Defer workflow activation to a follow-up PR

Keep the post-comment implementation independent of the workflow that loads it from main.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.editorconfig

@@ -8,6 +8,3 @@ trim_trailing_whitespace = true
 [*.ts]
 indent_style = space
 indent_size = 2
-
-[*.{yml,yaml}]
-indent_size = 2

.github/ISSUE_TEMPLATE/config.yml

@@ -2,4 +2,4 @@ blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
     url: https://support.github.com/request
-    about: Contact Support
+    about: Contact Support 

.github/actions/check-codescanning-config/action.yml

@@ -1,7 +1,7 @@
 name: Check Code-Scanning Config
 description: |
-  Checks the code scanning configuration file generated by the
-  action to ensure it contains the expected contents
+    Checks the code scanning configuration file generated by the
+    action to ensure it contains the expected contents
 inputs:
   languages:
     required: false
@@ -52,7 +52,7 @@ runs:
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/codescanning-config-cli-test
       env:
-        CODEQL_ACTION_TEST_MODE: "true"
+        CODEQL_ACTION_TEST_MODE: 'true'
 
     - name: Install dependencies
       shell: bash
@@ -62,7 +62,7 @@ runs:
       working-directory: ${{ github.action_path }}
       shell: bash
       env:
-        EXPECTED_CONFIG_FILE_CONTENTS: "${{ inputs.expected-config-file-contents }}"
+        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
       run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
     - name: Clean up
       shell: bash

.github/actions/post-comment/action.yml

@@ -0,0 +1,41 @@
+name: "Post comment"
+description: "Create or update a sticky PR comment identified by a caller-provided marker."
+inputs:
+  marker:
+    description: >
+      Non-empty plain-text identifier for the comment. Use a unique, stable value
+      for each distinct comment; it is automatically wrapped in a hidden HTML comment.
+    required: true
+  body:
+    description: "Full comment markdown."
+    required: true
+  update-only:
+    description: Do nothing if no comment with the specified marker exists.
+    required: false
+    default: "false"
+  issue-id:
+    description: >
+      The issue or pull request number to post/update the comment on.
+      Defaults to the current pull request if not provided.
+    required: false
+  token:
+    description: "The GitHub token to authenticate with."
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Post comment
+      shell: bash
+      env:
+        BODY: ${{ inputs.body }}
+        MARKER: ${{ inputs.marker }}
+        UPDATE_ONLY: ${{ case(inputs.update-only == 'true', '--update-only', '') }}
+        GH_TOKEN: ${{ inputs.token }}
+        ISSUE_ID: ${{ inputs.issue-id || github.event.pull_request.number }}
+      run: |
+        npx tsx ./pr-checks/post-comment.ts \
+          --body "$BODY" \
+          --marker "$MARKER" \
+          $UPDATE_ONLY \
+          --issue-id "$ISSUE_ID" \
+          --repository "$GITHUB_REPOSITORY"

.github/actions/query-filter-test/action.yml

@@ -54,7 +54,7 @@ runs:
     - name: Check SARIF
       uses: ./../action/.github/actions/check-sarif
       with:
-        sarif-file: ${{ inputs.sarif-file }}
+        sarif-file:  ${{ inputs.sarif-file }}
         queries-run: ${{ inputs.queries-run}}
         queries-not-run: ${{ inputs.queries-not-run}}
     - name: Cleanup after test

.github/actions/release-branches/action.yml

@@ -1,11 +1,11 @@
-name: "Release branches"
-description: "Determine branches for release & backport"
+name: 'Release branches'
+description: 'Determine branches for release & backport'
 inputs:
   major_version:
-    description: "The version as extracted from the package.json file"
+    description: 'The version as extracted from the package.json file'
     required: true
   latest_tag:
-    description: "The most recent tag published to the repository"
+    description: 'The most recent tag published to the repository'
     required: true
 outputs:
   backport_source_branch:

.github/actions/release-initialise/action.yml

@@ -1,16 +1,17 @@
-name: "Prepare release job"
-description: "Prepare for updating a release branch"
+name: 'Prepare release job'
+description: 'Prepare for updating a release branch'
 
 runs:
   using: "composite"
   steps:
+
     - name: Dump environment
       run: env
       shell: bash
 
     - name: Dump GitHub context
       env:
-        GITHUB_CONTEXT: "${{ toJson(github) }}"
+        GITHUB_CONTEXT: '${{ toJson(github) }}'
       run: echo "$GITHUB_CONTEXT"
       shell: bash
 
@@ -18,7 +19,7 @@ runs:
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
-        cache: "npm"
+        cache: 'npm'
 
     - name: Install JavaScript dependencies
       shell: bash

.github/codeql/codeql-config-actions.yml

@@ -1,5 +0,0 @@
-paths-ignore:
-  - lib
-  - tests
-queries:
-  - uses: security-and-quality

.github/workflows/__all-platform-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: All-platform bundle
     if: github.triggering_actor != 'dependabot[bot]'
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "true"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'true'
+          setup-kotlin: 'true'
       - id: init
         uses: ./../action/init
         with:

