint-ci
 
       - name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
         # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
         # rather than the event. The same results are uploaded by the `pull_request` run and again
         # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -93,7 +93,7 @@ jobs:
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
 
     concurrency:
@@ -126,10 +126,15 @@ jobs:
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
 
+      - name: Typecheck pr-checks scripts
+        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        working-directory: pr-checks
+        run: npm run typecheck
+
       - name: Run pr-checks tests
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         working-directory: pr-checks
-        run: npx tsx --test
+        run: npm run test
 
       - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}

.github/workflows/prepare-release.yml

@@ -29,7 +29,7 @@ defaults:
 jobs:
   prepare:
     name: "Release info"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.repository == 'github/codeql-action'
 
     permissions:

.github/workflows/python312-windows.yml

@@ -29,10 +29,10 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: windows-latest
+    runs-on: windows-2025
 
     steps:
-    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: 3.12
 

.github/workflows/query-filters.yml

@@ -25,7 +25,7 @@ jobs:
     name: Query Filters Tests
     if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:

.github/workflows/rebuild.yml

@@ -12,7 +12,7 @@ defaults:
 jobs:
   rebuild:
     name: Rebuild Action
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
     env:
@@ -33,7 +33,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Remove label
         if: github.event_name == 'pull_request'

.github/workflows/rollback-release.yml

@@ -34,7 +34,7 @@ jobs:
   rollback:
     name: "Create rollback release"
     if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
 
     # Don't set the deployment environment for test runs

.github/workflows/test-codeql-bundle-all.yml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: nightly-latest
     name: 'CodeQL Bundle All'
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/update-bundle.yml

@@ -20,7 +20,7 @@ defaults:
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests

.github/workflows/update-release-branch.yml

@@ -26,7 +26,7 @@ jobs:
   update:
     name: "Update release branch"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event_name == 'workflow_dispatch'
     needs: [prepare]
     env:
@@ -79,7 +79,7 @@ jobs:
   backport:
     name: "Create backport"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     needs: [prepare]
     if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}

CHANGELOG.md

@@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-No user facing changes.
+- Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)
 
 ## 4.39.1 - 21 Oct 2026
 

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.3",
-  "cliVersion": "2.27.3",
-  "priorBundleVersion": "codeql-bundle-v2.27.2",
-  "priorCliVersion": "2.27.2"
+  "bundleVersion": "codeql-bundle-v2.27.4",
+  "cliVersion": "2.27.4",
+  "priorBundleVersion": "codeql-bundle-v2.27.3",
+  "priorCliVersion": "2.27.3"
 }

