Merge pull request #4058 from github/backport-v3.37.4-f205ea1c3

Merge releases/v4 into releases/v3

.github/actions/check-sarif/action.yml

@@ -16,5 +16,5 @@ inputs:
       Comma separated list of query ids that should NOT be included in this SARIF file.
 
 runs:
-  using: node24
+  using: node20
   main: index.js

.github/actions/prepare-mergeback-branch/action.yml

@@ -92,7 +92,8 @@ runs:
           Please do the following:
 
           - [ ] Approve running the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".
+          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
+                selected rather than "Squash and merge" or "Rebase and merge".
         EOF
         )
 

.github/actions/verify-debug-artifact-scan-completed/action.yml

@@ -1,6 +1,6 @@
 name: Verify that the best-effort debug artifact scan completed
 description: Verifies that the best-effort debug artifact scan completed successfully during tests
 runs:
-  using: node24
+  using: node20
   main: index.js
   post: post.js

.github/copilot-instructions.md

@@ -1,33 +1,14 @@
 # CodeQL Action - Copilot Instructions
 
-The CodeQL Action is used in GitHub Actions workflows to run CodeQL scans using the CodeQL CLI.
-
-## Overview
-
-- The repository contains two TypeScript projects.
-- The main TypeScript codebase is in the `src` directory, with accompanying unit tests in `.test.ts` files in the same directory.
-- The main codebase is compiled to bundled JavaScript code, which is also contained in the repository in the `lib` directory.
-- A secondary TypeScript codebase with scripts that are only used for development purposes or by CI is in the `pr-checks` directory. This codebase is not compiled to bundled JavaScript. It is executed directly with `tsx`, which handles compilation internally.
-
-## Review instructions
-
-- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Word your comments constructively as suggestions for improvements. Do not word suggestions as commands.
-- If you want to comment on a change that you believe will fail a CI check, do not present the CI failure you expect as a fact. Instead, write that you think a change "may" lead to a failure in CI. Suggest that, if such a failure manifests, the changes you are commenting on may be the place responsible for the failure and are worth looking at.
-- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one.
-- If a change is a net improvement, for example because it improves on an existing limitation of existing code, do not complain about pre-existing problems that remain. You may comment on them, but you should make it clear that the thing you are commenting on is not new by writing e.g. "Not new in this PR, but [..]" followed by your description of the issue and a suggestion that it could be improved at the same time with e.g. "Consider whether this is worth addressing as part of this PR as well."
-
 ## Generated code
 
-The main codebase of the CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from. The secondary TypeScript codebase has sources in the `pr-checks` directory, which are executed directly with `tsx` and not compiled to JavaScript in the `lib` folder.
+The CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from.
 
 GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that start with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.
 
 ## Release process
 
-Changes that are merged to the `main` branch are not used in production straight away. Instead, changes from `main` must first be released using the release process, which has to be manually triggered by a staff member. Therefore, it is possible for further changes to be made to the code after some changes have been merged to `main` but before they are released. Once the release process automation is started, a series of PRs are automatically generated:
-
 - A release-PR is a PR which matches all of the following patterns:
-
   - PR title starts with the exact prefix: `Merge main into releases/v`
     - Equivalent regex: `^Merge main into releases\/v`
   - AND head (source) branch matches the update-branch pattern:
@@ -36,5 +17,5 @@ Changes that are merged to the `main` branch are not used in production straight
     - Regex: `^releases\/v` (e.g. `releases/v3`)
 
 - Consider all files in release-PRs to have already been reviewed and do not review them, except for the following two files:
-  - `CHANGELOG.md`
-  - `package.json`
+    - `CHANGELOG.md`
+    - `package.json`

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+      exclude:
+        - "@actions/*"
     labels:
       - Rebuild
     # Ignore incompatible dependency updates
@@ -31,6 +33,8 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+      exclude:
+        - "actions/*"
     labels:
       - Rebuild
     groups:

.github/instructions/release-merge.instructions.md

@@ -1,16 +0,0 @@
----
-applyTo: "CHANGELOG.md,src/defaults.json,lib/defaults.json,src/api-compatibility.json"
----
-
-# Merging release, mergeback, and backport PRs
-
-The release process creates a cascade of PRs (`main` → `releases/vN`, then
-`releases/vN` → `main` mergeback, then `releases/vN` → `releases/v(N-1)`
-backport). These PRs reliably touch `CHANGELOG.md`, `src/defaults.json` /
-`lib/defaults.json` (bundle/CLI version bump), and `src/api-compatibility.json`.
-
-Such PRs **must be merged with a merge commit**. Never squash or rebase, as
-that breaks the branch linkage the release automation relies on.
-
-When arming auto-merge on these PRs, use `--merge` (e.g. `gh pr merge --merge`),
-not `--squash` or `--rebase`.

.github/workflows/__all-platform-bundle.yml

@@ -56,7 +56,7 @@ jobs:
         include:
           - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-latest
             version: nightly-latest
           - os: windows-latest
             version: nightly-latest

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__build-mode-autobuild.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__bundle-toolcache.yml

@@ -80,8 +80,7 @@ jobs:
       - id: init
         uses: ./../action/init
         with:
-          # Request multiple languages so this check uses the combined bundle.
-          languages: javascript,python
+          languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:

.github/workflows/__config-input.yml

@@ -51,8 +51,6 @@ jobs:
         with:
           node-version: 20.x
           cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test

.github/workflows/__export-file-baseline-information.yml

@@ -124,5 +124,4 @@ jobs:
     env:
       CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
       CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__job-run-uuid-sarif.yml

@@ -71,8 +71,8 @@ jobs:
         run: |
           cd "$RUNNER_TEMP/results"
           actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
-          if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then
-            echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'."
+          if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
+            echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
             exit 1
           else
             echo "Found job run UUID '$actual'."

.github/workflows/__linux-arm64.yml

@@ -1,106 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Linux Arm64
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-  workflow_call:
-    inputs:
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
-jobs:
-  linux-arm64:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-24.04-arm
-            version: nightly-latest
-    name: Linux Arm64
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - uses: ./../action/init
-        with:
-          languages: ${{ env.LANGUAGES }}
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
-        with:
-          upload-database: false
-      - name: Assert databases exist
-        run: |
-          cd "$RUNNER_TEMP/codeql_databases"
-          for lang in ${LANGUAGES//,/ }; do
-            if [[ ! -d "$lang" ]]; then
-              echo "Did not find a database for $lang"
-              exit 1
-            fi
-            echo "Found database for $lang"
-          done
-    env:
-      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__multi-language-autodetect.yml

@@ -191,6 +191,5 @@ jobs:
             exit 1
           fi
     env:
-      CODEQL_ACTION_CLEANUP_TOOLCACHE_BUNDLES: true
       CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -84,8 +84,6 @@ jobs:
         with:
           node-version: 20.x
           cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test

.github/workflows/__packaging-config-inputs-js.yml

@@ -84,8 +84,6 @@ jobs:
         with:
           node-version: 20.x
           cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test

.github/workflows/__packaging-config-js.yml

@@ -84,8 +84,6 @@ jobs:
         with:
           node-version: 20.x
           cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test

.github/workflows/__packaging-inputs-js.yml

@@ -84,8 +84,6 @@ jobs:
         with:
           node-version: 20.x
           cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test

.github/workflows/__per-language-bundle-validation.yml

@@ -1,164 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Per-language bundles
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}
-jobs:
-  per-language-bundle-validation:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            os: ubuntu-latest
-            version: nightly-latest
-            expected-extractors: actions javascript
-          - language: cpp
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: manual
-            build-command: gcc -o main main.c
-          - language: csharp
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: none
-          - language: go
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: autobuild
-          - language: java
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: none
-          - language: javascript
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: python
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: ruby
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: rust
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: swift
-            os: macos-latest-xlarge
-            version: nightly-latest
-            build-mode: autobuild
-    name: Per-language bundles
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - uses: ./../action/init
-        id: init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix['build-mode'] }}
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - name: Check that the bundle contains only the expected extractors
-        env:
-          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-          LANGUAGE: ${{ matrix.language }}
-          EXPECTED_EXTRACTORS: ${{ matrix['expected-extractors'] || matrix.language }}
-        run: |
-          extractors="$("$CODEQL_PATH" resolve languages --format=json | jq -r 'keys[]')"
-          echo "Extractors in the bundle:"
-          echo "$extractors"
-          echo "Expected: $EXPECTED_EXTRACTORS"
-
-          for expected in $EXPECTED_EXTRACTORS; do
-            if ! echo "$extractors" | grep -qx "$expected"; then
-              echo "::error::The ${LANGUAGE} bundle does not contain the ${expected} extractor."
-              exit 1
-            fi
-          done
-
-          # If the bundle contained extractors beyond those the language needs, then it would not
-          # have been trimmed, and this job would be silently validating the combined bundle.
-          for other in actions cpp csharp go java javascript python ruby rust swift; do
-            if echo "$EXPECTED_EXTRACTORS" | grep -qw "$other"; then
-              continue
-            fi
-            if echo "$extractors" | grep -qx "$other"; then
-              echo "::error::The ${LANGUAGE} bundle also contains the ${other} extractor, so it is not trimmed."
-              exit 1
-            fi
-          done
-      - name: Check that the bundle was not added to the toolcache
-        env:
-          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-        run: |
-          # A bundle that is missing most of its extractors must never be left in the toolcache,
-          # where a later job analyzing a different language could pick it up. The runner image
-          # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-          # rather than whether the toolcache contains CodeQL at all.
-          echo "CodeQL is at $CODEQL_PATH"
-          if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
-            echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
-            exit 1
-          fi
-          if [[ "$CODEQL_PATH" != "$RUNNER_TEMP"/* ]]; then
-            echo "::error::Expected the per-language bundle to be extracted under $RUNNER_TEMP, but found it at $CODEQL_PATH."
-            exit 1
-          fi
-      - name: Build code
-        if: matrix['build-command']
-        run: ${{ matrix['build-command'] }}
-      - uses: ./../action/analyze
-        id: analysis
-        with:
-          upload-database: false
-      - name: Check that a database was created for the language
-        env:
-          DB_LOCATIONS: ${{ steps.analysis.outputs.db-locations }}
-          LANGUAGE: ${{ matrix.language }}
-        run: |
-          database="$(echo "$DB_LOCATIONS" | jq -r --arg lang "$LANGUAGE" '.[$lang] // empty')"
-          if [ -z "$database" ] || [ ! -d "$database" ]; then
-            echo "::error::No CodeQL database was created for ${LANGUAGE}."
-            echo "Databases: $DB_LOCATIONS"
-            exit 1
-          fi
-          echo "Created a ${LANGUAGE} database at ${database}."
-    env:
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__rubocop-multi-language.yml

@@ -54,7 +54,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__swift-custom-build.yml

@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest-xlarge
+          - os: macos-latest
             version: linked
-          - os: macos-latest-xlarge
+          - os: macos-latest
             version: default
-          - os: macos-latest-xlarge
+          - os: macos-latest
             version: nightly-latest
     name: Swift analysis using a custom build command
     if: github.triggering_actor != 'dependabot[bot]'

.github/workflows/codescanning-config-cli.yml

@@ -75,8 +75,7 @@ jobs:
       uses: ./../action/.github/actions/check-codescanning-config
       with:
         expected-config-file-contents: "{}"
-        # Request multiple languages so later checks can reuse the combined bundle.
-        languages: javascript,python
+        languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
 
     - name: Packs from input

.github/workflows/pr-checks.yml

@@ -45,13 +45,7 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
-          cache: "npm"
-
-      # Install a new enough version of `npm` to understand `min-release-age`
-      # that is still compatible with Node 20.
-      - name: Install newer npm
-        if: matrix.node-version == 20
-        run: npm install -g npm@11.19.1
+          cache: 'npm'
 
       - name: Install dependencies
         run: |
@@ -73,12 +67,7 @@ jobs:
 
       - name: Upload sarif
         uses: ./upload-sarif
-        # The merge queue deletes its `gh-readonly-queue` ref as soon as the queue entry resolves,
-        # so uploading against it races with that deletion. Both the `merge_group` run and the
-        # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
-        # rather than the event. The same results are uploaded by the `pull_request` run and again
-        # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -101,19 +90,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Check for incorrect addresses in package-lock.json
-        run: |
-          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
-              'package-lock.json'; then
-            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
-            exit 1
-          fi
-
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install dependencies
         id: install-deps
@@ -128,10 +109,6 @@ jobs:
         working-directory: pr-checks
         run: npx tsx --test
 
-      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: npx tsx pr-checks/changenotes.ts validate
-
       - name: Verify all Actions use the same Node version
         id: head-version
         run: |
@@ -181,14 +158,14 @@ jobs:
           path: ${{ runner.temp }}/repo-size/
           if-no-files-found: error
 
-      - name: "Backport: Check out base ref"
+      - name: 'Backport: Check out base ref'
         id: checkout-base
         if: ${{ startsWith(github.head_ref, 'backport-') }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.base_ref }}
 
-      - name: "Backport: Verify Node versions unchanged"
+      - name: 'Backport: Verify Node versions unchanged'
         if: steps.checkout-base.outcome == 'success'
         env:
           HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}

.github/workflows/prepare-release.yml

@@ -28,7 +28,7 @@ defaults:
 
 jobs:
   prepare:
-    name: "Release info"
+    name: "Prepare release"
     runs-on: ubuntu-latest
     if: github.repository == 'github/codeql-action'
 

.github/workflows/rebuild.yml

@@ -54,27 +54,32 @@ jobs:
         run: |
           git fetch origin "$BASE_BRANCH"
 
-          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
-          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
-          if git merge "origin/$BASE_BRANCH"; then
+          # Allow merge conflicts in `lib`, since rebuilding should resolve them.
+          git merge "origin/$BASE_BRANCH"
+          MERGE_RESULT=$?
+
+          if [ "$MERGE_RESULT" -eq 0 ]; then
             echo "Merge succeeded cleanly."
-          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
-            echo "Merge conflicts detected, continuing."
+          elif [ "$MERGE_RESULT" -eq 1 ]; then
+            echo "Merge conflicts detected (exit code $MERGE_RESULT), continuing."
+          else
+            echo "git merge failed with unexpected exit code $MERGE_RESULT."
+            exit 1
+          fi
+
+          if [ "$MERGE_RESULT" -ne 0 ]; then
             echo "merge-in-progress=true" >> $GITHUB_OUTPUT
 
-            # Check for merge conflicts outside of `lib`.
-            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
-            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
+            # Check for merge conflicts outside of `lib`. Disable git diff's trailing whitespace check
+            # since `node_modules/@types/semver/README.md` fails it.
+            if git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/'; then
               echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              echo "$CONFLICTS_OUTSIDE_LIB"
+              git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/' || true
               exit 1
             fi
 
             echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
               "these by rebuilding the Action."
-          else
-            echo "git merge failed for a reason other than merge conflicts."
-            exit 1
           fi
 
       - name: Compile TypeScript

.github/workflows/rollback-release.yml

@@ -10,7 +10,8 @@ on:
         required: true
   # Only for dry-runs of changes to the workflow.
   push:
-    # Don't run dry-run on release branches, since that's unnecessary.
+    # Don't run dry-run on release branches, to avoid an issue where the
+    # "new" tag determined by the "Prepare release" job already exists.
     branches-ignore:
       - releases/v*
     paths:
@@ -23,7 +24,7 @@ defaults:
 
 jobs:
   prepare:
-    name: "Prepare"
+    name: "Prepare release"
     if: github.repository == 'github/codeql-action'
 
     permissions:
@@ -106,10 +107,8 @@ jobs:
           # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
           # but use `v0.0.0` for testing.
           ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          # Use `needs.prepare.outputs.version` for actual runs and `v0.0.1` for testing.
-          RELEASE_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.version, 'v0.0.1') }}
-          # Use `needs.prepare.outputs.major_version` for actual runs and `v0` for testing.
-          MAJOR_VERSION_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.major_version, 'v0') }}
+          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
+          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
         run: |
           git checkout "refs/tags/${ROLLBACK_TAG}"
           git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
@@ -185,3 +184,4 @@ jobs:
           # Setting this to `true` for non-workflow_dispatch events will
           # still push the `branch`, but won't create a corresponding PR
           dry-run: "${{ github.event_name != 'workflow_dispatch' }}"
+

.github/workflows/update-release-branch.yml

@@ -16,15 +16,15 @@ defaults:
     shell: bash
 
 jobs:
+
   prepare:
-    name: "Prepare"
+    name: "Prepare release"
     permissions:
       contents: read
 
     uses: ./.github/workflows/prepare-release.yml
 
   update:
-    name: "Update release branch"
     timeout-minutes: 45
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch'
@@ -77,7 +77,6 @@ jobs:
           --conductor ${GITHUB_ACTOR}
 
   backport:
-    name: "Create backport"
     timeout-minutes: 45
     runs-on: ubuntu-latest
     environment: Automation

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: github/enterprise-releases
-          token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }}
+          token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }}
           path: ${{ github.workspace }}/enterprise-releases/
           sparse-checkout: releases.json
 

.npmrc

@@ -1,2 +1 @@
 lockfile-version=3
-min-release-age=7

.vscode/settings.json

@@ -7,10 +7,6 @@
     // transpiled JavaScript
     "build": true,
     "lib": true,
-
-    // exclude "tests" by default because it causes VSCode to start language-specific extensions
-    // that are not typically needed during development (or indeed may not work correctly)
-    "tests": true
   },
   "search.exclude": {
     "**/node_modules": true,
@@ -22,7 +18,7 @@
   "git.ignoreLimitWarning": true,
   // Use the vendored TypeScript version to have a consistent development experience across
   // machines.
-  "js/ts.tsdk.path": "node_modules/typescript/lib",
+  "typescript.tsdk": "node_modules/typescript/lib",
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },

CHANGELOG.md

@@ -2,100 +2,62 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## [UNRELEASED]
-
-- _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
-
-## 4.38.2 - 24 Sept 2026
-
-- Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)
-
-## 4.38.1 - 18 Sept 2026
-
-- The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://github.com/github/codeql-action/pull/4146)
-
-## 4.38.0 - 09 Sept 2026
-
-- On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. [#4124](https://github.com/github/codeql-action/pull/4124)
-- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
-- Update default CodeQL bundle version to [2.27.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0). [#4129](https://github.com/github/codeql-action/pull/4129)
-
-## 4.37.9 - 26 Aug 2026
-
-- Update default CodeQL bundle version to [2.26.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4). [#4106](https://github.com/github/codeql-action/pull/4106)
-
-## 4.37.8 - 21 Aug 2026
-
-No user facing changes.
-
-## 4.37.7 - 13 Aug 2026
-
-- Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085)
-
-## 4.37.6 - 04 Aug 2026
-
-- Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)
-
-## 4.37.5 - 03 Aug 2026
-
-- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)
-
-## 4.37.4 - 29 Jul 2026
+## 3.37.4 - 29 Jul 2026
 
 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)
 - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051)
 
-## 4.37.3 - 22 Jul 2026
+## 3.37.3 - 22 Jul 2026
 
 No user facing changes.
 