package-lock.json

@@ -50,14 +50,14 @@
         "@types/node-forge": "^1.3.14",
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.8.0",
-        "@types/sinon": "^22.0.0",
+        "@types/sinon": "^22.0.1",
         "ava": "^6.4.1",
         "esbuild": "^0.28.2",
         "eslint": "^9.39.5",
         "eslint-import-resolver-typescript": "^4.4.5",
         "eslint-plugin-github": "^6.1.2",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.3.15",
+        "eslint-plugin-jsdoc": "^65.4.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^13.0.6",
         "globals": "^17.13.0",
@@ -67,14 +67,6 @@
         "typescript-eslint": "^8.72.0"
       }
     },
-    "node_modules/@aashutoshrathi/word-wrap": {
-      "version": "1.2.6",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/@actions/artifact": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-5.0.3.tgz",
@@ -958,18 +950,89 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@es-joy/escodegen": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/escodegen/-/escodegen-4.2.0.tgz",
+      "integrity": "sha512-jWqqS3StW6vGwJeT8yu6alS4nipOBi3kD/pR63+9hG2NfGafCJ4viDME15mVf+fyupyptcUJDXfv63gFF5Gzfg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@es-joy/estraverse": "^7.1.1",
+        "@es-joy/jsdoccomment": "^0.62.0",
+        "esprima": "^4.0.1",
+        "esutils": "^2.0.3",
+        "optionator": "^0.9.4"
+      },
+      "bin": {
+        "escodegen": "bin/escodegen.js",
+        "esgenerate": "bin/esgenerate.js"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "optionalDependencies": {
+        "source-map": "~0.7.6"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/@es-joy/jsdoccomment": {
+      "version": "0.62.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.62.0.tgz",
+      "integrity": "sha512-yWi6sm7INEwnfS7IJvE0dU+RTrwzLPFcY7e7eGpu/l5Q9lWfQ2ROwZ0qVnc242jw2TUPsfHX3XMIISkGBv57RQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.8",
+        "@typescript-eslint/types": "^8.44.1",
+        "comment-parser": "1.4.1",
+        "esquery": "^1.6.0",
+        "jsdoc-type-pratt-parser": "~5.9.0"
+      },
+      "engines": {
+        "node": ">=20.11.0"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/comment-parser": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.1.tgz",
+      "integrity": "sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/@es-joy/escodegen/node_modules/jsdoc-type-pratt-parser": {
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-5.9.2.tgz",
+      "integrity": "sha512-TYzkACp/wPvDJLRY7qpHXtrhgwoAaojIOnLaaVNi+AbPU2u1kkjfKd9hXXTq0qSAGsyYXvwUXt99h9I5iCmjjw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/@es-joy/estraverse": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/@es-joy/estraverse/-/estraverse-7.1.1.tgz",
+      "integrity": "sha512-h2d737iS0LFAqypZOmXizu54qAbHofI/RpD30Zom03O6BCXKHuFevWKPcGarZbGq82h7qSBb5G6kLdhTMO+caw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.98.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.98.0.tgz",
-      "integrity": "sha512-QS+b7I2aaSM+gZfDz1b9E4B367JJ2qTjFXRKF289iKkh9sYdZ21Q5MiF/Duzouy3J0C4VhM3I/8f2F4+zT8gYQ==",
+      "version": "0.100.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.100.0.tgz",
+      "integrity": "sha512-QuIT5kMg3XWN22Wa1rcXmR/GkfSg6Ygs/ikMiHihdSpu+o3O59LygkFV9srKa5xHplBFwNd5ZCo3bywL4k7qMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.70.0",
+        "@typescript-eslint/types": "^8.72.0",
         "comment-parser": "1.4.9",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~9.2.2"
+        "jsdoc-type-pratt-parser": "~9.3.0"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
@@ -2681,20 +2744,15 @@
       "license": "MIT"
     },
     "node_modules/@types/sinon": {
-      "version": "22.0.0",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.0.tgz",
-      "integrity": "sha512-TDbVpbccc2HfiqHR09Argj3mHV1KMW7sCCKj52fsl8lbRLkEn7fB1966EWhOKWUBcqfBueZuPoA7/OK1CKiy3g==",
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.1.tgz",
+      "integrity": "sha512-MThluJXPmpBY+Z5S3565F2z+hjkCXnBrr36j2mitVQ7JUtxA+A+YQhs+0Q6J8jxb0SVJvydO+6NWfj9EBzpiBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/sinonjs__fake-timers": "*"
+        "@sinonjs/fake-timers": "^15.4.0"
       }
     },
-    "node_modules/@types/sinonjs__fake-timers": {
-      "version": "8.1.2",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -5366,15 +5424,16 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.3.15",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.15.tgz",
-      "integrity": "sha512-cpU66X+daaX2X6cndE0grdLAIlodysI3KuUEdrJd6FvQHuuYOOvMRAdy8ToYjyJrsoUv0fXkMclA5RM5kaipMw==",
+      "version": "65.4.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.4.0.tgz",
+      "integrity": "sha512-bRiU6LfCFmLL7GuePKvA6ZIcXLonhZGCg2TgQLmkcExeVdAirQp2Hsf3xeSUTmlKwAAsREVEOLbZYD8F7oA69g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/jsdoccomment": "~0.98.0",
+        "@es-joy/escodegen": "^4.2.0",
+        "@es-joy/jsdoccomment": "~0.100.0",
         "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.70.1",
+        "@typescript-eslint/utils": "^8.72.0",
         "are-docs-informative": "^0.1.1",
         "comment-parser": "1.4.9",
         "debug": "^4.4.3",
@@ -7170,36 +7229,18 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.2.tgz",
-      "integrity": "sha512-eFY7Rlscvv/BpY6UsVsjKwMhu1tJO/F4U/vC9g3yeRy/JqszuO1UP6Vdq+85G+3FP6fEw/sWR8a5ftPFY86csw==",
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.3.0.tgz",
+      "integrity": "sha512-JZ8lKMCZXDlM1jAjAK5tTmtFJtgv6iFQQfjE3Fza6jBRACUueaEXLY17n1u05JO1lcPkNxgP+ddEDtiPsk5ktg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.9",
-        "@types/node": "^26.4.0"
+        "@types/estree": "^1.0.9"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
       }
     },
-    "node_modules/jsdoc-type-pratt-parser/node_modules/@types/node": {
-      "version": "26.6.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
-      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.9.0"
-      }
-    },
-    "node_modules/jsdoc-type-pratt-parser/node_modules/undici-types": {
-      "version": "8.9.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
-      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -8360,16 +8401,18 @@
       }
     },
     "node_modules/optionator": {
-      "version": "0.9.3",
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@aashutoshrathi/word-wrap": "^1.2.3",
         "deep-is": "^0.1.3",
         "fast-levenshtein": "^2.0.6",
         "levn": "^0.4.1",
         "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0"
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -9293,6 +9336,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/source-map": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true,
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -10326,6 +10380,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",