-## 4.37.2 - 21 Jul 2026
+## 3.37.2 - 21 Jul 2026
 
 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
 - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007)
 
-## 4.37.1 - 16 Jul 2026
+## 3.37.1 - 16 Jul 2026
 
 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956)
 - Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019)
 
-## 4.37.0 - 08 Jul 2026
+## 3.37.0 - 08 Jul 2026
 
 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995)
 - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973)
 
-## 4.36.3 - 01 Jul 2026
+## 3.36.3 - 01 Jul 2026
 
 No user facing changes.
 
-## 4.36.2 - 04 Jun 2026
+## 3.36.2 - 04 Jun 2026
 
 - Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943)
 - Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937)
 - Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948)
 
-## 4.36.1 - 02 Jun 2026
+## 3.36.1 - 02 Jun 2026
 
 No user facing changes.
 
-## 4.36.0 - 22 May 2026
+## 3.36.0 - 22 May 2026
 
 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
 - Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
 - Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926)
 
-## 4.35.5 - 15 May 2026
+## 3.35.5 - 15 May 2026
 
 - We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
 - For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
 - If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
 - Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)
 
-## 4.35.4 - 07 May 2026
+## 3.35.4 - 07 May 2026
 
 - Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)
 
-## 4.35.3 - 01 May 2026
+## 3.35.3 - 01 May 2026
 
 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
 - Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
@@ -103,7 +65,7 @@ No user facing changes.
 - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
 - Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)
 
-## 4.35.2 - 15 Apr 2026
+## 3.35.2 - 15 Apr 2026
 
 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
 - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
@@ -111,26 +73,26 @@ No user facing changes.
 - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
 - Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
 
-## 4.35.1 - 27 Mar 2026
+## 3.35.1 - 27 Mar 2026
 
 - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
 
-## 4.35.0 - 27 Mar 2026
+## 3.35.0 - 27 Mar 2026
 
 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
 - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)
 
-## 4.34.1 - 20 Mar 2026
+## 3.34.1 - 20 Mar 2026
 
 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)
 
-## 4.34.0 - 20 Mar 2026
+## 3.34.0 - 20 Mar 2026
 
 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
 - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
 - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)
 
-## 4.33.0 - 16 Mar 2026
+## 3.33.0 - 16 Mar 2026
 
 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)
 
@@ -144,11 +106,11 @@ No user facing changes.
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
 - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)
 
-## 4.32.6 - 05 Mar 2026
+## 3.32.6 - 05 Mar 2026
 
 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)
 
-## 4.32.5 - 02 Mar 2026
+## 3.32.5 - 02 Mar 2026
 
 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
 - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
@@ -158,7 +120,7 @@ No user facing changes.
 - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
 - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)
 
-## 4.32.4 - 20 Feb 2026
+## 3.32.4 - 20 Feb 2026
 
 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
 - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
@@ -166,89 +128,89 @@ No user facing changes.
 - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
 - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)
 
-## 4.32.3 - 13 Feb 2026
+## 3.32.3 - 13 Feb 2026
 
 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)
 
-## 4.32.2 - 05 Feb 2026
+## 3.32.2 - 05 Feb 2026
 
 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)
 
-## 4.32.1 - 02 Feb 2026
+## 3.32.1 - 02 Feb 2026
 
 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
 - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)
 
-## 4.32.0 - 26 Jan 2026
+## 3.32.0 - 26 Jan 2026
 
 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425)
 
-## 4.31.11 - 23 Jan 2026
+## 3.31.11 - 23 Jan 2026
 
 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409)
 - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415)
 - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318)
 - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403)
 
-## 4.31.10 - 12 Jan 2026
+## 3.31.10 - 12 Jan 2026
 
 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393)
 
-## 4.31.9 - 16 Dec 2025
+## 3.31.9 - 16 Dec 2025
 
 No user facing changes.
 
-## 4.31.8 - 11 Dec 2025
+## 3.31.8 - 11 Dec 2025
 
 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354)
 
-## 4.31.7 - 05 Dec 2025
+## 3.31.7 - 05 Dec 2025
 
 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343)
 
-## 4.31.6 - 01 Dec 2025
+## 3.31.6 - 01 Dec 2025
 
 No user facing changes.
 
-## 4.31.5 - 24 Nov 2025
+## 3.31.5 - 24 Nov 2025
 
 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321)
 
-## 4.31.4 - 18 Nov 2025
+## 3.31.4 - 18 Nov 2025
 
 No user facing changes.
 
-## 4.31.3 - 13 Nov 2025
+## 3.31.3 - 13 Nov 2025
 
 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
 - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)
 
-## 4.31.2 - 30 Oct 2025
+## 3.31.2 - 30 Oct 2025
 
 No user facing changes.
 
-## 4.31.1 - 30 Oct 2025
+## 3.31.1 - 30 Oct 2025
 
 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.
 
-## 4.31.0 - 24 Oct 2025
+## 3.31.0 - 24 Oct 2025
 
 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)
 
-## 4.30.9 - 17 Oct 2025
+## 3.30.9 - 17 Oct 2025
 
 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)
 
-## 4.30.8 - 10 Oct 2025
+## 3.30.8 - 10 Oct 2025
 
 No user facing changes.
 
-## 4.30.7 - 06 Oct 2025
+## 3.30.7 - 06 Oct 2025
 
-- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
 
+No user facing changes.
 ## 3.30.6 - 02 Oct 2025
 
 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)

CONTRIBUTING.md

@@ -60,13 +60,10 @@ Here are a few things you can do that will increase the likelihood of your pull
     This workflow goes through the pull requests that have been merged to `main` since the last release, creates a changelog, then opens a pull request to merge the changes since the last release into the `releases/v3` release branch.
 
     You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
-1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it **with a merge commit** (`gh pr merge --merge`).
+1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it.
 1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
 1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
-1. Approve the mergeback and backport pull request (if applicable) and automerge them **with a merge commit** (`gh pr merge --merge`).
-
-    > [!NOTE]
-    > The release, mergeback, and backport pull requests must always be merged with a merge commit — **never squash or rebase**. The mergeback tags the release using the merge commit of the "Merge main into releases/v3" pull request, so squashing or rebasing breaks tagging and the branch linkage the release automation relies on.
+1. Approve the mergeback and backport pull request (if applicable) and automerge them.
 
 Once the mergeback and backport pull request have been merged, the release is complete.
 

README.md

@@ -72,11 +72,12 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.36.2` | `2.25.6` | Enterprise Server 3.22 | |
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
+| `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
+| `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 

analyze/action.yml

@@ -94,6 +94,6 @@ outputs:
   sarif-id:
     description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
+  using: node20
   main: "../lib/analyze-entry.js"
   post: "../lib/analyze-post-entry.js"

autobuild/action.yml

@@ -15,5 +15,5 @@ inputs:
       $GITHUB_WORKSPACE as its working directory.
     required: false
 runs:
-  using: node24
+  using: node20
   main: '../lib/autobuild-entry.js'

init/action.yml

@@ -164,19 +164,12 @@ inputs:
       [Internal] The ID of the check run, as provided by the Actions runtime environment. Do not set this value manually.
     default: ${{ job.check_run_id }}
     required: false
-  job-status:
-    description: >-
-      [Internal] The status of the job, as provided by the Actions runtime environment. This is how the
-      post step learns whether the job as a whole succeeded, failed, or was cancelled. Do not set this
-      value manually.
-    default: ${{ job.status }}
-    required: false
 outputs:
   codeql-path:
     description: The path of the CodeQL binary used for analysis
   codeql-version:
     description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
+  using: node20
   main: '../lib/init-entry.js'
   post: '../lib/init-post-entry.js'

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.1",
-  "cliVersion": "2.27.1",
-  "priorBundleVersion": "codeql-bundle-v2.27.0",
-  "priorCliVersion": "2.27.0"
+  "bundleVersion": "codeql-bundle-v2.26.2",
+  "cliVersion": "2.26.2",
+  "priorBundleVersion": "codeql-bundle-v2.26.1",
+  "priorCliVersion": "2.26.1"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.38.3",
+  "version": "3.37.4",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -30,50 +30,50 @@
     "@actions/http-client": "^3.0.0",
     "@actions/io": "^2.0.0",
     "@actions/tool-cache": "^3.0.1",
-    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": "^15.0.0",
-    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-    "@octokit/plugin-retry": "^8.1.1",
+    "@octokit/core": "^7.0.6",
+    "@octokit/plugin-paginate-rest": "^14.0.0",
+    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+    "@octokit/plugin-retry": "^8.1.0",
     "archiver": "^8.0.0",
     "fast-deep-equal": "^3.1.3",
     "follow-redirects": "^1.16.0",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.2",
+    "js-yaml": "^5.2.1",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
     "node-forge": "^1.4.0",
     "semver": "^7.8.5",
-    "undici": "^6.28.0",
-    "uuid": "^14.0.2"
+    "uuid": "^14.0.1",
+    "undici": "^6.24.0"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^2.1.1",
+    "@eslint/compat": "^2.1.0",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
-    "@octokit/types": "^18.0.0",
+    "@octokit/types": "^16.0.0",
     "@types/archiver": "^8.0.0",
     "@types/follow-redirects": "^1.14.4",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.19.43",
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
-    "@types/semver": "^7.8.0",
+    "@types/semver": "^7.7.1",
     "@types/sinon": "^22.0.0",
     "ava": "^6.4.1",
-    "esbuild": "^0.28.2",
+    "esbuild": "^0.28.1",
     "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
-    "eslint-plugin-github": "^6.1.2",
+    "eslint-plugin-github": "^6.1.1",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^64.5.4",
+    "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
-    "globals": "^17.12.0",
-    "nock": "^14.0.17",
-    "sinon": "^22.1.0",
+    "globals": "^17.7.0",
+    "nock": "^14.0.16",
+    "sinon": "^22.0.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.70.1"
+    "typescript-eslint": "^8.64.0"
   },
   "overrides": {
     "@actions/tool-cache": {
@@ -95,6 +95,6 @@
       "semver": ">=6.3.1"
     },
     "glob": "^13.0.6",
-    "undici": "^6.28.0"
+    "undici": "^6.24.0"
   }
 }

pr-checks/.nvmrc

@@ -1 +0,0 @@
-24

pr-checks/api-client.ts

@@ -1,7 +1,10 @@
 import * as githubUtils from "@actions/github/lib/utils";
+import { type Octokit } from "@octokit/core";
+import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
+import { type Api } from "@octokit/plugin-rest-endpoint-methods";
 
 /** The type of the Octokit client. */
-export type ApiClient = InstanceType<typeof githubUtils.GitHub>;
+export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
 
 /** Constructs an `ApiClient` using `token` for authentication. */
 export function getApiClient(token: string): ApiClient {

pr-checks/bundle-changelog.test.ts

@@ -112,7 +112,7 @@ ${NO_CHANGES_STR}`;
 describe("updateChangelog", async () => {
   await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
     const result = updateChangelog(EMPTY_CHANGELOG, "");
-    assert.ok(!result.includes(NO_CHANGES_STR));
+    assert.ok(!result.includes(NO_CHANGES_STR.trim()));
   });
 
   await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
@@ -120,7 +120,7 @@ describe("updateChangelog", async () => {
       EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
       "",
     );
-    assert.ok(result.includes(NO_CHANGES_STR));
+    assert.ok(result.includes(NO_CHANGES_STR.trim()));
   });
 
   await it("throws if there are no sections", async () => {

pr-checks/bundle-changelog.ts

@@ -122,6 +122,6 @@ function main() {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   process.exit(main());
 }

pr-checks/bundle-metadata.ts

@@ -43,6 +43,6 @@ async function main() {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   void main();
 }

pr-checks/changelog.test.ts

@@ -9,46 +9,17 @@ import * as fs from "node:fs";
 import { describe, it } from "node:test";
 
 import {
-  addBodyLinesToUnreleasedSection,
-  ChangelogSection,
   EMPTY_CHANGELOG,
-  getHeader,
   getReleaseDateString,
-  NO_CHANGES_STR,
   parseChangelog,
   processChangelogForBackports,
   renderChangelog,
   setVersionAndDate,
-  UNRELEASED_PLACEHOLDER,
 } from "./changelog";
 import { CHANGELOG_FILE } from "./config";
 
 const testDate = new Date(2026, 7, 14);
 
-describe("getHeader", async () => {
-  function Section(headerLine: string): ChangelogSection {
-    return {
-      headerLine,
-      bodyLines: [],
-    };
-  }
-  await it("returns non-headers unchanged", () => {
-    assert.equal("foo", getHeader(Section("foo")));
-    assert.equal("- bar", getHeader(Section("- bar")));
-  });
-  await it("strips octothorpes", async () => {
-    assert.equal("foo", getHeader(Section("# foo")));
-    assert.equal("foo", getHeader(Section("## foo")));
-    assert.equal("foo", getHeader(Section("### foo")));
-    assert.equal("foo", getHeader(Section("#### foo")));
-    assert.equal("foo", getHeader(Section("##### foo")));
-    assert.equal("foo", getHeader(Section("###### foo")));
-  });
-  await it("strips whitespace", async () => {
-    assert.equal("foo", getHeader(Section("# foo  ")));
-  });
-});
-
 describe("getReleaseDateString", async () => {
   await it("formats dates as expected", async () => {
     assert.equal(getReleaseDateString(testDate), "14 Aug 2026");
@@ -99,73 +70,3 @@ describe("processChangelogForBackports", async () => {
     assert.deepEqual(result.split("\n"), testChangelogResult.split("\n"));
   });
 });
-
-describe("addBodyLinesToUnreleasedSection", async () => {
-  function newChangelogWithSections(sections: ChangelogSection[]) {
-    return {
-      preamble: [],
-      sections,
-    };
-  }
-
-  await it("throws error if '[UNRELEASED]' section is not first", async () => {
-    const invalidChangelog = newChangelogWithSections([
-      {
-        headerLine: "## Release 1.0.0",
-        bodyLines: [],
-      },
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: [],
-      },
-    ]);
-    assert.throws(() =>
-      addBodyLinesToUnreleasedSection(invalidChangelog, ["foo"]),
-    );
-  });
-
-  await it("overwrites 'No user facing changes.'", async () => {
-    const changelog = newChangelogWithSections([
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: ["", NO_CHANGES_STR, ""],
-      },
-    ]);
-
-    addBodyLinesToUnreleasedSection(changelog, ["- foo"]);
-
-    assert.equal(changelog.sections[0].bodyLines.length, 3);
-    assert.deepEqual(changelog.sections[0].bodyLines, ["", "- foo", ""]);
-  });
-
-  await it("does nothing if lines is empty", async () => {
-    const changelog = newChangelogWithSections([
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: ["", NO_CHANGES_STR, ""],
-      },
-    ]);
-    const changelogClone = structuredClone(changelog);
-
-    addBodyLinesToUnreleasedSection(changelog, []);
-
-    assert.deepEqual(changelog, changelogClone);
-  });
-
-  await it("inserts a line", async () => {
-    const changelog = newChangelogWithSections([
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: ["", "- Added a new dependency.", ""],
-      },
-    ]);
-    const lineToInsert = "- foo";
-
-    addBodyLinesToUnreleasedSection(changelog, [lineToInsert]);
-
-    assert.equal(changelog.sections[0].bodyLines.length, 4);
-    assert.ok(
-      changelog.sections[0].bodyLines.some((line) => line === lineToInsert),
-    );
-  });
-});

pr-checks/changelog.ts

@@ -6,16 +6,14 @@ import { CHANGELOG_FILE, DryRunOption } from "./config";
 export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]";
 
 /** The default contents for a section in the changelog. */
-export const NO_CHANGES_STR = "No user facing changes.";
+export const NO_CHANGES_STR = "No user facing changes.\n\n";
 
 /** Placeholder changelog content for a new release. */
 export const EMPTY_CHANGELOG = `# CodeQL Action Changelog
 
 ## ${UNRELEASED_PLACEHOLDER}
 
-${NO_CHANGES_STR}
-
-`;
+${NO_CHANGES_STR}`;
 
 /**
  * Represents sections in a changelog.
@@ -33,13 +31,6 @@ export interface Changelog {
   sections: ChangelogSection[];
 }
 
-/**
- * Returns the text of the header (without the '## ' prefix) of the given section.
- * */
-export function getHeader(section: ChangelogSection): string {
-  return section.headerLine.replace(/^#+\s+/, "").trimEnd();
-}
-
 /** Returns `date` formatted as `DD Mon YYYY`. */
 export function getReleaseDateString(today: Date = new Date()): string {
   return today.toLocaleDateString("en-GB", {
@@ -134,42 +125,6 @@ export function parseChangelog(content: string): Changelog {
   return { preamble, sections };
 }
 
-/**
- * Inserts the changenotes `lines` in the `[UNRELEASED]` section of `changelog`.
- * If the section contains the stock message {@link NO_CHANGES_STR}, then
- * `lines` will be inserted in place and the stock message will be deleted.
- *
- * @throws Error -- if the [UNRELEASED] section does not exist.
- *
- * @param changelog The CHANGELOG object to modify.
- * @param lines The changenotes to insert.
- */
-export function addBodyLinesToUnreleasedSection(
-  changelog: Changelog,
-  lines: string[],
-) {
-  // Do nothing if there is nothing to insert.
-  if (lines.length === 0) return;
-
-  const unreleasedSection = changelog.sections[0];
-  if (getHeader(unreleasedSection) !== UNRELEASED_PLACEHOLDER) {
-    throw Error(
-      `'${UNRELEASED_PLACEHOLDER}' is not the first section of 'CHANGELOG.md'`,
-    );
-  }
-
-  if (unreleasedSection.bodyLines.includes(NO_CHANGES_STR)) {
-    unreleasedSection.bodyLines = ["", ...lines, ""];
-    return;
-  }
-
-  // The last body line should be a blank line (for spacing).
-  // Remove it so that we can add `lines` and then add the blank line back.
-  unreleasedSection.bodyLines.pop();
-  unreleasedSection.bodyLines.push(...lines);
-  unreleasedSection.bodyLines.push("");
-}
-
 /**
  * Combines an array of lines into a single string by adding line breaks.
  */
@@ -249,7 +204,7 @@ export function processChangelogForBackports(
 
     // Add an entry if we didn't keep any.
     if (!foundContent) {
-      section.bodyLines.push(NO_CHANGES_STR);
+      section.bodyLines.push(NO_CHANGES_STR.trim());
     }
   }
 

pr-checks/changelog/validate.test.ts

@@ -1,186 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-
-import { withTmpFile } from "../../src/util";
-
-import {
-  hasValidChangenoteCategory,
-  isValidChangenoteContent,
-  isValidChangenoteFile,
-  isValidChangenoteFilename,
-  VALID_CHANGE_NOTE_CATEGORIES,
-} from "./validate";
-
-await describe("isValidChangenoteContent", async () => {
-  await it("recognizes an unordered Markdown list", () => {
-    const inputs = [
-      "- One changenote entry",
-      "- First item\n- Second item",
-      "\n\n\n\n- Fixed a bug\n- Added a feature",
-    ];
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteContent(input), true);
-    }
-  });
-
-  await it("does not recognize non-Markdown text", () => {
-    const inputs = [
-      "This is not a list.",
-      '["this", "is", "JSON"]',
-      "---",
-      "***",
-      "___",
-      "paragraph",
-    ];
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteContent(input), false);
-    }
-  });
-
-  await it("does not recognize ordered Markdown lists", () => {
-    const inputs = [
-      "1. First item\n2. Second item",
-      "\n\n\n1. First item\n1. Second item",
-    ];
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteContent(input), false);
-    }
-  });
-
-  await it("requires all list items to use a hyphen bullet", () => {
-    const inputs = [
-      "* Fixed a bug\n* Added feature",
-      "+ Fixed a bug\n+ Added feature",
-      "- Fixed a bug\n* Added feature",
-      "- Fixed a bug\n+ Added feature",
-      "- Fixed a bug\n  * Added feature\n    + Updated docs",
-      "\n\n\n* Fixed a bug",
-      "\n\n\n+ Fixed a bug",
-      "---\n* Fixed a bug\n* Added feature",
-    ] as const;
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteContent(input), false);
-    }
-  });
-
-  await it("does not contain other Markdown elements", () => {
-    const inputs = [
-      "- Fixed a bug\n\nParagraph of text",
-      "- Fixed a bug\n\n* Added a feature",
-      "# Header\n- Fixed a bug",
-      "- Fixed a bug\n## Subheader",
-    ];
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteContent(input), false);
-    }
-  });
-});
-
-await describe("isValidChangenoteFilename", async () => {
-  await it("accepts valid filenames", () => {
-    const inputs = [
-      "2023-01-01-fix-bug.md",
-      "2023-12-31-add-feature.md",
-      "2023-06-15-update-docs.md",
-    ];
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteFilename(input), true);
-    }
-  });
-
-  await it("rejects invalid filenames", () => {
-    const inputs = [
-      "missing-date-from-filename.md",
-      "2021-01-01.md",
-      "2026-12-19-wrong-file-name-extension.txt",
-    ];
-
-    for (const input of inputs) {
-      assert.equal(isValidChangenoteFilename(input), false);
-    }
-  });
-});
-
-await describe("hasValidChangenoteCategory", async () => {
-  await it("accepts valid categories", () => {
-    for (const category of Object.keys(VALID_CHANGE_NOTE_CATEGORIES)) {
-      const frontmatter = { category };
-      assert.equal(hasValidChangenoteCategory(frontmatter), true);
-    }
-  });
-
-  await it("rejects invalid categories", () => {
-    const inputs = [
-      "",
-      "invalid-category",
-      "bug-fix",
-      "new-feature",
-      "security-patch",
-      "miscellaneous",
-      "documentation",
-    ];
-
-    for (const category of inputs) {
-      const frontmatter = { category };
-      assert.equal(hasValidChangenoteCategory(frontmatter), false);
-    }
-  });
-
-  await it("reject missing category", () => {
-    assert.equal(hasValidChangenoteCategory({}), false);
-    assert.equal(hasValidChangenoteCategory({ category: null }), false);
-    assert.equal(hasValidChangenoteCategory({ category: undefined }), false);
-  });
-});
-
-await describe("isValidChangenoteFile", async () => {
-  await it("accepts a valid change-note file", async () => {
-    await withTmpFile(
-      "2026-01-01-fix-bug.md",
-      "---\ncategory: fix\n---\n- Fixed a bug\n",
-      (filePath) => {
-        assert.equal(isValidChangenoteFile(filePath), true);
-      },
-    );
-  });
-
-  await it("rejects a non-existent path", async () => {
-    assert.equal(isValidChangenoteFile("non-existent-file.md"), false);
-  });
-
-  await it("rejects invalid filename", async () => {
-    await withTmpFile(
-      "fix-bug.md",
-      "---\ncategory: fix\n---\n- Fixed a bug\n",
-      (filePath) => {
-        assert.equal(isValidChangenoteFile(filePath), false);
-      },
-    );
-  });
-
-  await it("rejects missing frontmatter", async () => {
-    await withTmpFile(
-      "2026-01-01-fix-bug.md",
-      "- Fixed a bug\n",
-      (filePath) => {
-        assert.equal(isValidChangenoteFile(filePath), false);
-      },
-    );
-  });
-
-  await it("rejects invalid Markdown", async () => {
-    await withTmpFile(
-      "2026-01-01-fix-bug.md",
-      "---\ncategory: fix\n---\n* Fixed a bug\n",
-      (filePath) => {
-        assert.equal(isValidChangenoteFile(filePath), false);
-      },
-    );
-  });
-});

pr-checks/changelog/validate.ts

@@ -1,121 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import { matter } from "lite-matter";
-import type { List, ListItem } from "mdast";
-import { fromMarkdown } from "mdast-util-from-markdown";
-
-// Regex for filename: YYYY-MM-DD-id.md
-const VALID_CHANGE_NOTE_FILENAME_PATTERN =
-  /^(\d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])-([a-z0-9]+(?:-[a-z0-9]+)*)\.md$/;
-
-export const VALID_CHANGE_NOTE_CATEGORIES = {
-  breaking: "Breaking Changes",
-  feature: "New Features",
-  improvement: "Improvements",
-  securityFix: "Security Fixes",
-  fix: "Bug Fixes",
-  unship: "Removed Features",
-  deprecation: "Deprecations",
-  knownIssue: "Known Issues",
-  misc: "Miscellaneous",
-};
-
-/**
- * Validates that the given Markdown string meets the criteria for a change-note, which is:
- * - A single unordered list
- * - Each list item must start with a hyphen (-)
- * - No other Markdown elements are allowed
- * @param content The Markdown string to validate
- * @returns True if the string is a valid change-note, false otherwise
- */
-export function isValidChangenoteContent(content: string): boolean {
-  const ast = fromMarkdown(content);
-  const lines = content.split("\n");
-
-  function listHasHyphenBullets(node: List | ListItem): boolean {
-    if (node.type === "list") {
-      return node.children.every(listHasHyphenBullets);
-    }
-
-    const line = lines[node.position!.start.line - 1].trim();
-    return (
-      line.startsWith("-") &&
-      node.children.every(
-        (child) => child.type !== "list" || listHasHyphenBullets(child),
-      )
-    );
-  }
-
-  return (
-    ast.children.length === 1 &&
-    ast.children[0].type === "list" &&
-    ast.children[0].ordered === false &&
-    listHasHyphenBullets(ast.children[0])
-  );
-}
-
-/**
- * Validates that the given filename meets the criteria for a change-note filename.
- * @param filename The name of the change-note file to validate.
- * @returns True if the filename is valid, false otherwise.
- */
-export function isValidChangenoteFilename(filename: string): boolean {
-  return filename.match(VALID_CHANGE_NOTE_FILENAME_PATTERN) !== null;
-}
-
-/**
- * Validates that the given frontmatter has a valid change-note category.
- * @param frontmatter The frontmatter object to validate.
- * @returns True if the frontmatter has a valid category, false otherwise.
- */
-export function hasValidChangenoteCategory(
-  frontmatter: Record<string, unknown>,
-): boolean {
-  const category = frontmatter["category"];
-  return (
-    typeof category === "string" &&
-    Object.hasOwn(VALID_CHANGE_NOTE_CATEGORIES, category)
-  );
-}
-
-/**
- * Validates that the given change-note file meets all of the criteria for a change-note.
- * @param filename The name of the change-note file to validate.
- * @returns True if the file is a valid change-note, false otherwise.
- */
-export function isValidChangenoteFile(filename: string): boolean {
-  let isValid: boolean = true;
-
-  let fileData: string | undefined;
-  try {
-    fileData = fs.readFileSync(filename, "utf8");
-  } catch (error) {
-    console.error(`${filename}: failed to read file`, error);
-    return false;
-  }
-
-  const { data: frontmatter, content } = matter(fileData);
-
-  if (!isValidChangenoteFilename(path.basename(filename))) {
-    isValid = false;
-    console.error(
-      `${filename}: invalid filename; must match pattern YYYY-MM-DD-id.md`,
-    );
-  }
-  if (!hasValidChangenoteCategory(frontmatter)) {
-    isValid = false;
-    const categories = Object.keys(VALID_CHANGE_NOTE_CATEGORIES).join(", ");
-    console.error(
-      `${filename}: invalid category; must be one of: ${categories}`,
-    );
-  }
-  if (!isValidChangenoteContent(content)) {
-    isValid = false;
-    console.error(
-      `${filename}: invalid Markdown; content must be a single unordered list with hyphen bullets and no other Markdown elements`,
-    );
-  }
-
-  return isValid;
-}

pr-checks/changenotes.ts

@@ -1,134 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs";
-import { pathToFileURL } from "node:url";
-import { parseArgs } from "node:util";
-import path from "path";
-
-import { ExitCode } from "@actions/core";
-import { matter } from "lite-matter";
-
-import {
-  addBodyLinesToUnreleasedSection,
-  parseChangelog,
-  renderChangelog,
-  withChangelog,
-} from "./changelog";
-import { isValidChangenoteFile } from "./changelog/validate";
-import { CHANGENOTES_DIR } from "./config";
-
-/**
- * Describes a changenote file, including its file path, frontmatter, and content.
- */
-interface ChangenoteFile {
-  absolutePath: string;
-  data: Record<string, any>;
-  content: string;
-}
-
-/**
- * Returns the absolute file paths of all files in
- * {@link CHANGENOTES_DIR} (except ".gitkeep").
- * */
-function listUnreleasedChangenoteDir(): string[] {
-  return fs
-    .readdirSync(CHANGENOTES_DIR)
-    .filter((name) => name !== ".gitkeep")
-    .map((name) => path.join(CHANGENOTES_DIR, name));
-}
-
-/**
- * Scans the {@link CHANGENOTES_DIR} directory for changenote files
- * and returns a parsed listing of those changenote files.
- */
-function getChangenotes(): ChangenoteFile[] {
-  return listUnreleasedChangenoteDir().map((absolutePath) => {
-    return {
-      absolutePath,
-      ...matter(fs.readFileSync(absolutePath, "utf-8")),
-    };
-  });
-}
-
-const entryPoint = process.argv[1];
-if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) {
-  try {
-    process.exit(main());
-  } catch (error) {
-    console.error(error);
-    process.exit(ExitCode.Failure);
-  }
-}
-
-function main(): ExitCode {
-  const { positionals } = parseArgs({
-    allowPositionals: true,
-    strict: true,
-  });
-  const [command] = positionals;
-  switch (command) {
-    case undefined:
-    case "help":
-      return usage();
-    case "assemble":
-      return assemble();
-    case "validate":
-      return validate();
-    default:
-      console.error(`Unknown command: ${command}`);
-      return ExitCode.Failure;
-  }
-}
-
-function usage(): ExitCode {
-  const message =
-    "Usage: changenotes.ts assemble\n" +
-    "       changenotes.ts validate\n" +
-    "       changenotes.ts help";
-  console.log(message);
-  return ExitCode.Success;
-}
-
-function assemble(): ExitCode {
-  try {
-    const changenotes = getChangenotes();
-    const changenoteBodies = changenotes.map((c) => c.content);
-    const changenotePaths = changenotes.map((c) => c.absolutePath);
-
-    withChangelog((contents) => {
-      const changelog = parseChangelog(contents);
-      addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
-      return renderChangelog(changelog);
-    }, {});
-
-    // Delete changenotes only after successful processing.
-    for (const p of changenotePaths) {
-      fs.unlinkSync(p);
-    }
-
-    return ExitCode.Success;
-  } catch (e) {
-    console.error("Failed to assemble changenotes to 'CHANGELOG.md'", e);
-  }
-
-  return ExitCode.Failure;
-}
-
-function validate(): ExitCode {
-  try {
-    const allChangenotesValid = getChangenotes().reduce(
-      (r, changenote) => r && isValidChangenoteFile(changenote.absolutePath),
-      true,
-    );
-    if (allChangenotesValid) {
-      console.log(`All changenotes in '${CHANGENOTES_DIR}' are valid.`);
-      return ExitCode.Success;
-    }
-  } catch (error) {
-    console.error(
-      `Failed to read changenotes directory '${CHANGENOTES_DIR}'`,
-      error,
-    );
-  }
-  return ExitCode.Failure;
-}

pr-checks/check-repo-size.ts

@@ -218,6 +218,6 @@ async function run(): Promise<void> {
   }
 }
 
-if (import.meta.main) {
+if (require.main === module) {
   void run();
 }

pr-checks/checks/all-platform-bundle.yml

@@ -2,8 +2,7 @@ name: "All-platform bundle"
 description: "Tests using an all-platform CodeQL Bundle"
 operatingSystems:
   - ubuntu
-  - os: macos
-    runner-image: macos-latest-xlarge
+  - macos
   - windows
 versions:
   - nightly-latest

pr-checks/checks/bundle-toolcache.yml

@@ -30,8 +30,7 @@ steps:
   - id: init
     uses: ./../action/init
     with:
-      # Request multiple languages so this check uses the combined bundle.
-      languages: javascript,python
+      languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - uses: ./../action/analyze
     with:

pr-checks/checks/export-file-baseline-information.yml

@@ -11,10 +11,6 @@ installDotNet: true
 env:
   CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
   CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-  # To balance speed and coverage, we analyze only a single language (JavaScript), but use the
-  # combined bundle so we can test that baseline information is reported for each language in the
-  # multi-language source directory.
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
 steps:
   - uses: ./../action/init
     id: init

pr-checks/checks/job-run-uuid-sarif.yml

@@ -21,8 +21,8 @@ steps:
     run: |
       cd "$RUNNER_TEMP/results"
       actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
-      if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then
-        echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'."
+      if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
+        echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
         exit 1
       else
         echo "Found job run UUID '$actual'."

pr-checks/checks/linux-arm64.yml

@@ -1,35 +0,0 @@
-name: "Linux Arm64"
-description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
-operatingSystems:
-  - os: ubuntu
-    runner-image: ubuntu-24.04-arm
-# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
-# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
-# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
-versions:
-  - nightly-latest
-installGo: true
-installDotNet: true
-# The set of languages CodeQL supports on this platform, excluding Swift (macOS only).
-env:
-  LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
-steps:
-  - uses: ./../action/init
-    with:
-      languages: ${{ env.LANGUAGES }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Build code
-    run: ./build.sh
-  - uses: ./../action/analyze
-    with:
-      upload-database: false
-  - name: Assert databases exist
-    run: |
-      cd "$RUNNER_TEMP/codeql_databases"
-      for lang in ${LANGUAGES//,/ }; do
-        if [[ ! -d "$lang" ]]; then
-          echo "Did not find a database for $lang"
-          exit 1
-        fi
-        echo "Found database for $lang"
-      done

pr-checks/checks/multi-language-autodetect.yml

@@ -15,7 +15,6 @@ operatingSystems:
       - stable-v2.21.4
       - stable-v2.22.4
 env:
-  CODEQL_ACTION_CLEANUP_TOOLCACHE_BUNDLES: true
   CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
 installGo: true
 installDotNet: true

pr-checks/checks/per-language-bundle-validation.yml

@@ -1,117 +0,0 @@
-name: Per-language bundles
-description: Validates extraction and analysis using each per-language CodeQL bundle.
-# TODO: Use a released bundle once releases include per-language bundles.
-matrix:
-  include:
-    - language: actions
-      os: ubuntu-latest
-      version: nightly-latest
-      # Actions also needs the JavaScript extractor.
-      expected-extractors: actions javascript
-    - language: cpp
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: manual
-      build-command: gcc -o main main.c
-    - language: csharp
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: none
-    - language: go
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: autobuild
-    - language: java
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: none
-    - language: javascript
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: python
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: ruby
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: rust
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: swift
-      os: macos-latest-xlarge
-      version: nightly-latest
-      build-mode: autobuild
-env:
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
-steps:
-  - uses: ./../action/init
-    id: init
-    with:
-      languages: ${{ matrix.language }}
-      build-mode: ${{ matrix['build-mode'] }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Check that the bundle contains only the expected extractors
-    env:
-      CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-      LANGUAGE: ${{ matrix.language }}
-      EXPECTED_EXTRACTORS: ${{ matrix['expected-extractors'] || matrix.language }}
-    run: |
-      extractors="$("$CODEQL_PATH" resolve languages --format=json | jq -r 'keys[]')"
-      echo "Extractors in the bundle:"
-      echo "$extractors"
-      echo "Expected: $EXPECTED_EXTRACTORS"
-
-      for expected in $EXPECTED_EXTRACTORS; do
-        if ! echo "$extractors" | grep -qx "$expected"; then
-          echo "::error::The ${LANGUAGE} bundle does not contain the ${expected} extractor."
-          exit 1
-        fi
-      done
-
-      # If the bundle contained extractors beyond those the language needs, then it would not
-      # have been trimmed, and this job would be silently validating the combined bundle.
-      for other in actions cpp csharp go java javascript python ruby rust swift; do
-        if echo "$EXPECTED_EXTRACTORS" | grep -qw "$other"; then
-          continue
-        fi
-        if echo "$extractors" | grep -qx "$other"; then
-          echo "::error::The ${LANGUAGE} bundle also contains the ${other} extractor, so it is not trimmed."
-          exit 1
-        fi
-      done
-  - name: Check that the bundle was not added to the toolcache
-    env:
-      CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-    run: |
-      # A bundle that is missing most of its extractors must never be left in the toolcache,
-      # where a later job analyzing a different language could pick it up. The runner image
-      # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-      # rather than whether the toolcache contains CodeQL at all.
-      echo "CodeQL is at $CODEQL_PATH"
-      if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
-        echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
-        exit 1
-      fi
-      if [[ "$CODEQL_PATH" != "$RUNNER_TEMP"/* ]]; then
-        echo "::error::Expected the per-language bundle to be extracted under $RUNNER_TEMP, but found it at $CODEQL_PATH."
-        exit 1
-      fi
-  - name: Build code
-    if: matrix['build-command']
-    run: ${{ matrix['build-command'] }}
-  - uses: ./../action/analyze
-    id: analysis
-    with:
-      upload-database: false
-  - name: Check that a database was created for the language
-    env:
-      DB_LOCATIONS: ${{ steps.analysis.outputs.db-locations }}
-      LANGUAGE: ${{ matrix.language }}
-    run: |
-      database="$(echo "$DB_LOCATIONS" | jq -r --arg lang "$LANGUAGE" '.[$lang] // empty')"
-      if [ -z "$database" ] || [ ! -d "$database" ]; then
-        echo "::error::No CodeQL database was created for ${LANGUAGE}."
-        echo "Databases: $DB_LOCATIONS"
-        exit 1
-      fi
-      echo "Created a ${LANGUAGE} database at ${database}."