package.json

@@ -13,7 +13,8 @@
     "test": "npm run ava -- src/",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh"
+    "update-pr-checks": "./pr-checks/sync.sh",
+    "typecheck": "tsc --noEmit"
   },
   "license": "MIT",
   "workspaces": [
@@ -58,14 +59,14 @@
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.8.0",
-    "@types/sinon": "^22.0.0",
+    "@types/sinon": "^22.0.1",
     "ava": "^6.4.1",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.3.15",
+    "eslint-plugin-jsdoc": "^65.4.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
     "globals": "^17.13.0",

pr-checks/checks/all-platform-bundle.yml

@@ -3,7 +3,7 @@ description: "Tests using an all-platform CodeQL Bundle"
 operatingSystems:
   - ubuntu
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
   - windows
 versions:
   - nightly-latest

pr-checks/checks/multi-language-autodetect.yml

@@ -3,7 +3,7 @@ description: "An end-to-end integration test of a multi-language repository usin
 operatingSystems:
   - ubuntu
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
   # Older CodeQL CLI versions only support Swift up to 6.1, which requires Xcode 16. That is
   # not available on macOS 26, so run these versions on macOS 15 where we select Xcode 16
   # below. See https://github.com/actions/runner-images/issues/14167.
@@ -23,7 +23,7 @@ steps:
     # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
     # See https://github.com/github/codeql-action/pull/3212
     if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-    uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
     with:
       python-version: "3.13.15"
 

pr-checks/checks/per-language-bundle-validation.yml

@@ -3,41 +3,41 @@ description: Validates extraction and analysis using each per-language CodeQL bu
 matrix:
   include:
     - language: actions
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       # Actions also needs the JavaScript extractor.
       expected-extractors: actions javascript
     - language: cpp
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: manual
       build-command: gcc -o main main.c
     - language: csharp
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: none
     - language: go
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: autobuild
     - language: java
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: none
     - language: javascript
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: python
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: ruby
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: rust
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: swift
-      os: macos-latest-xlarge
+      os: macos-26-xlarge
       version: linked
       build-mode: autobuild
 installNode: true

pr-checks/checks/swift-autobuild.yml

@@ -4,7 +4,7 @@ versions:
   - nightly-latest
 operatingSystems:
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
 steps:
   - uses: ./../action/init
     id: init

pr-checks/checks/swift-custom-build.yml

@@ -6,7 +6,7 @@ versions:
   - nightly-latest
 operatingSystems:
   - os: macos
-    runner-image: macos-latest-xlarge
+    runner-image: macos-26-xlarge
 installGo: true
 installDotNet: true
 env:

pr-checks/checks/unsupported-macos.yml

@@ -0,0 +1,67 @@
+name: "Unsupported macOS"
+description: "Tests that unsupported macOS versions are detected and result in appropriate diagnostics."
+versions:
+  - linked
+  - nightly-latest
+installNode: true
+
+operatingSystems:
+  - os: macos
+    runner-image: xcode-27
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  - name: Check xcode_select_link
+    run: |
+      readlink /private/var/db/xcode_select_link
+      file -h /private/var/db/xcode_select_link
+
+  - uses: ./../action/init
+    id: init
+    continue-on-error: true
+    env:
+      CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+      CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+    # can't cope with that unless we introduce a different testing environment. Since this step
+    # would just fail on `xcode-27` anyway, we just skip it instead.
+    if: false
+    uses: ./analyze
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+validationJobs:
+  unsupported-macos-sarif-checks:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts

pr-checks/package.json

@@ -2,6 +2,11 @@
   "private": true,
   "description": "Dependencies for codeql-action scripts",
   "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "npx tsx --test",
+    "checks": "npm run typecheck && npm run test"
+  },
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@actions/github": "^8.0.1",

pr-checks/sync.ts

@@ -43,6 +43,13 @@ type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;
 /** An operating system identifier. */
 type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows";
 
+/** Mapping from {@link OperatingSystemIdentifier} to default runner image labels. */
+const DEFAULT_RUNNER_IMAGES: Record<OperatingSystemIdentifier, string> = {
+  ubuntu: "ubuntu-26.04",
+  macos: "macos-26",
+  windows: "windows-2025",
+};
+
 /**
  * Represents an operating system matrix entry for a generated PR check workflow.
  *
@@ -296,8 +303,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Python",
         uses: pinnedUses(
           "actions/setup-python",
-          "5fda3b95a4ea91299a34e894583c3862153e4b97",
-          "v7.0.0",
+          "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0",
+          "v7.1.0",
         ),
         with: {
           "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`,
@@ -414,12 +421,6 @@ function generateJobMatrix(
       );
     }
 
-    const defaultRunnerImages = [
-      "ubuntu-latest",
-      "macos-latest",
-      "windows-latest",
-    ];
-
     for (const operatingSystemConfig of operatingSystems) {
       const operatingSystem =
         typeof operatingSystemConfig === "string"
@@ -449,7 +450,7 @@ function generateJobMatrix(
       const runnerImagesForOs =
         typeof operatingSystemConfig === "string" ||
         operatingSystemConfig["runner-image"] === undefined
-          ? defaultRunnerImages.filter((image) =>
+          ? Object.values(DEFAULT_RUNNER_IMAGES).filter((image) =>
               image.startsWith(operatingSystem),
             )
           : [operatingSystemConfig["runner-image"]];
@@ -462,7 +463,7 @@ function generateJobMatrix(
         // is removed from `defaultTestVersions`.
         const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
         if (
-          runnerImage === "ubuntu-latest" &&
+          runnerImage === DEFAULT_RUNNER_IMAGES["ubuntu"] &&
           version === requiresOlderRunnerImage
         ) {
           matrix.push({ os: "ubuntu-24.04", version });
@@ -666,16 +667,18 @@ function generateValidationJob(
   // Add the generated steps in front of the ones from the specification.
   specSteps.items.unshift(...checkoutStep, ...steps);
 
+  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if: baseCondition,
     needs: [checkName],
     permissions: {
       contents: "read",
       "security-events": "read",
     },
     "timeout-minutes": 5,
-    "runs-on": "ubuntu-latest",
+    "runs-on": DEFAULT_RUNNER_IMAGES["ubuntu"],
     steps: specSteps,
   };
 

pr-checks/tsconfig.json

@@ -9,5 +9,12 @@
     "noEmit": true
   },
   "include": ["./**/*.ts", "../src/**/*.ts"],
-  "exclude": ["node_modules"]
+  "exclude": [
+    "node_modules",
+    "../src/testdata/**",
+    "../src/**/*.test.ts",
+    "../src/testing-utils.ts",
+    "../src/json/testing-util.ts",
+    "../src/feature-flags/testing-util.ts"
+  ]
 }

src/action-common.ts

@@ -1,3 +1,5 @@
+import * as os from "os";
+
 import * as core from "@actions/core";
 
 import { ActionsEnv, getActionsEnv } from "./actions-util";
@@ -13,6 +15,8 @@ import {
 } from "./status-report";
 import { getEnv, getErrorMessage, wrapError } from "./util";
 
+export type { Logger } from "./logging";
+
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
   /** The name of the Action. */
@@ -23,6 +27,8 @@ export interface BaseState {
   platform: NodeJS.Platform;
   /** The architecture of the host. */
   arch: NodeJS.Architecture;
+  /** The version of the operating system. */
+  osRelease: string;
 }
 