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+    uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

pr-checks/checks/swift-custom-build.yml

@@ -5,8 +5,7 @@ versions:
   - default
   - nightly-latest
 operatingSystems:
-  - os: macos
-    runner-image: macos-latest-xlarge
+  - macos
 installGo: true
 installDotNet: true
 env:

pr-checks/config.ts

@@ -1,9 +1,4 @@
 import path from "path";
-import { fileURLToPath } from "url";
-
-// For backwards-compatibility.
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
 
 /** The oldest supported major version of the CodeQL Action. */
 export const OLDEST_SUPPORTED_MAJOR_VERSION = 3;
@@ -23,9 +18,6 @@ export const PACKAGE_JSON = path.join(REPO_ROOT, "package.json");
 /** The path of the changelog. */
 export const CHANGELOG_FILE = path.join(REPO_ROOT, "CHANGELOG.md");
 
-/** The path to the unreleased change-notes directory. */
-export const CHANGENOTES_DIR = path.join(REPO_ROOT, "unreleased-change-notes");
-
 /** The path to the esbuild metadata file. */
 export const BUNDLE_METADATA_FILE = path.join(REPO_ROOT, "meta.json");
 

pr-checks/excluded.yml

@@ -5,8 +5,6 @@ contains:
   - "test-setup-python-scripts"
   - "update"
   - "Update"
-  # Matrix-ed job; the name starts with this
-  - "Create backport"
 is:
   - "Agent"
   - "check-expected-release-files"
@@ -17,6 +15,4 @@ is:
   - "Label PR with size"
   - "Post repo size comment"
   - "Prepare"
-  - "Release info"
   - "Upload results"
-  - "Update release branch"

pr-checks/package.json

@@ -1,20 +1,17 @@
 {
   "private": true,
-  "description": "Dependencies for codeql-action scripts",
-  "type": "module",
+  "description": "Dependencies for the sync.ts",
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@actions/github": "^8.0.1",
-    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": ">=15.0.0",
-    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-    "lite-matter": "^0.1.2",
-    "mdast-util-from-markdown": "^2.0.3",
+    "@octokit/core": "^7.0.6",
+    "@octokit/plugin-paginate-rest": ">=9.2.2",
+    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
     "semver": "^7.8.5",
-    "yaml": "^2.9.1"
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@types/node": "^24.19.0",
-    "tsx": "^4.23.15"
+    "@types/node": "^20.19.43",
+    "tsx": "^4.23.1"
   }
 }

pr-checks/prepare-changelog.ts

@@ -77,6 +77,6 @@ function main() {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   process.exit(main());
 }

pr-checks/release-branches.ts

@@ -116,6 +116,6 @@ async function main() {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   void main();
 }

pr-checks/rollback-changelog.ts

@@ -79,6 +79,6 @@ function main() {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   process.exit(main());
 }

pr-checks/sync-back.ts

@@ -21,11 +21,10 @@ import * as fs from "fs";
 import { parseArgs } from "node:util";
 import * as path from "path";
 
-import { PR_CHECKS_DIR, REPO_ROOT } from "./config";
-
-const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
-const WORKFLOW_DIR = path.join(REPO_ROOT, ".github", "workflows");
-const SYNC_TS_PATH = path.join(PR_CHECKS_DIR, "sync.ts");
+const THIS_DIR = __dirname;
+const CHECKS_DIR = path.join(THIS_DIR, "checks");
+const WORKFLOW_DIR = path.join(THIS_DIR, "..", ".github", "workflows");
+const SYNC_TS_PATH = path.join(THIS_DIR, "sync.ts");
 
 /**
  * Scan generated workflow files to extract the latest action versions.
@@ -233,6 +232,6 @@ function main(): number {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   process.exit(main());
 }

pr-checks/sync-checks.ts

@@ -342,6 +342,6 @@ async function main(): Promise<void> {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   void main();
 }

pr-checks/sync.sh

@@ -4,19 +4,12 @@ set -e
 cd "$(dirname "$0")"
 
 # Run `npm ci` in CI or `npm install` otherwise.
-#
-# `pr-checks` is an npm workspace of the repository root and the two share a single hoisted
-# `node_modules` directory. Running npm from this directory puts it in workspace mode, where it
-# ignores the root project's own dependencies by default. `npm ci` would then rebuild the shared
-# `node_modules` with only this workspace's dependencies, removing the root's ones, which breaks
-# anything that imports from `src` (such as `sync.ts` itself). `--include-workspace-root` keeps the
-# root project's dependencies in the installed tree.
 if [ "$GITHUB_ACTIONS" = "true" ]; then
   echo "In Actions, running 'npm ci' for 'sync.ts'..."
-  npm ci --include-workspace-root
+  npm ci
 else
   echo "Running 'npm install' for 'sync.ts'..."
-  npm install --no-audit --no-fund --include-workspace-root
+  npm install --no-audit --no-fund
 fi
 
 npx tsx sync.ts

pr-checks/sync.ts

@@ -7,8 +7,6 @@ import * as yaml from "yaml";
 
 import { BuiltInLanguage } from "../src/languages";
 
-import { PR_CHECKS_DIR, REPO_ROOT } from "./config";
-
 /**
  * Returns a `uses` value for `action` pinned to a commit SHA, with the
  * human-readable version recorded in a trailing comment.
@@ -81,8 +79,6 @@ interface Specification extends JobSpecification {
   useAllPlatformBundle?: string;
   /** Values for the `analysis-kinds` matrix dimension. */
   analysisKinds?: string[];
-  /** Overrides the generated job matrix using GitHub Actions matrix syntax. */
-  matrix?: Record<string, unknown>;
 
   /** Container image configuration for the job. */
   container?: any;
@@ -223,12 +219,6 @@ const languageSetups: LanguageSetups = {
           cache: "npm",
         },
       },
-      // Install a new enough version of `npm` to understand `min-release-age`
-      // that is still compatible with Node 20.
-      {
-        name: "Install newer npm",
-        run: "npm install -g npm@11.19.1",
-      },
       {
         name: "Install dependencies",
         run: "npm ci",
@@ -263,8 +253,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Java",
         uses: pinnedUses(
           "actions/setup-java",
-          "de7274f081f381c8f8158605e0321c36c376e2e6",
-          "v6.0.1",
+          "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95",
+          "v5.6.0",
         ),
         with: {
           "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -314,8 +304,9 @@ const languageSetups: LanguageSetups = {
 // See https://github.com/github/codeql-action/pull/3423
 const YQ_VERSION = "v4.50.1";
 
-const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
-const OUTPUT_DIR = path.join(REPO_ROOT, ".github", "workflows");
+const THIS_DIR = __dirname;
+const CHECKS_DIR = path.join(THIS_DIR, "checks");
+const OUTPUT_DIR = path.join(THIS_DIR, "..", ".github", "workflows");
 
 /**
  * Loads and parses a YAML file.
@@ -521,6 +512,9 @@ function generateJob(
   specDocument: yaml.Document,
   checkSpecification: Specification,
 ) {
+  const matrix: Array<Record<string, any>> =
+    generateJobMatrix(checkSpecification);
+
   const useAllPlatformBundle = checkSpecification.useAllPlatformBundle
     ? checkSpecification.useAllPlatformBundle
     : "false";
@@ -573,8 +567,8 @@ function generateJob(
   const checkJob: Record<string, any> = {
     strategy: {
       "fail-fast": false,
-      matrix: checkSpecification.matrix ?? {
-        include: generateJobMatrix(checkSpecification),
+      matrix: {
+        include: matrix,
       },
     },
     name: checkSpecification.name,

pr-checks/tsconfig.json

@@ -6,8 +6,8 @@
     "module": "preserve",
     "rootDir": "..",
     "sourceMap": false,
-    "noEmit": true
+    "noEmit": true,
   },
-  "include": ["./**/*.ts", "../src/**/*.ts"],
+  "include": ["./*.ts", "../src/**/*.ts"],
   "exclude": ["node_modules"]
 }

pr-checks/update-ghes-versions.ts

@@ -238,6 +238,6 @@ function main() {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   main();
 }

pr-checks/update-release-branch.ts

@@ -835,6 +835,6 @@ async function main(): Promise<void> {
 }
 
 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
   void main();
 }

resolve-environment/action.yml

@@ -21,5 +21,5 @@ outputs:
   environment:
     description: The inferred build environment configuration.
 runs:
-  using: node24
+  using: node20
   main: '../lib/resolve-environment-entry.js'

setup-codeql/action.yml

@@ -21,16 +21,19 @@ inputs:
     required: false
   languages:
     description: >-
-      A comma-separated list of CodeQL languages that the installed CodeQL CLI will be used to
-      analyze. If specified, the Action may use this list to select a CodeQL CLI version that is
-      best suited to analyzing those languages, for example by preferring a version that has a
-      cached overlay-base database for the specified languages.
+      A comma-separated list of CodeQL languages that will be analyzed in subsequent
+      `github/codeql-action/init` and `github/codeql-action/analyze` invocations. If specified, the
+      Action may use this list to select a CodeQL CLI version that is best suited to analyzing those
+      languages, for example by preferring a version that has a cached overlay-base database for the
+      specified languages. This input is not remembered and must also be passed to
+      `github/codeql-action/init`.
     required: false
   analysis-kinds:
     description: >-
-      [Internal] A comma-separated list of analysis kinds that the installed CodeQL CLI will be used
-      for. If specified, the Action may use this list to select a CodeQL CLI version that is best
-      suited to those analysis kinds.
+      [Internal] A comma-separated list of analysis kinds that subsequent
+      `github/codeql-action/init` invocations will enable. If specified, the Action may use this
+      list to select a CodeQL CLI version that is best suited to those analysis kinds. This input is
+      not remembered and must also be passed to `github/codeql-action/init`.
 
       Available options are the same as for the `analysis-kinds` input on the `init` Action.
     default: 'code-scanning'
@@ -51,5 +54,5 @@ outputs:
   codeql-version:
     description: The version of the CodeQL binary that was installed.
 runs:
-  using: node24
+  using: node20
   main: '../lib/setup-codeql-entry.js'

src/action-common.test.ts

@@ -1,123 +0,0 @@
-import * as core from "@actions/core";
-import test from "ava";
-import sinon from "sinon";
-
-import * as common from "./action-common";
-import * as actionsUtil from "./actions-util";
-import * as environment from "./environment";
-import * as logging from "./logging";
-import { ActionName } from "./status-report";
-import * as statusReport from "./status-report";
-import {
-  getTestActionsEnv,
-  getTestEnv,
-  makeMacro,
-  RecordingLogger,
-  setupTests,
-} from "./testing-utils";
-import { getErrorMessage } from "./util";
-
-setupTests(test);
-
-interface RunInActionsTestOpts {
-  runFn?: () => Promise<any>;
-  expectedErrorMessage?: string;
-  expectedTelemetryError?: string;
-}
-
-const runInActionsMacro = makeMacro({
-  exec: async (t, opts: RunInActionsTestOpts) => {
-    const expectFailure = opts?.expectedErrorMessage !== undefined;
-
-    const logger = new RecordingLogger();
-    const getActionsLogger = sinon
-      .stub(logging, "getActionsLogger")
-      .returns(logger);
-
-    const env = getTestEnv();
-    const getEnv = sinon.stub(environment, "getEnv").returns(env);
-
-    const actionsEnv = getTestActionsEnv(env);
-    const getActionsEnv = sinon
-      .stub(actionsUtil, "getActionsEnv")
-      .returns(actionsEnv);
-
-    const getJobUUID = sinon
-      .stub(statusReport, "getJobUUID")
-      .returns("test-job-uuid");
-
-    const setFailed = sinon.stub(core, "setFailed");
-    const sendUnhandledErrorStatusReport = sinon.stub(
-      statusReport,
-      "sendUnhandledErrorStatusReport",
-    );
-
-    const name = ActionName.Init;
-    const run = sinon.stub();
-
-    if (opts?.runFn) {
-      run.callsFake(opts.runFn);
-    }
-
-    const transformTelemetryError = sinon
-      .stub()
-      .callsFake((err) => opts?.expectedTelemetryError ?? getErrorMessage(err));
-    const testAction: common.Action = {
-      name,
-      run,
-      transformTelemetryError,
-    };
-
-    await common.runInActions(testAction);
-
-    // These always should have been called once.
-    t.true(getActionsLogger.calledOnce);
-    t.true(getEnv.calledOnce);
-    t.true(getActionsEnv.calledOnce);
-
-    const expectedActionState = {
-      actions: actionsEnv,
-      env,
-      logger,
-      name: ActionName.Init,
-    };
-
-    t.true(getJobUUID.calledOnceWithExactly(sinon.match(expectedActionState)));
-    t.true(run.calledOnceWithExactly(sinon.match(expectedActionState)));
-
-    t.is(setFailed.calledOnce, expectFailure ?? false);
-    t.is(sendUnhandledErrorStatusReport.calledOnce, expectFailure ?? false);
-
-    if (expectFailure) {
-      t.true(
-        setFailed.calledOnceWithExactly(
-          `${statusReport.getDisplayActionName(name)} action failed: ${opts?.expectedErrorMessage}`,
-        ),
-      );
-      t.true(
-        sendUnhandledErrorStatusReport.calledOnceWithExactly(
-          name,
-          sinon.match.any,
-          opts?.expectedTelemetryError ?? opts?.expectedErrorMessage,
-          logger,
-        ),
-      );
-    }
-  },
-  title: (providedTitle) => `runInActions - ${providedTitle}`,
-});
-
-runInActionsMacro.serial("calls run", {});
-runInActionsMacro.serial("handles run exceptions", {
-  runFn: () => {
-    throw new Error("Test failure");
-  },
-  expectedErrorMessage: "Test failure",
-});
-runInActionsMacro.serial("transforms run exceptions", {
-  runFn: () => {
-    throw new Error("Test failure");
-  },
-  expectedErrorMessage: "Test failure",
-  expectedTelemetryError: "Transformed failure message",
-});

src/action-common.ts

@@ -8,10 +8,9 @@ import { getActionsLogger, Logger } from "./logging";
 import {
   ActionName,
   getDisplayActionName,
-  getJobUUID,
   sendUnhandledErrorStatusReport,
 } from "./status-report";
-import { getEnv, getErrorMessage, wrapError } from "./util";
+import { getEnv, getErrorMessage } from "./util";
 
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
@@ -19,10 +18,6 @@ export interface BaseState {
   name: ActionName;
   /** When the Action was started. */
   startedAt: Date;
-  /** The platform the Action is running on. */
-  platform: NodeJS.Platform;
-  /** The architecture of the host. */
-  arch: NodeJS.Architecture;
 }
 
 /** Describes different state features that an Action may have. */
@@ -83,12 +78,6 @@ export interface Action {
   name: ActionName;
   /** The entry point for the Action. */
   run: ActionMain;
-  /**
-   * An optional function that transforms a caught error into a message suitable for
-   * inclusion in a status report. This is primarily intended for the `start-proxy`
-   * action to replace the thrown `Error`'s message with a safe one.
-   */
-  transformTelemetryError?: (error: Error) => string;
 }
 