 /** Describes different state features that an Action may have. */
@@ -173,6 +179,7 @@ export async function runInActions(action: Action) {
       startedAt,
       platform: process.platform,
       arch: process.arch,
+      osRelease: os.release(),
       logger,
       env,
       actions: actionsEnv,

src/actions-util.test.ts

@@ -11,8 +11,8 @@ import {
 } from "./actions-util";
 import { computeAutomationID } from "./api-client";
 import { EnvVar } from "./environment";
-import { RecordingLogger, setupTests } from "./testing-utils";
-import { initializeEnvironment, withTmpDir } from "./util";
+import { getTestEnv, RecordingLogger, setupTests } from "./testing-utils";
+import { withTmpDir } from "./util";
 
 setupTests(test);
 
@@ -227,8 +227,9 @@ test.serial(
 );
 
 test.serial("initializeEnvironment", (t) => {
-  initializeEnvironment("1.2.3");
-  t.deepEqual(process.env[EnvVar.VERSION], "1.2.3");
+  const env = getTestEnv();
+  env.initialise("1.2.3");
+  t.deepEqual(env.getOptional(EnvVar.VERSION), "1.2.3");
 });
 
 test.serial("fixCodeQualityCategory", (t) => {

src/actions-util.ts

@@ -364,7 +364,7 @@ const MAX_STDERR_BUFFER_SIZE = 20000;
  * @throws A {@link CommandInvocationError} if the tool exits with a non-zero status code.
  */
 export async function runTool(
-  env: Env,
+  env: ReadOnlyEnv,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},

src/analyze-action.ts

@@ -233,7 +233,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
   let databaseUploadResults: DatabaseUploadResult[] = [];
 
   try {
-    util.initializeEnvironment(actionsUtil.getActionVersion());
+    action.env.initialise(actionsUtil.getActionVersion());
 
     // Make inputs accessible in the `post` step, details at
     // https://github.com/github/codeql-action/issues/2553

src/api-client.test.ts

@@ -7,7 +7,7 @@ import { ProxyAgent } from "undici";
 import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
 import { DO_NOT_RETRY_STATUSES } from "./api-client";
-import { ActionsEnvVars, RegistryProxyVars } from "./environment";
+import { ActionsEnvVars, RegistryProxyVars, getEnv } from "./environment";
 import { GITHUB_DOTCOM_API_URL, GITHUB_DOTCOM_URL } from "./github";
 import {
   callee,
@@ -21,7 +21,7 @@ import * as util from "./util";
 setupTests(test);
 
 test.beforeEach(() => {
-  util.initializeEnvironment(actionsUtil.getActionVersion());
+  getEnv().initialise(actionsUtil.getActionVersion());
 });
 
 test.serial("getApiClient", async (t) => {

src/autobuild-action.ts

@@ -10,7 +10,7 @@ import { getGitHubVersion } from "./api-client";
 import { determineAutobuildLanguages, runAutobuild } from "./autobuild";
 import { getCodeQL } from "./codeql";
 import { Config, getConfig } from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, type Env } from "./environment";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 import {
@@ -26,7 +26,6 @@ import {
   checkDiskUsage,
   checkGitHubVersionInRange,
   ConfigurationError,
-  initializeEnvironment,
   wrapError,
 } from "./util";
 
@@ -38,6 +37,7 @@ interface AutobuildStatusReport extends StatusReportBase {
 }
 
 async function sendCompletedStatusReport(
+  env: Env,
   config: Config | undefined,
   logger: Logger,
   startedAt: Date,
@@ -45,7 +45,7 @@ async function sendCompletedStatusReport(
   failingLanguage?: string,
   cause?: Error,
 ) {
-  initializeEnvironment(getActionVersion());
+  env.initialise(getActionVersion());
 
   const status = getActionsStatus(cause, failingLanguage);
   const statusReportBase = await createStatusReportBase(
@@ -129,6 +129,7 @@ async function run({
       `We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. ${error.message}`,
     );
     await sendCompletedStatusReport(
+      env,
       config,
       logger,
       startedAt,
@@ -141,7 +142,13 @@ async function run({
 
   env.export(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
 
-  await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
+  await sendCompletedStatusReport(
+    env,
+    config,
+    logger,
+    startedAt,
+    languages ?? [],
+  );
 }
 