 /** A generic entry point that sets up the basic environment for the `action` and runs it. */
@@ -99,34 +88,17 @@ export async function runInActions(action: Action) {
   const actionsEnv = getActionsEnv();
 
   try {
-    const actionState = {
+    await action.run({
       name: action.name,
       startedAt,
-      platform: process.platform,
-      arch: process.arch,
       logger,
       env,
       actions: actionsEnv,
-    };
-
-    // Create a unique identifier for this run.
-    getJobUUID(actionState);
-
-    await action.run(actionState);
+    });
   } catch (error) {
     core.setFailed(
       `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`,
     );
-
-    const statusReportError =
-      action.transformTelemetryError !== undefined
-        ? action.transformTelemetryError(wrapError(error))
-        : error;
-    await sendUnhandledErrorStatusReport(
-      action.name,
-      startedAt,
-      statusReportError,
-      logger,
-    );
+    await sendUnhandledErrorStatusReport(action.name, startedAt, error, logger);
   }
 }

src/actions-util.ts

@@ -7,14 +7,13 @@ import * as github from "@actions/github";
 import * as io from "@actions/io";
 
 import type { Config } from "./config-utils";
-import { Env, EnvVar, ActionsEnvVars, ReadOnlyEnv } from "./environment";
+import { Env, EnvVar, ActionsEnvVars } from "./environment";
 import { Logger } from "./logging";
 import {
   doesDirectoryExist,
   getCodeQLDatabasePath,
   ConfigurationError,
   getEnv,
-  getErrorMessage,
 } from "./util";
 
 /**
@@ -28,20 +27,14 @@ declare const __CODEQL_ACTION_VERSION__: string;
  * global functions in tests.
  */
 export interface ActionsEnv {
-  getRequiredInput: (name: string) => string;
   getOptionalInput: (name: string) => string | undefined;
-  exportVariable: (name: string, value: string) => void;
 }
 
 /**
  * Gets the real `ActionsEnv` used by production code.
  */
 export function getActionsEnv(): ActionsEnv {
-  return {
-    getRequiredInput,
-    getOptionalInput,
-    exportVariable: core.exportVariable,
-  };
+  return { getOptionalInput };
 }
 
 /**
@@ -284,19 +277,6 @@ export function isSelfHostedRunner(env: Env = getEnv()) {
   return env.getOptional(ActionsEnvVars.RUNNER_ENVIRONMENT) === "self-hosted";
 }
 
-/**
- * Whether the job is running on a runner that GitHub hosts, and whose toolcache is therefore thrown
- * away once the job has finished.
- *
- * Unlike `looksLikeHostedRunner`, this is based on what the service reports for the job rather than
- * on how the runner's filesystem happens to be laid out, so it does not match self-hosted runners
- * that are configured to resemble hosted ones, such as those that mount a persistent volume at
- * `/opt/hostedtoolcache`.
- */
-export function isGitHubHostedRunner(env: ReadOnlyEnv = getEnv()) {
-  return env.getOptional(ActionsEnvVars.RUNNER_ENVIRONMENT) === "github-hosted";
-}
-
 /** Determines whether the workflow trigger is `dynamic`. */
 export function isDynamicWorkflow(env: Env = getEnv()): boolean {
   return getWorkflowEventName(env) === "dynamic";
@@ -413,23 +393,14 @@ export const persistInputs = function (env: Env = getEnv()) {
 /**
  * Restores all inputs to the action from the persisted state.
  */
-export function restoreInputs(logger: Logger) {
-  try {
-    const persistedInputsValue = core.getState(persistedInputsKey);
-    if (persistedInputsValue) {
-      const persistedInputs = JSON.parse(persistedInputsValue);
-
-      for (const [name, value] of persistedInputs) {
-        process.env[name] = value;
-      }
+export const restoreInputs = function () {
+  const persistedInputs = core.getState(persistedInputsKey);
+  if (persistedInputs) {
+    for (const [name, value] of JSON.parse(persistedInputs)) {
+      process.env[name] = value;
     }
-  } catch (err) {
-    logger.error(`Unable to restore inputs: ${getErrorMessage(err)}`);
-    throw new Error(
-      "Failed to restore inputs from the state set by this action's main execution.",
-    );
   }
-}
+};
 
 export interface PullRequestBranches {
   base: string;

src/analyze-action-post.ts

@@ -25,8 +25,8 @@ export async function runWrapper() {
   // possible, and only use safe functions outside.
 
   try {
+    actionsUtil.restoreInputs();
     const logger = getActionsLogger();
-    actionsUtil.restoreInputs(logger);
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);
 
@@ -38,7 +38,7 @@ export async function runWrapper() {
         logger,
       );
       if (config !== undefined) {
-        const codeql = await getCodeQL(logger, config.codeQLCmd);
+        const codeql = await getCodeQL(config.codeQLCmd);
         const version = await codeql.getVersion();
         await debugArtifacts.uploadCombinedSarifArtifacts(
           logger,

src/analyze-action.ts

@@ -212,11 +212,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
   await runAutobuild(config, BuiltInLanguage.go, logger);
 }
 
-async function run({
-  startedAt,
-  logger,
-  actions,
-}: ActionState<["Base", "Logger", "Actions"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
 
@@ -259,7 +255,7 @@ async function run({
       );
     }
 
-    const codeql = await getCodeQL(logger, config.codeQLCmd);
+    const codeql = await getCodeQL(config.codeQLCmd);
 
     if (hasBadExpectErrorInput()) {
       throw new util.ConfigurationError(
@@ -311,13 +307,8 @@ async function run({
       logger,
     );
 
-    const checkoutPath = actions.getRequiredInput("checkout_path");
-
     // Setup diff informed analysis if needed (based on whether init created the file)
-    const diffRangePackDir = await setupDiffInformedQueryRun(
-      logger,
-      checkoutPath,
-    );
+    const diffRangePackDir = await setupDiffInformedQueryRun(logger);
 
     await warnIfGoInstalledAfterInit(config, logger);
     await runAutobuildIfLegacyGoWorkflow(config, logger);
@@ -363,6 +354,7 @@ async function run({
       actionsUtil.getOptionalInput("upload"),
     );
     if (runStats) {
+      const checkoutPath = actionsUtil.getRequiredInput("checkout_path");
       const category = actionsUtil.getOptionalInput("category");
 
       uploadResults = await postProcessAndUploadSarif(
@@ -396,23 +388,18 @@ async function run({
     // Possibly upload the overlay-base database to actions cache.
     // Note: Take care with the ordering of this call since databases may be cleaned up
     // at the `overlay` level.
-    await cleanupAndUploadOverlayBaseDatabaseToCache(
-      codeql,
-      config,
-      logger,
-      checkoutPath,
-    );
+    await cleanupAndUploadOverlayBaseDatabaseToCache(codeql, config, logger);
 
     // Possibly upload the database bundles for remote queries.
     // Note: Take care with the ordering of this call since databases may be cleaned up
     // at the `overlay` or `clear` level.
     databaseUploadResults = await cleanupAndUploadDatabases(
-      { logger, features },
       repositoryNwo,
       codeql,
       config,
       apiDetails,
-      checkoutPath,
+      features,
+      logger,
     );
 
     // Possibly upload the TRAP caches for later re-use

src/analyze.test.ts

@@ -7,12 +7,12 @@ import * as sinon from "sinon";
 import { CodeQuality, CodeScanning, RiskAssessment } from "./analyses";
 import {
   runQueries,
+  defaultSuites,
   resolveQuerySuiteAlias,
   addSarifExtension,
   diffRangeExtensionPackContents,
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
-import { defaultSuites } from "./config/db-config";
 import { Feature } from "./feature-flags";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";

src/analyze.ts

@@ -5,11 +5,10 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";
 
-import { getTemporaryDirectory } from "./actions-util";
+import { getTemporaryDirectory, getRequiredInput } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
-import { defaultSuites } from "./config/db-config";
 import * as configUtils from "./config-utils";
 import {
   getCsharpTempDependencyDir,
@@ -234,7 +233,6 @@ async function finalizeDatabaseCreation(
  */
 export async function setupDiffInformedQueryRun(
   logger: Logger,
-  checkoutPath: string,
 ): Promise<string | undefined> {
   return await withGroupAsync(
     "Generating diff range extension pack",
@@ -247,6 +245,7 @@ export async function setupDiffInformedQueryRun(
         return undefined;
       }
 
+      const checkoutPath = getRequiredInput("checkout_path");
       const packDir = writeDiffRangeDataExtensionPack(
         logger,
         diffRanges,
@@ -358,6 +357,15 @@ dataExtensions:
   return diffRangeDir;
 }
 
+// A set of default query suite names that are understood by the CLI.
+export const defaultSuites: Set<string> = new Set([
+  "security-experimental",
+  "security-extended",
+  "security-and-quality",
+  "code-quality",
+  "code-scanning",
+]);
+
 /**
  * If `maybeSuite` is the name of a default query suite, it is resolved into the corresponding
  * query suite name for the given `language`. Otherwise, `maybeSuite` is returned as is.

src/api-client.test.ts

@@ -111,115 +111,103 @@ test.serial("getGitHubVersion for GHEC-DR", async (t) => {
   t.deepEqual({ type: util.GitHubVariant.GHEC_DR }, gheDotcom);
 });
 
-test("wrapApiConfigurationError doesn't wrap errors it isn't supposed to", (t) => {
-  const unwrappedErrors = [
+test.serial(
+  "wrapApiConfigurationError correctly wraps specific configuration errors",
+  (t) => {
     // We don't reclassify arbitrary errors
-    new Error("arbitrary error"),
-    // Same goes for arbitrary strings
-    "arbitrary error",
-    // If an HTTP error doesn't contain a specific error message, we don't wrap it.
-    new util.HTTPError("arbitrary HTTP error", 456),
-  ];
+    const arbitraryError = new Error("arbitrary error");
+    let res = api.wrapApiConfigurationError(arbitraryError);
+    t.is(res, arbitraryError);
 
-  for (const unwrappedError of unwrappedErrors) {
-    const res = api.wrapApiConfigurationError(unwrappedError);
-    t.is(
-      res,
-      unwrappedError,
-      `${util.getErrorMessage(unwrappedError)} should not be wrapped by wrapApiConfigurationError`,
+    // Same goes for arbitrary errors
+    const configError = new util.ConfigurationError("arbitrary error");
+    res = api.wrapApiConfigurationError(configError);
+    t.is(res, configError);
+
+    // If an HTTP error doesn't contain a specific error message, we don't
+    // wrap is an an API error.
+    const httpError = new util.HTTPError("arbitrary HTTP error", 456);
+    res = api.wrapApiConfigurationError(httpError);
+    t.is(res, httpError);
+
+    // For other HTTP errors, we wrap them as Configuration errors if they contain
+    // specific error messages.
+    const httpNotFoundError = new util.HTTPError("commit not found", 404);
+    res = api.wrapApiConfigurationError(httpNotFoundError);
+    t.deepEqual(res, new util.ConfigurationError("commit not found"));
+
+    const refNotFoundError = new util.HTTPError(
+      "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
+      404,
+    );
+    res = api.wrapApiConfigurationError(refNotFoundError);
+    t.deepEqual(
+      res,
+      new util.ConfigurationError(
+        "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
+      ),
     );
-  }
-});
 
-test("wrapApiConfigurationError correctly wraps specific configuration errors", (t) => {
-  // For other HTTP errors, we wrap them as Configuration errors if they contain
-  // specific error messages.
-  const httpNotFoundError = new util.HTTPError("commit not found", 404);
-  const refNotFoundError = new util.HTTPError(
-    "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
-    404,
-  );
-  const apiRateLimitError = new util.HTTPError(
-    "API rate limit exceeded for installation",
-    403,
-  );
-  const resourceNotAccessibleError = new util.HTTPError(
-    "Resource not accessible by integration",
-    403,
-  );
-  const errorsToWrap = [
-    httpNotFoundError,
-    refNotFoundError,
-    apiRateLimitError,
-    resourceNotAccessibleError,
-  ];
+    const apiRateLimitError = new util.HTTPError(
+      "API rate limit exceeded for installation",
+      403,
+    );
+    res = api.wrapApiConfigurationError(apiRateLimitError);
+    t.deepEqual(
+      res,
+      new util.ConfigurationError("API rate limit exceeded for installation"),
+    );
 
-  for (const errorToWrap of errorsToWrap) {
-    const res = api.wrapApiConfigurationError(errorToWrap);
-    t.deepEqual(res, new util.ConfigurationError(errorToWrap.message));
-  }
-});
-
-test("wrapApiConfigurationError wraps token errors", async (t) => {
-  const tokenSuggestionMessage =
-    "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
-  const badCredentialsError = new util.HTTPError("Bad credentials", 401);
-  const notFoundError = new util.HTTPError("Not Found", 404);
-  const errorsToWrap = [badCredentialsError, notFoundError];
-
-  for (const errorToWrap of errorsToWrap) {
-    const res = api.wrapApiConfigurationError(errorToWrap);
+    const tokenSuggestionMessage =
+      "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
+    const badCredentialsError = new util.HTTPError("Bad credentials", 401);
+    res = api.wrapApiConfigurationError(badCredentialsError);
     t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
-  }
-});
 
-test("wrapApiConfigurationError wraps enablement errors", async (t) => {
-  // Enablement errors.
-  const enablementErrorMessages = [
-    "Code Security must be enabled for this repository to use code scanning",
-    "Advanced Security must be enabled for this repository to use code scanning",
-    "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
-    "Code quality is not enabled for this repository. Please enable code quality in the repository settings.",
-  ];
-  const transforms = [
-    (msg: string) => msg,
-    (msg: string) => msg.toLowerCase(),
-    (msg: string) => msg.toLocaleUpperCase(),
-  ];
+    const notFoundError = new util.HTTPError("Not Found", 404);
+    res = api.wrapApiConfigurationError(notFoundError);
+    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
 
-  for (const enablementErrorMessage of enablementErrorMessages) {
-    for (const transform of transforms) {
-      const enablementError = new util.HTTPError(
-        transform(enablementErrorMessage),
-        403,
-      );
-      const res = api.wrapApiConfigurationError(enablementError);
-      t.deepEqual(
-        res,
-        new util.ConfigurationError(
-          api.getFeatureEnablementError(enablementError.message),
-        ),
-      );
+    const resourceNotAccessibleError = new util.HTTPError(
+      "Resource not accessible by integration",
+      403,
+    );
+    res = api.wrapApiConfigurationError(resourceNotAccessibleError);
+    t.deepEqual(
+      res,
+      new util.ConfigurationError("Resource not accessible by integration"),
+    );
+
+    // Enablement errors.
+    const enablementErrorMessages = [
+      "Code Security must be enabled for this repository to use code scanning",
+      "Advanced Security must be enabled for this repository to use code scanning",
+      "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
+      "Code quality is not enabled for this repository. Please enable code quality in the repository settings.",
+    ];
+    const transforms = [
+      (msg: string) => msg,
+      (msg: string) => msg.toLowerCase(),
+      (msg: string) => msg.toLocaleUpperCase(),
+    ];
+
+    for (const enablementErrorMessage of enablementErrorMessages) {
+      for (const transform of transforms) {
+        const enablementError = new util.HTTPError(
+          transform(enablementErrorMessage),
+          403,
+        );
+        res = api.wrapApiConfigurationError(enablementError);
+        t.deepEqual(
+          res,
+          new util.ConfigurationError(
+            api.getFeatureEnablementError(enablementError.message),
+          ),
+        );
+      }
     }
-  }
-});
-
-test("wrapApiConfigurationError doesn't double-wrap errors", async (t) => {
-  // This test checks that errors don't get wrapped a second time if `wrapApiConfigurationError`
-  // is called on an error that was already wrapped by a previous call to `wrapApiConfigurationError`.
-  // Start by calling `wrapApiConfigurationError` on an unwrapped error that should be wrapped:
-  const unwrappedError = new util.HTTPError("commit not found", 404);
-  const wrappedError = api.wrapApiConfigurationError(unwrappedError);
-
-  // Sanity-check that it was wrapped, as expected.
-  t.deepEqual(
-    wrappedError,
-    new util.ConfigurationError(unwrappedError.message),
-  );
-
-  // The result of the second call should be exactly `wrappedError`:
-  t.is(api.wrapApiConfigurationError(wrappedError), wrappedError);
-});
+  },
+);
 
 test("getRegistryProxy - returns undefined if the proxy is not configured", async (t) => {
   const target = callee(api.getRegistryProxy).withArgs();

src/api-client.ts

@@ -1,5 +1,8 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
+import { type Octokit } from "@octokit/core";
+import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
+import { type Api } from "@octokit/plugin-rest-endpoint-methods";
 import * as retry from "@octokit/plugin-retry";
 import { RequestRequestOptions } from "@octokit/types";
 import {
@@ -125,7 +128,7 @@ export function makeProxyRequestOptions(
 }
 
 /** The type of GitHub API client we use. */
-export type ApiClient = InstanceType<typeof githubUtils.GitHub>;
+export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
 
 /** Options for `createApiClientWithDetails`. */
 interface CreateApiClientOptions {
@@ -219,31 +222,25 @@ export async function getGitHubVersionFromApi(
     return { type: GitHubVariant.DOTCOM };
   }
 
-  try {
-    // Doesn't strictly have to be the meta endpoint as we're only
-    // using the response headers which are available on every request.
-    //
-    // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
-    const response = await apiClient.rest.meta.get();
+  // Doesn't strictly have to be the meta endpoint as we're only
+  // using the response headers which are available on every request.
+  //
+  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+  const response = await apiClient.rest.meta.get();
 
-    // This happens on dotcom, although we expect to have already returned in that
-    // case. This can also serve as a fallback in cases we haven't foreseen.
-    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
-      return { type: GitHubVariant.DOTCOM };
-    }
-
-    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
-      return { type: GitHubVariant.GHEC_DR };
-    }
-
-    const version = response.headers[
-      GITHUB_ENTERPRISE_VERSION_HEADER
-    ] as string;
-    return { type: GitHubVariant.GHES, version };
-  } catch (err) {
-    throw wrapApiConfigurationError(err);
+  // This happens on dotcom, although we expect to have already returned in that
+  // case. This can also serve as a fallback in cases we haven't foreseen.
+  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
+    return { type: GitHubVariant.DOTCOM };
   }
+
+  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
+    return { type: GitHubVariant.GHEC_DR };
+  }
+
+  const version = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] as string;
+  return { type: GitHubVariant.GHES, version };
 }
 
 /**
@@ -255,10 +252,9 @@ export async function getGitHubVersionFromApi(
  */
 export async function getGitHubVersion(): Promise<GitHubVersion> {
   if (cachedGitHubVersion === undefined) {
-    const apiDetails = getApiDetails();
     cachedGitHubVersion = await getGitHubVersionFromApi(
-      createApiClientWithDetails(apiDetails),
-      apiDetails,
+      getApiClient(),
+      getApiDetails(),
     );
   }
   return cachedGitHubVersion;
@@ -421,14 +417,7 @@ export function getFeatureEnablementError(message: string): string {
   return `Please verify that the necessary features are enabled: ${message}`;
 }
 
-/**
- * Decides whether `e` is a known error returned by the GitHub API that we should
- * classify as a `ConfigurationError`.
- *
- * @param e The error to classify.
- * @returns Either `e` or a corresponding `ConfigurationError`.
- */
-export function wrapApiConfigurationError<T>(e: T): T | ConfigurationError {
+export function wrapApiConfigurationError(e: unknown) {
   const httpError = asHTTPError(e);
   if (httpError !== undefined) {
     if (

src/api-compatibility.json

@@ -1 +1 @@
-{"maximumVersion":"3.23","minimumVersion":"3.18"}
+{"maximumVersion": "3.22", "minimumVersion": "3.17"}

src/autobuild-action.ts

@@ -99,7 +99,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
       );
     }
 
-    const codeql = await getCodeQL(logger, config.codeQLCmd);
+    const codeql = await getCodeQL(config.codeQLCmd);
 
     languages = await determineAutobuildLanguages(codeql, config, logger);
     if (languages !== undefined) {

src/autobuild.ts

@@ -155,7 +155,7 @@ export async function runAutobuild(
   logger: Logger,
 ) {
   logger.startGroup(`Attempting to automatically build ${language} code`);
-  const codeQL = await getCodeQL(logger, config.codeQLCmd);
+  const codeQL = await getCodeQL(config.codeQLCmd);
   if (language === BuiltInLanguage.cpp) {
     await setupCppAutobuild(codeQL, logger);
   }

src/caching-utils.ts

@@ -5,7 +5,7 @@ import * as core from "@actions/core";
 import { getOptionalInput, isDefaultSetup } from "./actions-util";
 import { EnvVar } from "./environment";
 import { Logger } from "./logging";
-import { looksLikeHostedRunner, tryGetFolderBytes } from "./util";
+import { isHostedRunner, tryGetFolderBytes } from "./util";
 
 /**
  * Returns the total size of all the specified paths.
@@ -109,7 +109,7 @@ export function getDependencyCachingEnabled(): CachingKind {
   if (dependencyCaching !== undefined) return getCachingKind(dependencyCaching);
 
   // On self-hosted runners which may have dependencies installed centrally, disable caching by default
-  if (!looksLikeHostedRunner()) return CachingKind.None;
+  if (!isHostedRunner()) return CachingKind.None;
 
   // Disable in advanced workflows by default.
   if (!isDefaultSetup()) return CachingKind.None;

src/cli-errors.test.ts

@@ -128,6 +128,7 @@ test("CliError constructor with empty stderr", (t) => {
 
 for (const [platform, arch] of [
   ["weird_plat", "x64"],
+  ["linux", "arm64"],
   ["win32", "arm64"],
 ]) {
   test.serial(
@@ -156,34 +157,20 @@ for (const [platform, arch] of [
   );
 }
 
-for (const [platform, arch] of [
-  ["linux", "x64"],
-  ["linux", "arm64"],
-  ["win32", "x64"],
-  ["darwin", "x64"],
-  ["darwin", "arm64"],
-]) {
-  test.serial(
-    `wrapCliConfigurationError - ${platform}/${arch} supported`,
-    (t) => {
-      sinon.stub(process, "platform").value(platform);
-      sinon.stub(process, "arch").value(arch);
-      const commandError = new CommandInvocationError(
-        "codeql",
-        ["version"],
-        1,
-        "Some error",
-      );
-      const cliError = new CliError(commandError);
-
-      const wrappedError = wrapCliConfigurationError(cliError);
-
-      // Should return the original error since the platform is supported, rather
-      // than replacing it with the unsupported-platform ConfigurationError.
-      t.is(wrappedError, cliError);
-    },
+test("wrapCliConfigurationError - supported platform", (t) => {
+  const commandError = new CommandInvocationError(
+    "codeql",
+    ["version"],
+    1,
+    "Some error",
   );
-}
+  const cliError = new CliError(commandError);
+
+  const wrappedError = wrapCliConfigurationError(cliError);
+
+  // Should return the original error since platform is supported
+  t.is(wrappedError, cliError);
+});
 
 test("wrapCliConfigurationError - autobuild error", (t) => {
   const commandError = new CommandInvocationError(

src/cli-errors.ts

@@ -8,7 +8,6 @@ import { ConfigurationError } from "./util";
 
 const SUPPORTED_PLATFORMS = [
   ["linux", "x64"],
-  ["linux", "arm64"],
   ["win32", "x64"],
   ["darwin", "x64"],
   ["darwin", "arm64"],

src/cli/output-cache.test.ts

@@ -1,123 +0,0 @@
-import * as fs from "fs";
-import path from "path";
-
-import test from "ava";
-
-import { getRunnerLogger } from "../logging";
-import { setupTests } from "../testing-utils";
-import * as util from "../util";
-
-import { getCachedCodeQlVersion } from "./output-cache";
-
-setupTests(test);
-
-const logger = getRunnerLogger(true);
-
-test.serial(
-  "getCachedCodeQlVersion reuses a version persisted by an earlier step",
-  async (t) => {
-    await util.withTmpDir(async (tmpDir: string) => {
-      const cacheFilePath = path.join(tmpDir, "cache.json");
-
-      fs.writeFileSync(
-        cacheFilePath,
-        JSON.stringify({
-          cmd: "/path/to/codeql",
-          entries: { version: { version: "2.20.0" } },
-        }),
-        "utf8",
-      );
-      t.deepEqual(
-        getCachedCodeQlVersion(logger, cacheFilePath, "/path/to/codeql"),
-        {
-          version: "2.20.0",
-        },
-      );
-    });
-  },
-);
-
-test.serial(
-  "getCachedCodeQlVersion ignores a persisted version from a different CLI",
-  async (t) => {
-    await util.withTmpDir(async (tmpDir: string) => {
-      const cacheFilePath = path.join(tmpDir, "cache.json");
-      fs.writeFileSync(
-        cacheFilePath,
-        JSON.stringify({
-          cmd: "/path/to/other-codeql",
-          entries: { version: { version: "2.20.0" } },
-        }),
-        "utf8",
-      );
-      t.is(
-        getCachedCodeQlVersion(logger, cacheFilePath, "/path/to/codeql"),
-        undefined,
-      );
-    });
-  },
-);
-
-test.serial(
-  "getCachedCodeQlVersion ignores a malformed persisted value",
-  async (t) => {
-    await util.withTmpDir(async (tmpDir: string) => {
-      const cacheFilePath = path.join(tmpDir, "cache.json");
-      fs.writeFileSync(cacheFilePath, "not valid json", "utf8");
-      t.is(
-        getCachedCodeQlVersion(logger, cacheFilePath, "/path/to/codeql"),
-        undefined,
-      );
-    });
-  },
-);
-
-test.serial(
-  "getCachedCodeQlVersion ignores a persisted value with the wrong structure",
-  async (t) => {
-    await util.withTmpDir(async (tmpDir: string) => {
-      const cacheFilePath = path.join(tmpDir, "cache.json");
-      const testValues = [
-        { cmd: "/path/to/codeql" },
-        { entries: { version: { version: "2.20.0" } } },
-        { cmd: "/path/to/codeql", entries: {} },
-        { cmd: "/path/to/codeql", entries: null },
-        { cmd: "/path/to/codeql", entries: { version: {} } },
-        { cmd: "/path/to/codeql", entries: { version: null } },
-        { cmd: "/path/to/codeql", entries: { version: "2.20.0" } },
-        { cmd: "/path/to/codeql", entries: { version: { version: null } } },
-        { cmd: "/path/to/codeql", entries: { version: { version: 2.2 } } },
-        { cmd: "/path/to/codeql", entries: { version: { version: 2 } } },
-        {
-          cmd: "/path/to/codeql",
-          entries: { version: { version: "2.20.0", overlayVersion: "1" } },
-        },
-        {
-          cmd: "/path/to/codeql",
-          entries: { version: { version: "2.20.0", features: "nope" } },
-        },
-      ].map((v) => JSON.stringify(v));
-
-      for (const value of testValues) {
-        fs.writeFileSync(cacheFilePath, value, "utf8");
-        t.is(
-          getCachedCodeQlVersion(logger, cacheFilePath, "/path/to/codeql"),
-          undefined,
-          value,
-        );
-      }
-    });
-  },
-);
-
-test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => {
-  await util.withTmpDir(async (tmpDir: string) => {
-    const cacheFilePath = path.join(tmpDir, "cache.json");
-    t.notThrows(() => {
-      t.is(
-        getCachedCodeQlVersion(logger, cacheFilePath, "/path/to/codeql"),
-        undefined,
-      );
-    });
-  });
-});

src/cli/output-cache.ts

@@ -1,146 +0,0 @@
-import * as fs from "fs";
-import path from "path";
-
-import { getTemporaryDirectory } from "../actions-util";
-import { Env } from "../environment";
-import * as json from "../json";
-import { Logger } from "../logging";
-
-import { VersionInfo, versionInfoBaseSchema } from "./types";
-
-/**
- * The keys of the command cache. Each key corresponds to a command whose output we cache.
- */
-export type CommandCacheKey = string;
-
-/**
- * The JSON schema of the command cache that is persisted to disk.
- */
-const outputCacheSchema = {
-  cmd: json.string,
-  entries: json.object({}),
-} as const satisfies json.Schema;
-
-/**
- * The type that describes the command cache that is persisted to disk.
- */
-export type OutputCache = json.FromSchema<typeof outputCacheSchema> & {
-  entries: { version: VersionInfo };
-};
-
-/**
- * The name of the temporary file that backs the on-disk cache of
- * CLI responses between workflow steps.
- */
-const COMMAND_CACHE_FILENAME = "codeql-action-command-cache.json";
-
-/**
- * The module-global variable that caches the CodeQL CLI version in-memory.
- */
-let cachedCodeQlVersion: undefined | VersionInfo = undefined;
-
-/**
- * Resets the in-process cache of the CodeQL CLI version. Only for use in tests,
- * which exercise multiple "steps" within a single process.
- */
-export function resetCachedCodeQlVersion(): void {
-  cachedCodeQlVersion = undefined;
-}
-
-/**
- * Returns the path to the temporary file that backs the
- * on-disk cache of CLI responses between workflow steps.
- */
-export function getCommandCacheFilePath(env: Env): string {
-  return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
-}
-
-/**
- * Caches the CodeQL CLI version both in-memory and on disk.
- * @param cacheFilePath The path to the cache file.
- * @param cmd The path to the CodeQL CLI.
- * @param version The version information to cache.
- */
-export function cacheCodeQlVersion(
-  cacheFilePath: string,
-  cmd: string,
-  version: VersionInfo,
-): void {
-  if (cachedCodeQlVersion !== undefined) {
-    throw new Error("cacheCodeQlVersion() should be called only once");
-  }
-  cachedCodeQlVersion = version;
-  const outputCache = {
-    cmd,
-    entries: { version },
-  } satisfies OutputCache;
-  // Persist the version so that subsequent Actions steps, which run in separate
-  // processes, can reuse it rather than invoking `codeql version` again. We
-  // record the CLI path so that a different step using a different CodeQL bundle
-  // doesn't pick up a stale version.
-  fs.writeFileSync(cacheFilePath, JSON.stringify(outputCache), "utf8");
-}
-
-/**
- * Returns the cached CodeQL CLI version, if any.
- * @param logger The logger to use for logging messages.
- * @param cacheFilePath The path to the cache file.
- * @param cmd The path to the CodeQL CLI.
- */
-export function getCachedCodeQlVersion(
-  logger: Logger,
-  cacheFilePath: string,
-  cmd?: string,
-): undefined | VersionInfo {
-  if (cachedCodeQlVersion !== undefined) {
-    return cachedCodeQlVersion;
-  }
-  // Fall back to the value persisted by an earlier Actions step, if any. This is
-  // best-effort: any malformed or mismatched value is ignored so that the caller
-  // invokes `codeql version` instead.
-  let serialized: string;
-  try {
-    serialized = fs.readFileSync(cacheFilePath, "utf8");
-  } catch (e) {
-    logger.debug(`Cannot read CLI-cache file ${cacheFilePath}: ${e}`);
-    return undefined;
-  }
-  let persisted: unknown;
-  try {
-    persisted = JSON.parse(serialized);
-  } catch (e) {
-    logger.debug(`Cannot parse CLI-cache data as JSON: ${e}`);
-    return undefined;
-  }
-  if (
-    !isOutputCache(persisted) ||
-    (cmd !== undefined && persisted.cmd !== cmd)
-  ) {
-    return undefined;
-  }
-  // Memoize the parsed value so that subsequent calls in this process don't
-  // re-parse the environment variable.
-  cachedCodeQlVersion = persisted.entries.version as VersionInfo;
-  return cachedCodeQlVersion;
-}
-
-/**
- * Determines whether a value is a `VersionInfo` object.
- * @param x The value to test
- */
-function isVersionInfo(x: unknown): x is VersionInfo {
-  return json.isObject(x) && json.validateSchema(versionInfoBaseSchema, x);
-}
-
-/**
- * Determines whether a value is a `OutputCache` object.
- * @param x The value to test
- */
-function isOutputCache(x: unknown): x is OutputCache {
-  return (
-    json.isObject(x) &&
-    json.validateSchema(outputCacheSchema, x) &&
-    json.isObject<{ version: unknown }>(x.entries) &&
-    isVersionInfo(x.entries.version)
-  );
-}

src/cli/types.ts

@@ -1,30 +0,0 @@
-import * as json from "../json";
-
-/**
- * The JSON schema of the expected output of the `codeql version` command.
- */
-export const versionInfoBaseSchema = {
-  version: json.string,
-  features: json.optional(json.object({})),
-  /**
-   * The overlay version helps deal with backward incompatible changes for
-   * overlay analysis. When a precompiled query pack reports the same overlay
-   * version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay
-   * analysis with that pack. Otherwise, if the overlay versions are different,
-   * or if either the pack or the CLI does not report an overlay version,
-   * we need to revert to non-overlay analysis.
-   */
-  overlayVersion: json.optional(json.number),
-} as const satisfies json.Schema;
-
-/**
- * The base type that describes the expected output of the `codeql version` command.
- */
-export type VersionInfoBase = json.FromSchema<typeof versionInfoBaseSchema>;
-
-/**
- * The full type that describes the expected output of the `codeql version` command.
- */
-export type VersionInfo = Omit<VersionInfoBase, "features"> & {
-  features?: { [name: string]: boolean };
-};

src/codeql-bundle.test.ts

@@ -1,75 +0,0 @@
-import test from "ava";
-
-import { getCodeQLBundleFromUrl, getCodeQLBundleName } from "./codeql-bundle";
-import { BuiltInLanguage } from "./languages";
-import { BundlePlatform } from "./platform";
-
-test("getCodeQLBundleName returns a per-language bundle name only when a language is specified", (t) => {
-  t.is(
-    getCodeQLBundleName("zstd", BundlePlatform.Linux64, BuiltInLanguage.java),
-    "codeql-bundle-java-linux64.tar.zst",
-  );
-  t.is(
-    getCodeQLBundleName("zstd", BundlePlatform.Linux64),
-    "codeql-bundle-linux64.tar.zst",
-  );
-});
-
-test("getCodeQLBundleName names the Swift bundle for macOS", (t) => {
-  t.is(
-    getCodeQLBundleName("zstd", BundlePlatform.Osx64, BuiltInLanguage.swift),
-    "codeql-bundle-swift-osx64.tar.zst",
-  );
-});
-
-for (const [assetName, language] of [
-  ["codeql-bundle-java-linux64.tar.zst", BuiltInLanguage.java],
-  ["codeql-bundle-swift-osx64.tar.zst", BuiltInLanguage.swift],
-  // Recognize unpublished language/platform combinations to keep them out of the toolcache.
-  ["codeql-bundle-csharp-win64.tar.gz", BuiltInLanguage.csharp],
-  ["codeql-bundle-java-kotlin-linux64.tar.zst", BuiltInLanguage.java],
-  ["codeql-bundle-%70ython-linux64.tar.zst", BuiltInLanguage.python],
-] as const) {
-  test(`getCodeQLBundleFromUrl identifies ${assetName} without adding a fallback`, (t) => {
-    const url = `https://github.com/github/codeql-action/releases/download/codeql-bundle-v1.2.3/${assetName}`;
-    t.deepEqual(getCodeQLBundleFromUrl(url), {
-      kind: "per-language",
-      url,
-      language,
-    });
-  });
-}
-
-test("getCodeQLBundleFromUrl preserves encoding, query parameters and fragments", (t) => {
-  const url =
-    "https://github.com/github/codeql-action/releases/download/codeql-bundle-v1.2.3/codeql-bundle-%70ython-linux64.tar.zst?download=1#asset";
-  t.deepEqual(getCodeQLBundleFromUrl(url), {
-    kind: "per-language",
-    url,
-    language: BuiltInLanguage.python,
-  });
-});
-
-test("getCodeQLBundleFromUrl treats unrecognized assets as combined bundles", (t) => {
-  for (const name of [
-    "codeql-bundle-linux64.tar.zst",
-    "codeql-bundle-osx64.tar.gz",
-    "codeql-bundle-win64.tar.zst",
-    // The all-platform bundle.
-    "codeql-bundle.tar.gz",
-    // A platform we do not publish per-language bundles for, whose name also contains a hyphen.
-    "codeql-bundle-linux-arm64.tar.zst",
-    // Not a language we know about.
-    "codeql-bundle-cobol-linux64.tar.zst",
-    // A name we cannot decode must not be mistaken for a language either.
-    "codeql-bundle-%zz-linux64.tar.zst",
-  ]) {
-    const url = `https://github.com/github/codeql-action/releases/download/codeql-bundle-v1.2.3/${name}`;
-    t.deepEqual(getCodeQLBundleFromUrl(url), { kind: "combined", url });
-  }
-});
-
-test("getCodeQLBundleFromUrl preserves URLs it cannot parse", (t) => {
-  const url = "not a url";
-  t.deepEqual(getCodeQLBundleFromUrl(url), { kind: "combined", url });
-});