 /** Defines the `autobuild` Action. */

src/codeql.test.ts

@@ -21,6 +21,7 @@ import {
 import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
+import { getEnv } from "./environment";
 import { BuiltInLanguage } from "./languages";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -38,14 +39,13 @@ import {
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
-import { initializeEnvironment } from "./util";
 
 setupTests(test);
 
 let stubConfig: Config;
 
 test.beforeEach(() => {
-  initializeEnvironment("1.2.3");
+  getEnv().initialise("1.2.3");
 
   stubConfig = createTestConfig({
     languages: [BuiltInLanguage.cpp],

src/codeql.ts

@@ -4,6 +4,7 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as yaml from "js-yaml";
+import * as semver from "semver";
 
 import {
   CommandInvocationError,
@@ -19,6 +20,7 @@ import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
 import { EnvVar, getEnv, Env, ReadOnlyEnv } from "./environment";
+import { getErrorMessage, isDiskConfigurationError } from "./errors";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -34,7 +36,9 @@ import { ToolsDownloadStatusReport } from "./tools-download";
 import { ToolsFeature, isSupportedToolsFeature } from "./tools-features";
 import { shouldEnableIndirectTracing } from "./tracer-config";
 import * as util from "./util";
-import { BuildMode, CleanupLevel, getErrorMessage } from "./util";
+import { BuildMode, CleanupLevel } from "./util";
+
+export { isDiskConfigurationError } from "./errors";
 
 type Options = Array<string | number | boolean>;
 
@@ -70,6 +74,11 @@ export interface CodeQL {
    * Get a string containing the semver version of the CodeQL executable.
    */
   getVersion(): Promise<VersionInfo>;
+  /**
+   * Determines whether the CLI installation represented by this {@link CodeQL} instance
+   * has at least the {@link requiredVersion}.
+   */
+  isVersionAtLeast(requiredVersion: string): Promise<boolean>;
   /**
    * Print version information about CodeQL.
    */
@@ -275,26 +284,6 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 
-/**
- * Decides whether `e` is a disk-related error outside of our control
- * that should be classified as a `ConfigurationError`.
- *
- * @param e The error to check.
- * @returns True if the error should be treated as a `ConfigurationError` or false if not.
- */
-export function isDiskConfigurationError(e: unknown): boolean {
-  if (!(e instanceof Error)) {
-    return false;
-  }
-
-  return (
-    // out of disk space
-    e.message.includes("ENOSPC") ||
-    // access denied
-    e.message.includes("EACCES")
-  );
-}
-
 /**
  * Set up CodeQL CLI access.
  *
@@ -403,9 +392,9 @@ export function setCodeQL(codeql: Partial<CodeQL>): void {
   cachedCodeQL = createStubCodeQL(codeql);
 }
 
-function resolveFunction<T>(
+function resolveFunction<K extends keyof CodeQL, T extends CodeQL[K]>(
   partialCodeql: Partial<CodeQL>,
-  methodName: string,
+  methodName: K,
   defaultImplementation?: T,
 ): T {
   if (typeof partialCodeql[methodName] !== "function") {
@@ -415,7 +404,7 @@ function resolveFunction<T>(
     const dummyMethod = () => {
       throw new Error(`CodeQL ${methodName} method not correctly defined`);
     };
-    return dummyMethod as T;
+    return dummyMethod as unknown as T;
   }
   return partialCodeql[methodName] as T;
 }
@@ -432,6 +421,19 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
     getVersion: resolveFunction(partialCodeql, "getVersion", async () => ({
       version: "1.0.0",
     })),
+    isVersionAtLeast: resolveFunction(
+      partialCodeql,
+      "isVersionAtLeast",
+      async (requiredVersion) => {
+        return (
+          !!partialCodeql.getVersion &&
+          semver.gte(
+            (await partialCodeql.getVersion()).version,
+            requiredVersion,
+          )
+        );
+      },
+    ),
     printVersion: resolveFunction(partialCodeql, "printVersion"),
     supportsFeature: resolveFunction(
       partialCodeql,
@@ -525,6 +527,9 @@ export async function getCodeQLForCmd(
       }
       return result;
     },
+    async isVersionAtLeast(requiredVersion: string) {
+      return semver.gte((await this.getVersion()).version, requiredVersion);
+    },
     async printVersion() {
       // Reuse the cached version information rather than invoking the CLI again.
       core.info(JSON.stringify(await this.getVersion(), null, 2));
@@ -1062,7 +1067,7 @@ export async function getCodeQLForCmd(
   // CodeQL object is created.
   if (
     checkVersion &&
-    !(await util.codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION))
+    !(await codeql.isVersionAtLeast(CODEQL_MINIMUM_VERSION))
   ) {
     throw new util.ConfigurationError(
       `Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${
@@ -1072,7 +1077,7 @@ export async function getCodeQLForCmd(
   } else if (
     checkVersion &&
     env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
-    !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
+    !(await codeql.isVersionAtLeast(CODEQL_NEXT_MINIMUM_VERSION))
   ) {
     const result = await codeql.getVersion();
     core.warning(
@@ -1166,7 +1171,7 @@ export function getExtraOptions(
 }
 