src/codeql-bundle.ts

@@ -1,71 +0,0 @@
-import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
-import { BundlePlatform } from "./platform";
-import type { CompressionMethod } from "./tar";
-
-/** Describes the contents and location of a downloadable CodeQL bundle. */
-export type CodeQLBundle =
-  | { kind: "combined"; url: string }
-  | {
-      kind: "per-language";
-      url: string;
-      language: BuiltInLanguage;
-      /** Only set when the Action selected the bundle, allowing a same-version fallback. */
-      combinedBundleURL?: string;
-    };
-
-/** A resolved download, including its bundle identity and version. */
-export interface CodeQLDownloadSource {
-  /** Distinguishes downloads from local archives and cached installations. */
-  sourceType: "download";
-  /** The bundle to download. */
-  bundle: CodeQLBundle;
-  /** The compression format of the bundle archive. */
-  compressionMethod: CompressionMethod;
-  /** Bundle version of the tools, if known. */
-  bundleVersion?: string;
-  /** Requested CLI version, if known. */
-  cliVersion?: string;
-  /** Resolved version for telemetry, independent of whether the bundle can be cached. */
-  toolsVersion: string;
-}
-
-/** Returns the exact bundle asset name for a platform and optional language. */
-export function getCodeQLBundleName(
-  compressionMethod: CompressionMethod,
-  platform: BundlePlatform | undefined,
-  language?: BuiltInLanguage,
-): string {
-  const extensions: Record<CompressionMethod, string> = {
-    gzip: ".tar.gz",
-    zstd: ".tar.zst",
-  };
-  const extension = extensions[compressionMethod];
-  if (platform === undefined) {
-    return `codeql-bundle${extension}`;
-  }
-  if (language !== undefined) {
-    return `codeql-bundle-${language}-${platform}${extension}`;
-  }
-  return `codeql-bundle-${platform}${extension}`;
-}
-
-const PER_LANGUAGE_BUNDLE_NAME =
-  /^codeql-bundle-(.+)-(?:linux64|osx64|win64)\.tar\.(?:gz|zst)$/;
-
-/** Classifies an explicit tools URL without changing it or adding a fallback. */
-export function getCodeQLBundleFromUrl(url: string): CodeQLBundle {
-  let assetName: string;
-  try {
-    const pathname = new URL(url).pathname;
-    // URL-encoded names must not bypass the toolcache safeguard.
-    assetName = decodeURIComponent(pathname.split("/").pop() ?? "");
-  } catch {
-    return { kind: "combined", url };
-  }
-
-  const match = assetName.match(PER_LANGUAGE_BUNDLE_NAME);
-  const language = match ? parseBuiltInLanguage(match[1]) : undefined;
-  return language === undefined
-    ? { kind: "combined", url }
-    : { kind: "per-language", url, language };
-}

src/codeql.test.ts

@@ -51,31 +51,6 @@ test.beforeEach(() => {
   });
 });
 
-test("isDiskConfigurationError - true for expected errors", async (t) => {
-  t.true(
-    codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")),
-  );
-  t.true(
-    codeql.isDiskConfigurationError(
-      new Error(
-        "EACCES: permission denied, mkdir /opt/hostedtoolcache/CodeQL/",
-      ),
-    ),
-  );
-});
-
-test("isDiskConfigurationError - false for other errors", async (t) => {
-  t.false(codeql.isDiskConfigurationError("Not an Error instance"));
-
-  const otherMessages = [
-    "Does not contain an error code we test for",
-    "ENOSP: Not quite the full error code",
-  ];
-  for (const otherMessage of otherMessages) {
-    t.false(codeql.isDiskConfigurationError(new Error(otherMessage)));
-  }
-});
-
 async function installIntoToolcache({
   apiDetails = SAMPLE_DOTCOM_API_DETAILS,
   cliVersion,
@@ -90,7 +65,7 @@ async function installIntoToolcache({
   tmpDir: string;
 }) {
   const url = mockBundleDownloadApi({ apiDetails, isPinned, tagName });
-  return await codeql.setupCodeQL(
+  await codeql.setupCodeQL(
     cliVersion !== undefined ? undefined : url,
     apiDetails,
     tmpDir,
@@ -99,7 +74,6 @@ async function installIntoToolcache({
       ? { enabledVersions: [{ cliVersion, tagName }] }
       : SAMPLE_DEFAULT_CLI_VERSION,
     undefined, // rawLanguages
-    undefined, // otherLanguagePacksReason
     false, // useOverlayAwareDefaultCliVersion
     createFeatures([]),
     getRunnerLogger(true),
@@ -173,7 +147,6 @@ test.serial(
           util.GitHubVariant.DOTCOM,
           SAMPLE_DEFAULT_CLI_VERSION,
           undefined, // rawLanguages
-          undefined, // otherLanguagePacksReason
           false, // useOverlayAwareDefaultCliVersion
           features,
           getRunnerLogger(true),
@@ -209,7 +182,6 @@ test.serial(
         util.GitHubVariant.DOTCOM,
         SAMPLE_DEFAULT_CLI_VERSION,
         undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
         getRunnerLogger(true),
@@ -249,7 +221,6 @@ test.serial(
         util.GitHubVariant.DOTCOM,
         SAMPLE_DEFAULT_CLI_VERSION,
         undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
         getRunnerLogger(true),
@@ -263,65 +234,6 @@ test.serial(
   },
 );
 
-for (const { cliVersion, tagName, expectedToolcacheVersion } of [
-  {
-    cliVersion: "2.21.0",
-    tagName: "codeql-bundle-20240101",
-    expectedToolcacheVersion: "2.21.0",
-  },
-  {
-    cliVersion: "2.21.0-rc.1",
-    tagName: "codeql-bundle-20240101",
-    expectedToolcacheVersion: "0.0.0-20240101",
-  },
-  {
-    cliVersion: "2.21.0+20240101",
-    tagName: "codeql-bundle-20240101",
-    expectedToolcacheVersion: "0.0.0-20240101",
-  },
-  {
-    cliVersion: "2.21.0",
-    tagName: "custom-release",
-    expectedToolcacheVersion: undefined,
-  },
-]) {
-  test.serial(
-    `preserves CLI version ${cliVersion} when installing ${tagName}`,
-    async (t) => {
-      await util.withTmpDir(async (tmpDir) => {
-        setupActionsVars(tmpDir, tmpDir);
-
-        const result = await installIntoToolcache({
-          cliVersion,
-          isPinned: false,
-          tagName,
-          tmpDir,
-        });
-
-        t.is(result.toolsVersion, cliVersion);
-        t.is(result.toolsSource, ToolsSource.Download);
-        t.true(
-          Number.isInteger(result.toolsDownloadStatusReport?.totalDurationMs),
-        );
-        t.deepEqual(
-          toolcache.findAllVersions("CodeQL"),
-          expectedToolcacheVersion === undefined
-            ? []
-            : [expectedToolcacheVersion],
-        );
-        if (expectedToolcacheVersion !== undefined) {
-          const cachedFolder = toolcache.find(
-            "CodeQL",
-            expectedToolcacheVersion,
-          );
-          t.truthy(cachedFolder);
-          t.true(fs.existsSync(`${cachedFolder}.complete`));
-        }
-      });
-    },
-  );
-}
-
 const EXPLICITLY_REQUESTED_BUNDLE_TEST_CASES = [
   {
     tagName: "codeql-bundle-2.17.6",
@@ -359,7 +271,6 @@ for (const {
           util.GitHubVariant.DOTCOM,
           SAMPLE_DEFAULT_CLI_VERSION,
           undefined, // rawLanguages
-          undefined, // otherLanguagePacksReason
           false, // useOverlayAwareDefaultCliVersion
           features,
           getRunnerLogger(true),
@@ -402,7 +313,6 @@ for (const toolcacheVersion of [
           util.GitHubVariant.DOTCOM,
           SAMPLE_DEFAULT_CLI_VERSION,
           undefined, // rawLanguages
-          undefined, // otherLanguagePacksReason
           false, // useOverlayAwareDefaultCliVersion
           features,
           getRunnerLogger(true),
@@ -447,7 +357,6 @@ test.serial(
           ],
         },
         undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
         getRunnerLogger(true),
@@ -494,7 +403,6 @@ test.serial(
           ],
         },
         undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
         getRunnerLogger(true),
@@ -534,7 +442,6 @@ test.serial(
         util.GitHubVariant.DOTCOM,
         SAMPLE_DEFAULT_CLI_VERSION,
         undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
         getRunnerLogger(true),
@@ -576,7 +483,6 @@ test.serial(
         util.GitHubVariant.DOTCOM,
         SAMPLE_DEFAULT_CLI_VERSION,
         undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
         getRunnerLogger(true),
@@ -674,6 +580,7 @@ const injectedConfigMacro = makeMacro({
         "",
         undefined,
         undefined,
+        getRunnerLogger(true),
       );
 
       const args = runnerConstructorStub.firstCall.args[1] as string[];
@@ -949,6 +856,7 @@ test.serial(
         "",
         undefined,
         "/path/to/qlconfig.yml",
+        getRunnerLogger(true),
       );
 
       const args = runnerConstructorStub.firstCall.args[1] as string[];
@@ -979,6 +887,7 @@ test.serial(
         "",
         undefined,
         undefined, // undefined qlconfigFile
+        getRunnerLogger(true),
       );
 
       const args = runnerConstructorStub.firstCall.args[1] as any[];
@@ -1157,6 +1066,7 @@ test.serial(
       "sourceRoot",
       undefined,
       undefined,
+      getRunnerLogger(false),
     );
 
     t.true(runnerConstructorStub.calledOnce);

src/codeql.ts

@@ -12,12 +12,10 @@ import {
   runTool,
 } from "./actions-util";
 import * as api from "./api-client";
-import * as outputCache from "./cli/output-cache";
-import type { VersionInfo } from "./cli/types";
 import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -25,7 +23,7 @@ import {
 } from "./feature-flags";
 import { isAnalyzingDefaultBranch } from "./git-utils";
 import { Language } from "./languages";
-import { getRunnerLogger, Logger } from "./logging";
+import { Logger } from "./logging";
 import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import * as setupCodeql from "./setup-codeql";
@@ -93,6 +91,7 @@ export interface CodeQL {
     sourceRoot: string,
     processName: string | undefined,
     qlconfigFile: string | undefined,
+    logger: Logger,
   ): Promise<void>;
   /**
    * Runs the autobuilder for the given language.
@@ -216,6 +215,20 @@ export interface CodeQL {
   ): Promise<void>;
 }
 
+export interface VersionInfo {
+  version: string;
+  features?: { [name: string]: boolean };
+  /**
+   * The overlay version helps deal with backward incompatible changes for
+   * overlay analysis. When a precompiled query pack reports the same overlay
+   * version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay
+   * analysis with that pack. Otherwise, if the overlay versions are different,
+   * or if either the pack or the CLI does not report an overlay version,
+   * we need to revert to non-overlay analysis.
+   */
+  overlayVersion?: number;
+}
+
 export interface ResolveDatabaseOutput {
   overlayBaseSpecifier?: string;
 }
@@ -258,41 +271,21 @@ const CODEQL_MINIMUM_VERSION = "2.19.4";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.20.7";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 
-/**
- * Decides whether `e` is a disk-related error outside of our control
- * that should be classified as a `ConfigurationError`.
- *
- * @param e The error to check.
- * @returns True if the error should be treated as a `ConfigurationError` or false if not.
- */
-export function isDiskConfigurationError(e: unknown): boolean {
-  if (!(e instanceof Error)) {
-    return false;
-  }
-
-  return (
-    // out of disk space
-    e.message.includes("ENOSPC") ||
-    // access denied
-    e.message.includes("EACCES")
-  );
-}
-
 /**
  * Set up CodeQL CLI access.
  *
@@ -302,9 +295,6 @@ export function isDiskConfigurationError(e: unknown): boolean {
  * @param variant
  * @param defaultCliVersion
  * @param rawLanguages Raw set of languages.
- * @param otherLanguagePacksReason Why the CodeQL CLI may need packs for languages other than
- *   `rawLanguages`, or `undefined` if it won't. If defined, the combined bundle is used. See
- *   `PerLanguageBundleOptions.otherLanguagePacksReason`.
  * @param useOverlayAwareDefaultCliVersion Whether to select an overlay-aware default CLI version.
  * @param features Information about the features that are enabled.
  * @param logger
@@ -319,7 +309,6 @@ export async function setupCodeQL(
   variant: util.GitHubVariant,
   defaultCliVersion: CodeQLDefaultVersionInfo,
   rawLanguages: string[] | undefined,
-  otherLanguagePacksReason: string | undefined,
   useOverlayAwareDefaultCliVersion: boolean,
   features: FeatureEnablement,
   logger: Logger,
@@ -343,7 +332,6 @@ export async function setupCodeQL(
       variant,
       defaultCliVersion,
       rawLanguages,
-      otherLanguagePacksReason,
       useOverlayAwareDefaultCliVersion,
       features,
       logger,
@@ -358,7 +346,7 @@ export async function setupCodeQL(
       );
     }
 
-    cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion);
+    cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion);
     return {
       codeql: cachedCodeQL,
       toolsDownloadStatusReport,
@@ -368,7 +356,8 @@ export async function setupCodeQL(
   } catch (rawError) {
     const e = api.wrapApiConfigurationError(rawError);
     const ErrorClass =
-      e instanceof util.ConfigurationError || isDiskConfigurationError(e)
+      e instanceof util.ConfigurationError ||
+      (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space
         ? util.ConfigurationError
         : Error;
 
@@ -383,9 +372,9 @@ export async function setupCodeQL(
 /**
  * Use the CodeQL executable located at the given path.
  */
-export async function getCodeQL(logger: Logger, cmd: string): Promise<CodeQL> {
+export async function getCodeQL(cmd: string): Promise<CodeQL> {
   if (cachedCodeQL === undefined) {
-    cachedCodeQL = await getCodeQLForCmd(logger, cmd, true);
+    cachedCodeQL = await getCodeQLForCmd(cmd, true);
   }
   return cachedCodeQL;
 }
@@ -492,9 +481,8 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
  */
 export async function getCodeQLForTesting(
   cmd = "codeql-for-testing",
-  logger: Logger = getRunnerLogger(true),
 ): Promise<CodeQL> {
-  return getCodeQLForCmd(logger, cmd, false);
+  return getCodeQLForCmd(cmd, false);
 }
 
 /**
@@ -506,7 +494,6 @@ export async function getCodeQLForTesting(
  * @returns A new CodeQL object
  */
 async function getCodeQLForCmd(
-  logger: Logger,
   cmd: string,
   checkVersion: boolean,
 ): Promise<CodeQL> {
@@ -515,12 +502,7 @@ async function getCodeQLForCmd(
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
-      let result = outputCache.getCachedCodeQlVersion(
-        logger,
-        cacheFilePath,
-        cmd,
-      );
+      let result = util.getCachedCodeQlVersion(cmd);
       if (result === undefined) {
         result = await runCliJson<VersionInfo>(
           cmd,
@@ -529,7 +511,7 @@ async function getCodeQLForCmd(
             noStreamStdout: true,
           },
         );
-        outputCache.cacheCodeQlVersion(cacheFilePath, cmd, result);
+        util.cacheCodeQlVersion(cmd, result);
       }
       return result;
     },
@@ -557,6 +539,7 @@ async function getCodeQLForCmd(
       sourceRoot: string,
       processName: string | undefined,
       qlconfigFile: string | undefined,
+      logger: Logger,
     ) {
       const extraArgs = config.languages.map(
         (language) => `--language=${language}`,
@@ -942,7 +925,6 @@ async function getCodeQLForCmd(
           "--format=json",
           `--language=${language}`,
           "--extractor-include-aliases",
-          "-J-XX:-UsePerfData",
           ...getExtraOptionsFromEnv(["resolve", "extractor"]),
         ],
         {
@@ -957,13 +939,7 @@ async function getCodeQLForCmd(
           },
         },
       ).exec();
-      try {
-        return JSON.parse(extractorPath) as string;
-      } catch (err) {
-        throw new Error(
-          `Failed to parse extractor path for '${language}' from CLI: ${getErrorMessage(err)}\nOutput was: ${extractorPath}`,
-        );
-      }
+      return JSON.parse(extractorPath) as string;
     },
     async resolveQueriesStartingPacks(queries: string[]): Promise<string[]> {
       const codeqlArgs = [

src/config-utils.test.ts

@@ -473,12 +473,6 @@ const simpleConfigFileContents = `
   queries:
     - uses: ./foo_file`;
 
-/** The configuration in `simpleConfigFileContents`. */
-const simpleConfigInput: UserConfig = {
-  name: "my config",
-  queries: [{ uses: "./foo_file" }],
-};
-
 /** A less minimal configuration file. */
 const otherConfigFileContents = `
   name: my config
@@ -564,14 +558,16 @@ test.serial(
         tempDir,
       );
 
-      const configInput: UserConfig = {
-        name: "my config",
-        queries: [{ uses: "./foo" }],
-        packs: {
-          javascript: ["a/b@1.2.3"],
-          python: ["c/d@1.2.3"],
-        },
-      };
+      const configInput = `
+      name: my config
+      queries:
+        - uses: ./foo
+      packs:
+        javascript:
+          - a/b@1.2.3
+        python:
+          - c/d@1.2.3
+    `;
 
       fs.mkdirSync(path.join(tempDir, "foo"));
 
@@ -602,16 +598,7 @@ test.serial(
         }),
       );
 