 async function runCli(
-  env: Env,
+  env: ReadOnlyEnv,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
@@ -1193,7 +1198,7 @@ async function runCli(
  * @returns The parsed JSON output from the command.
  */
 async function runCliJson<T>(
-  env: Env,
+  env: ReadOnlyEnv,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},

src/config-utils.ts

@@ -82,7 +82,6 @@ import {
   GitHubVersion,
   ConfigurationError,
   BuildMode,
-  codeQlVersionAtLeast,
   cloneObject,
   isDefined,
   checkDiskUsage,
@@ -654,10 +653,7 @@ async function runnerHasSufficientMemory(
   logger: Logger,
 ): Promise<boolean> {
   if (
-    await codeQlVersionAtLeast(
-      codeql,
-      CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE,
-    )
+    await codeql.isVersionAtLeast(CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE)
   ) {
     logger.debug(
       `Skipping memory check for overlay analysis because CodeQL version is at least ${CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE}.`,
@@ -901,7 +897,7 @@ async function validateOverlayDatabaseMode(
     );
     return new Failure(OverlayDisabledReason.IncompatibleBuildMode);
   }
-  if (!(await codeQlVersionAtLeast(codeql, CODEQL_OVERLAY_MINIMUM_VERSION))) {
+  if (!(await codeql.isVersionAtLeast(CODEQL_OVERLAY_MINIMUM_VERSION))) {
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because ` +
         `the CodeQL CLI is older than ${CODEQL_OVERLAY_MINIMUM_VERSION}. ` +

src/database-upload.test.ts

@@ -15,6 +15,7 @@ import {
   cleanupAndUploadDatabases,
   uploadBundledDatabase,
 } from "./database-upload";
+import { getEnv } from "./environment";
 import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
@@ -31,18 +32,12 @@ import {
   setupActionsVars,
   setupTests,
 } from "./testing-utils";
-import {
-  CleanupLevel,
-  GitHubVariant,
-  HTTPError,
-  initializeEnvironment,
-  withTmpDir,
-} from "./util";
+import { CleanupLevel, GitHubVariant, HTTPError, withTmpDir } from "./util";
 
 setupTests(test);
 
 test.beforeEach(() => {
-  initializeEnvironment("1.2.3");
+  getEnv().initialise("1.2.3");
 });
 
 const testRepoName: RepositoryNwo = { owner: "github", repo: "example" };

src/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.3",
-  "cliVersion": "2.27.3",
-  "priorBundleVersion": "codeql-bundle-v2.27.2",
-  "priorCliVersion": "2.27.2"
+  "bundleVersion": "codeql-bundle-v2.27.4",
+  "cliVersion": "2.27.4",
+  "priorBundleVersion": "codeql-bundle-v2.27.3",
+  "priorCliVersion": "2.27.3"
 }

src/doc-url.ts

@@ -12,4 +12,6 @@ export enum DocUrl {
   SPECIFY_BUILD_STEPS_MANUALLY = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually",
   SYSTEM_REQUIREMENTS = "https://codeql.github.com/docs/codeql-overview/system-requirements/",
   TRACK_CODE_SCANNING_ALERTS_ACROSS_RUNS = "https://docs.github.com/en/code-security/reference/code-scanning/sarif-support-for-code-scanning#data-for-preventing-duplicated-alerts",
+  /** Blog post about traced analysis being unsupported on macOS 27 and with Xcode 27. */
+  UNSUPPORTED_TRACED_ANALYSIS_MACOS27 = "https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/",
 }

src/environment.ts

@@ -397,6 +397,18 @@ export class Env extends ReadOnlyEnv {
     }
   }
 
+  /**
+   * Set some initial environment variables that we can set even without
+   * knowing what version of CodeQL we're running.
+   */
+  public initialise(version: string) {
+    this.export(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
+    this.export(EnvVar.FEATURE_SANDWICH, "false");
+    this.export(EnvVar.FEATURE_SARIF_COMBINE, "true");
+    this.export(EnvVar.FEATURE_WILL_UPLOAD, "true");
+    this.export(EnvVar.VERSION, version);
+  }
+
   /** Gets a value indicating whether `set` was called at least once. */
   public hasChanged(): boolean {
     return this.changed;

src/errors/index.ts

@@ -0,0 +1,88 @@
+import * as json from "../json";
+
+/**
+ * If {@link error} is not already an instance of {@link Error}, then this function constructs
+ * an {@link Error} with a string representation of {@link error} as the message.
+ */
+export function wrapError(error: unknown): Error {
+  return error instanceof Error ? error : new Error(String(error));
+}
+
+/**
+ * Returns an appropriate message for the error.
+ *
+ * If the error is an {@link Error} instance, this returns the error message without
+ * an `Error: ` prefix.
+ */
+export function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * Approximates whether {@link error} is like a {@link NodeJS.ErrnoException}.
+ * We only typically care about the `code` property, so that's what we check for here.
+ */
+export function isErrnoException(
+  error: unknown,
+): error is NodeJS.ErrnoException {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    typeof error.code === "string"
+  );
+}
+
+/**
+ * Decides whether `e` is a disk-related error outside of our control
+ * that should be classified as a `ConfigurationError`.
+ *
+ * @param e The error to check.
+ * @returns True if the error should be treated as a `ConfigurationError` or false if not.
+ */
+export function isDiskConfigurationError(e: unknown): boolean {
+  if (!(e instanceof Error)) {
+    return false;
+  }
+
+  return (
+    // out of disk space
+    e.message.includes("ENOSPC") ||
+    // access denied
+    e.message.includes("EACCES")
+  );
+}
+
+/**
+ * An Error class that indicates an error that occurred due to
+ * a misconfiguration of the action or the CodeQL CLI.
+ */
+export class ConfigurationError extends Error {}
+
+/** Minimal representation of errors resulting from HTTP requests. */
+export class HTTPError extends Error {
+  public status: number;
+
+  constructor(message: string, status: number) {
+    super(message);
+    this.status = status;
+  }
+}
+
+/**
+ * Tries to convert {@link arg} to a {@link HTTPError}, but returns `undefined` if
+ * {@link arg} is not like a {@link HTTPError}.
+ */
+export function asHTTPError(arg: any): HTTPError | undefined {
+  if (!json.isObject<any>(arg) || !json.isString(arg.message)) {
+    return undefined;
+  }
+  if (Number.isInteger(arg.status)) {
+    return new HTTPError(arg.message, arg.status as number);
+  }
+  // See https://github.com/actions/toolkit/blob/acb230b99a46ed33a3f04a758cd68b47b9a82908/packages/tool-cache/src/tool-cache.ts#L19
+  if (Number.isInteger(arg.httpStatusCode)) {
+    return new HTTPError(arg.message, arg.httpStatusCode as number);
+  }
+  return undefined;
+}

src/feature-flags.test.ts

@@ -4,6 +4,7 @@ import * as path from "path";
 import test from "ava";
 
 import * as defaults from "./defaults.json";
+import { getEnv } from "./environment";
 import {
   Feature,
   featureConfig,
@@ -26,12 +27,12 @@ import {
   setupTests,
   stubFeatureFlagApiEndpoint,
 } from "./testing-utils";
-import { GitHubVariant, initializeEnvironment, withTmpDir } from "./util";
+import { GitHubVariant, withTmpDir } from "./util";
 
 setupTests(test);
 
 test.beforeEach(() => {
-  initializeEnvironment("1.2.3");
+  getEnv().initialise("1.2.3");
 });
 
 test.serial(