-      // Compare with a separate object rather than `configInput` itself, so that the test catches
-      // changes made to the input in place.
-      t.deepEqual(config.originalUserInput, {
-        name: "my config",
-        queries: [{ uses: "./foo" }],
-        packs: {
-          javascript: ["a/b@1.2.3"],
-          python: ["c/d@1.2.3"],
-        },
-      });
+      t.deepEqual(config.originalUserInput, yaml.load(configInput));
     });
   },
 );
@@ -1308,12 +1295,13 @@ checkOverlayEnablementMacro.serial(
 );
 
 checkOverlayEnablementMacro.serial(
-  "No overlay-base database on default branch if runner disk space is below minimum",
+  "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled",
   {
     languages: [BuiltInLanguage.javascript],
     features: [
       Feature.OverlayAnalysis,
       Feature.OverlayAnalysisCodeScanningJavascript,
+      Feature.OverlayAnalysisResourceChecksV2,
     ],
     isDefaultBranch: true,
     diskUsage: {
@@ -1327,12 +1315,13 @@ checkOverlayEnablementMacro.serial(
 );
 
 checkOverlayEnablementMacro.serial(
-  "Overlay-base database on default branch if runner disk space is above minimum",
+  "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled",
   {
     languages: [BuiltInLanguage.javascript],
     features: [
       Feature.OverlayAnalysis,
       Feature.OverlayAnalysisCodeScanningJavascript,
+      Feature.OverlayAnalysisResourceChecksV2,
     ],
     isDefaultBranch: true,
     diskUsage: {
@@ -1346,93 +1335,17 @@ checkOverlayEnablementMacro.serial(
   },
 );
 
-// Check that each feature flag lowers the limit to the threshold that its name
-// declares. Both sides of the boundary are needed to pin the threshold down: a
-// mapping to a lower value would still pass the case at the limit, and one to a
-// higher value would still fail the case below it.
-for (const [feature, thresholdGb] of [
-  [Feature.OverlayAnalysisMinDisk8Gb, 8],
-  [Feature.OverlayAnalysisMinDisk9Gb, 9],
-  [Feature.OverlayAnalysisMinDisk10Gb, 10],
-  [Feature.OverlayAnalysisMinDisk11Gb, 11],
-  [Feature.OverlayAnalysisMinDisk12Gb, 12],
-  [Feature.OverlayAnalysisMinDisk13Gb, 13],
-] as Array<[Feature, number]>) {
-  const features = [
-    Feature.OverlayAnalysis,
-    Feature.OverlayAnalysisCodeScanningJavascript,
-    feature,
-  ];
-
-  checkOverlayEnablementMacro.serial(
-    `Overlay-base database on default branch if ${feature} is enabled and runner disk space is at its limit`,
-    {
-      languages: [BuiltInLanguage.javascript],
-      features,
-      isDefaultBranch: true,
-      diskUsage: {
-        numAvailableBytes: thresholdGb * 1_000_000_000,
-        numTotalBytes: 100_000_000_000,
-      },
-    },
-    {
-      overlayDatabaseMode: OverlayDatabaseMode.OverlayBase,
-      useOverlayDatabaseCaching: true,
-    },
-  );
-
-  checkOverlayEnablementMacro.serial(
-    `No overlay-base database on default branch if ${feature} is enabled and runner disk space is below its limit`,
-    {
-      languages: [BuiltInLanguage.javascript],
-      features,
-      isDefaultBranch: true,
-      diskUsage: {
-        numAvailableBytes: thresholdGb * 1_000_000_000 - 1_000_000,
-        numTotalBytes: 100_000_000_000,
-      },
-    },
-    {
-      disabledReason: OverlayDisabledReason.InsufficientDiskSpace,
-    },
-  );
-}
-
 checkOverlayEnablementMacro.serial(
-  "Overlay-base database on default branch if runner disk space is exactly at the lowest limit enabled by a feature flag",
+  "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled",
   {
     languages: [BuiltInLanguage.javascript],
     features: [
       Feature.OverlayAnalysis,
       Feature.OverlayAnalysisCodeScanningJavascript,
-      Feature.OverlayAnalysisMinDisk9Gb,
-      Feature.OverlayAnalysisMinDisk12Gb,
     ],
     isDefaultBranch: true,
     diskUsage: {
-      numAvailableBytes: 9_000_000_000,
-      numTotalBytes: 100_000_000_000,
-    },
-  },
-  {
-    overlayDatabaseMode: OverlayDatabaseMode.OverlayBase,
-    useOverlayDatabaseCaching: true,
-  },
-);
-
-checkOverlayEnablementMacro.serial(
-  "No overlay-base database on default branch if runner disk space is below the lowest limit enabled by a feature flag",
-  {
-    languages: [BuiltInLanguage.javascript],
-    features: [
-      Feature.OverlayAnalysis,
-      Feature.OverlayAnalysisCodeScanningJavascript,
-      Feature.OverlayAnalysisMinDisk9Gb,
-      Feature.OverlayAnalysisMinDisk12Gb,
-    ],
-    isDefaultBranch: true,
-    diskUsage: {
-      numAvailableBytes: 8_500_000_000,
+      numAvailableBytes: 15_000_000_000,
       numTotalBytes: 100_000_000_000,
     },
   },
@@ -2426,7 +2339,7 @@ test("determineUserConfig - loads config input", async (t) => {
     const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
 
     const inputs = createTestInitConfigInputs({
-      configInput: simpleConfigInput,
+      configInput: simpleConfigFileContents,
       configFile: undefined,
       workspacePath: tmpDir,
     });
@@ -2436,15 +2349,17 @@ test("determineUserConfig - loads config input", async (t) => {
 
     await target
       // The input source and path of the generated config file should have been logged.
-      .logs(t, `Using config from action input: ${expectedConfigPath}`)
-      // The message about no configuration input and the warning about both inputs should not have
-      // been logged. The generated config file isn't loaded, since the `config` input has already
-      // been parsed.
+      .logs(
+        t,
+        "Using config from action input:",
+        `Using configuration file: ${expectedConfigPath}`,
+      )
+      // The message about no configuration input and
+      // the warning about both inputs should not have been logged.
       .notLogs(
         t,
         "No configuration file was provided",
         "Both a config file and config input were provided. Ignoring config file.",
-        `Using configuration file: ${expectedConfigPath}`,
       )
       // The loaded configuration should match `simpleConfigFileContents`.
       .passes(t.deepEqual, {
@@ -2463,7 +2378,7 @@ test("determineUserConfig - ignores config file input when both specified", asyn
     const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
 
     const inputs = createTestInitConfigInputs({
-      configInput: simpleConfigInput,
+      configInput: simpleConfigFileContents,
       configFile: configFilePath,
       workspacePath: tmpDir,
     });
@@ -2477,14 +2392,10 @@ test("determineUserConfig - ignores config file input when both specified", asyn
       .logs(
         t,
         `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
         "Both a config file and config input were provided. Ignoring config file.",
       )
-      // The generated config file isn't loaded, since the `config` input has already been parsed.
-      .notLogs(
-        t,
-        "No configuration file was provided",
-        `Using configuration file: ${expectedConfigPath}`,
-      )
+      .notLogs(t, "No configuration file was provided")
       // The loaded configuration should match `simpleConfigFileContents`.
       .passes(t.deepEqual, {
         name: "my config",
@@ -2497,14 +2408,11 @@ test("determineUserConfig - ignores config file input when both specified", asyn
 });
 
 /** A `config` input that we might get from Default Setup. */
-const defaultSetupConfigInput: UserConfig = {
-  "threat-models": ["local", "remote"],
-  "default-setup": {
-    org: {
-      "model-packs": ["foo", "bar"],
-    },
-  },
-};
+const defaultSetupConfigInput = `
+  threat-models: [local, remote]
+  default-setup:
+    org:
+      model-packs: [foo, bar]`;
 
 test("determineUserConfig - merges configs if FF is enabled in Default Setup", async (t) => {
   await withTmpDir(async (tmpDir) => {
@@ -2573,7 +2481,7 @@ test("determineUserConfig - ignores config file input in Default Setup if FF is
       .withArgs(
         tmpDir,
         createTestInitConfigInputs({
-          configInput: simpleConfigInput,
+          configInput: simpleConfigFileContents,
           configFile: configFilePath,
           workspacePath: tmpDir,
         }),
@@ -2583,14 +2491,10 @@ test("determineUserConfig - ignores config file input in Default Setup if FF is
       .logs(
         t,
         `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
         "Both a config file and config input were provided. Ignoring config file.",
       )
-      // The generated config file isn't loaded, since the `config` input has already been parsed.
-      .notLogs(
-        t,
-        "No configuration file was provided",
-        `Using configuration file: ${expectedConfigPath}`,
-      )
+      .notLogs(t, "No configuration file was provided")
       .passes(t.deepEqual, {
         name: "my config",
         queries: [{ uses: "./foo_file" }],
@@ -2609,7 +2513,7 @@ test("determineUserConfig - ignores config file input outside Default Setup if F
       .withArgs(
         tmpDir,
         createTestInitConfigInputs({
-          configInput: simpleConfigInput,
+          configInput: simpleConfigFileContents,
           configFile: configFilePath,
           workspacePath: tmpDir,
         }),
@@ -2619,14 +2523,10 @@ test("determineUserConfig - ignores config file input outside Default Setup if F
       .logs(
         t,
         `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
         "Both a config file and config input were provided. Ignoring config file.",
       )
-      // The generated config file isn't loaded, since the `config` input has already been parsed.
-      .notLogs(
-        t,
-        "No configuration file was provided",
-        `Using configuration file: ${expectedConfigPath}`,
-      )
+      .notLogs(t, "No configuration file was provided")
       .passes(t.deepEqual, {
         name: "my config",
         queries: [{ uses: "./foo_file" }],

src/config-utils.ts

@@ -48,7 +48,7 @@ import {
 import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import * as errorMessages from "./error-messages";
-import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
+import { Feature, FeatureEnablement } from "./feature-flags";
 import {
   RepositoryProperties,
   RepositoryPropertyName,
@@ -90,8 +90,9 @@ import {
   Result,
   Success,
   Failure,
-  looksLikeHostedRunner,
+  isHostedRunner,
 } from "./util";
+
 export { type Config } from "./config/action-config";
 
 /**
@@ -100,23 +101,19 @@ export { type Config } from "./config/action-config";
  * whether to perform overlay analysis, then the action will not perform overlay
  * analysis unless overlay analysis has been explicitly enabled via environment
  * variable.
- *
- * This threshold can be lowered by the feature flags in
- * `OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE`.
  */
-const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14000;
+const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 20000;
+const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES =
+  OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1_000_000;
 
 /**
- * Minimum available disk space (in MB) enabled by each overlay feature flag.
+ * The v2 minimum available disk space (in MB) required to perform overlay
+ * analysis. This is a lower threshold than the v1 limit, allowing overlay
+ * analysis to run on runners with less available disk space.
  */
-const OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE = {
-  [Feature.OverlayAnalysisMinDisk8Gb]: 8000,
-  [Feature.OverlayAnalysisMinDisk9Gb]: 9000,
-  [Feature.OverlayAnalysisMinDisk10Gb]: 10000,
-  [Feature.OverlayAnalysisMinDisk11Gb]: 11000,
-  [Feature.OverlayAnalysisMinDisk12Gb]: 12000,
-  [Feature.OverlayAnalysisMinDisk13Gb]: 13000,
-} satisfies Partial<Record<FeatureWithoutCLI, number>>;
+const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14000;
+const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES =
+  OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1_000_000;
 
 /**
  * The minimum memory (in MB) that must be available for CodeQL to perform overlay analysis. If
@@ -337,8 +334,7 @@ export interface InitConfigInputs {
   packsInput: string | undefined;
   configFile: string | undefined;
   dbLocation: string | undefined;
-  /** The configuration from the `config` input. */
-  configInput: UserConfig | undefined;
+  configInput: string | undefined;
   buildModeInput: string | undefined;
   ramInput: string | undefined;
   dependencyCachingEnabled: string | undefined;
@@ -592,44 +588,24 @@ async function checkOverlayAnalysisFeatureEnabled(
   return new Success(undefined);
 }
 
-/**
- * Returns the minimum available disk space (in MB) required to perform overlay
- * analysis, which is the lowest threshold enabled by a feature flag, or the
- * default threshold if no such feature flag is enabled.
- */
-async function getMinimumDiskSpaceMb(
-  features: FeatureEnablement,
-): Promise<number> {
-  let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB;
-  for (const [feature, thresholdMb] of Object.entries(
-    OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE,
-  )) {
-    if (await features.getValue(feature as FeatureWithoutCLI)) {
-      minimumMb = Math.min(minimumMb, thresholdMb);
-    }
-  }
-  return minimumMb;
-}
-
 /** Checks if the runner has enough disk space for overlay analysis. */
 function runnerHasSufficientDiskSpace(
   diskUsage: DiskUsage,
   logger: Logger,
-  minimumDiskSpaceMb: number,
+  useV2ResourceChecks: boolean,
 ): boolean {
-  const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000);
-  if (diskUsage.numAvailableBytes < minimumDiskSpaceMb * 1_000_000) {
+  const minimumDiskSpaceBytes = useV2ResourceChecks
+    ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES
+    : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES;
+  if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) {
+    const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000);
+    const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1_000_000);
     logger.info(
       `Setting overlay database mode to ${OverlayDatabaseMode.None} ` +
         `due to insufficient disk space (${diskSpaceMb} MB, needed ${minimumDiskSpaceMb} MB).`,
     );
     return false;
   }
-
-  logger.debug(
-    `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is at or above the ` +
-      `minimum of ${minimumDiskSpaceMb} MB.`,
-  );
   return true;
 }
 
@@ -661,7 +637,7 @@ async function runnerHasSufficientMemory(
   }
 
   logger.debug(
-    `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is at or above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.`,
+    `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.`,
   );
   return true;
 }
@@ -672,13 +648,12 @@ async function runnerHasSufficientMemory(
  */
 async function checkRunnerResources(
   codeql: CodeQL,
-  features: FeatureEnablement,
   diskUsage: DiskUsage,
   ramInput: string | undefined,
   logger: Logger,
+  useV2ResourceChecks: boolean,
 ): Promise<Result<void, OverlayDisabledReason>> {
-  const minimumDiskSpaceMb = await getMinimumDiskSpaceMb(features);
-  if (!runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb)) {
+  if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) {
     return new Failure(OverlayDisabledReason.InsufficientDiskSpace);
   }
   if (!(await runnerHasSufficientMemory(codeql, ramInput, logger))) {
@@ -777,6 +752,9 @@ export async function checkOverlayEnablement(
     Feature.OverlayAnalysisSkipResourceChecks,
     codeql,
   ));
+  const useV2ResourceChecks = await features.getValue(
+    Feature.OverlayAnalysisResourceChecksV2,
+  );
   const checkOverlayStatus = await features.getValue(
     Feature.OverlayAnalysisStatusCheck,
   );
@@ -792,10 +770,10 @@ export async function checkOverlayEnablement(
     performResourceChecks && diskUsage !== undefined
       ? await checkRunnerResources(
           codeql,
-          features,
           diskUsage,
           ramInput,
           logger,
+          useV2ResourceChecks,
         )
       : new Success<void>(undefined);
   if (resourceResult.isFailure()) {
@@ -938,7 +916,7 @@ export async function isTrapCachingEnabled(
   if (trapCaching !== undefined) return trapCaching === "true";
 
   // On self-hosted runners which may have slow network access, disable TRAP caching by default.
-  if (!looksLikeHostedRunner()) return false;
+  if (!isHostedRunner()) return false;
 
   // If overlay analysis is enabled, then disable TRAP caching since overlay analysis supersedes it.
   // This change is gated behind a feature flag.
@@ -1058,13 +1036,17 @@ export async function determineUserConfig(
   tempDir: string,
   inputs: InitConfigInputs,
 ): Promise<UserConfig> {
+  const validateConfig = await action.features.getValue(
+    Feature.ValidateDbConfig,
+  );
+
   // We have the following cases:
   // 1. A `config` or `config-file` input is provided, but not both: use the provided one.
   // 2. Both are provided and we are in an advanced workflow: ignore the `config-file` input.
   // 3. Both are provided and we are in Default Setup: the `config` input uses a limited
   //    set of options, which are supported by `mergeDefaultSetupAndUserConfigs`,
   //    and we merge the two configs.
-  if (inputs.configInput !== undefined) {
+  if (inputs.configInput) {
     const computedConfigPath = userConfigFromActionPath(tempDir);
 
     // Get a function which enables us to determine whether the FF that allows us to
@@ -1081,6 +1063,12 @@ export async function determineUserConfig(
     ) {
       // If the FF is enabled and we are in Default Setup, combine the supported
       // configuration file properties and write the result to disk.
+      const fromConfigInput = parseUserConfig(
+        action.logger,
+        "`config` input",
+        inputs.configInput,
+        validateConfig,
+      );
       const fromConfigFile = await loadUserConfig(
         action,
         inputs.configFile,
@@ -1093,7 +1081,7 @@ export async function determineUserConfig(
       // the CLI or other CodeQL Action steps.
       const mergedConfig = mergeDefaultSetupAndUserConfigs(
         action.logger,
-        inputs.configInput,
+        fromConfigInput,
         fromConfigFile,
       );
       fs.writeFileSync(computedConfigPath, yaml.dump(mergedConfig));
@@ -1113,13 +1101,12 @@ export async function determineUserConfig(
         );
       }
 
-      // Write the `config` input to disk without merging it with a configuration file.
-      fs.writeFileSync(computedConfigPath, yaml.dump(inputs.configInput));
+      // Write the `config` input straight to disk.
+      fs.writeFileSync(computedConfigPath, inputs.configInput);
       inputs.configFile = computedConfigPath;
       action.logger.debug(
         `Using config from action input: ${inputs.configFile}`,
       );
-      return inputs.configInput;
     }
   }
 
@@ -1417,12 +1404,7 @@ export async function getConfig(
   }
   if (config.version !== getActionVersion()) {
     throw new ConfigurationError(
-      [
-        `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'.`,
-        "All steps in a workflow that use `github/codeql-action` must use the same version to work correctly.",
-        "If you are using Dependabot to manage dependency updates, you can configure a dependency group to update all `github/codeql-action` steps at the same time.",
-        "For more information, see https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--",
-      ].join(" "),
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`,
     );
   }