.github/workflows/__analysis-kinds.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,28 +34,28 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: code-scanning
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: risk-assessment
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds
@@ -73,8 +73,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: javascript
@@ -82,16 +82,16 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
-          post-processed-sarif-path: "${{ runner.temp }}/post-processed"
+          post-processed-sarif-path: '${{ runner.temp }}/post-processed'
 
       - name: Upload SARIF files
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: "${{ runner.temp }}/results/*.sarif"
+          path: '${{ runner.temp }}/results/*.sarif'
           retention-days: 7
 
       - name: Upload post-processed SARIF
@@ -99,7 +99,7 @@ jobs:
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: "${{ runner.temp }}/post-processed"
+          path: '${{ runner.temp }}/post-processed'
           retention-days: 7
           if-no-files-found: error
 
@@ -107,16 +107,16 @@ jobs:
         if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
-          EXPECT_PRESENT: "false"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          EXPECT_PRESENT: 'false'
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
-          EXPECT_PRESENT: "true"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
+          EXPECT_PRESENT: 'true'
         with:
           script: ${{ env.CHECK_SCRIPT }}
     env:

.github/workflows/__analyze-ref-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -91,7 +91,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__autobuild-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -44,11 +44,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: autobuild-action
     if: github.triggering_actor != 'dependabot[bot]'
@@ -69,8 +69,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: csharp
@@ -78,12 +78,12 @@ jobs:
       - uses: ./../action/autobuild
         env:
           # Explicitly disable the CLR tracer.
-          COR_ENABLE_PROFILING: ""
-          COR_PROFILER: ""
-          COR_PROFILER_PATH_64: ""
-          CORECLR_ENABLE_PROFILING: ""
-          CORECLR_PROFILER: ""
-          CORECLR_PROFILER_PATH_64: ""
+          COR_ENABLE_PROFILING: ''
+          COR_PROFILER: ''
+          COR_PROFILER_PATH_64: ''
+          CORECLR_ENABLE_PROFILING: ''
+          CORECLR_PROFILER: ''
+          CORECLR_PROFILER_PATH_64: ''
       - uses: ./../action/analyze
       - name: Check database
         run: |

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
 defaults:
   run:
     shell: bash
@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     if: github.triggering_actor != 'dependabot[bot]'
@@ -72,8 +72,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__autobuild-working-dir.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Autobuild working directory
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__build-mode-autobuild.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
 defaults:
   run:
     shell: bash
@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Build mode autobuild
     if: github.triggering_actor != 'dependabot[bot]'
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -92,7 +92,7 @@ jobs:
         id: init
         with:
           build-mode: autobuild
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-manual.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Build mode manual
     if: github.triggering_actor != 'dependabot[bot]'
@@ -80,13 +80,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
           build-mode: manual
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-none.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Build mode none
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,13 +53,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
           build-mode: none
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-rollback.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Build mode rollback
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -63,7 +63,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__bundle-from-nightly.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Bundle: From nightly"
+name: 'PR Check - Bundle: From nightly'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-    name: "Bundle: From nightly"
+    name: 'Bundle: From nightly'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - id: init
         uses: ./../action/init
         env:

.github/workflows/__bundle-from-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Bundle: From toolcache"
+name: 'PR Check - Bundle: From toolcache'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: toolcache
-    name: "Bundle: From toolcache"
+    name: 'Bundle: From toolcache'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -60,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Check toolcache contains CodeQL
         continue-on-error: true
         run: |

.github/workflows/__bundle-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Bundle: Caching checks"
+name: 'PR Check - Bundle: Caching checks'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
-    name: "Bundle: Caching checks"
+    name: 'Bundle: Caching checks'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -64,8 +64,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Clean up database cluster directory
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Add a file to the database cluster directory
         run: |
           mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
@@ -62,7 +62,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__config-export.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Config export
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: javascript
@@ -62,18 +62,18 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check config properties appear in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         with:
           script: |
             const fs = require('fs');

.github/workflows/__config-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Config input
     if: github.triggering_actor != 'dependabot[bot]'
@@ -60,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Copy queries into workspace
         run: |
           cp -a ../action/queries .

.github/workflows/__cpp-deptrace-disabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)"
+name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "C/C++: disabling autoinstalling dependencies (Linux)"
+    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)"
+name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "C/C++: autoinstalling dependencies is skipped (macOS)"
+    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - C/C++: autoinstalling dependencies (Linux)"
+name: 'PR Check - C/C++: autoinstalling dependencies (Linux)'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "C/C++: autoinstalling dependencies (Linux)"
+    name: 'C/C++: autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__diagnostics-export.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Diagnostic export
     if: github.triggering_actor != 'dependabot[bot]'
@@ -62,8 +62,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -82,18 +82,18 @@ jobs:
             --ready-for-status-page
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
 
       - name: Check diagnostics appear in SARIF
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         run: |
           cd ../action
           npx tsx ./pr-checks/check-diagnostics.ts

.github/workflows/__diagnostics-without-db.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Diagnostic export without database
     if: github.triggering_actor != 'dependabot[bot]'
@@ -67,8 +67,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Initialise failing analysis
         id: init
         uses: ./../action/init
@@ -87,11 +87,11 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: "/test-codeql-version:${{ matrix.version }}"
+          category: '/test-codeql-version:${{ matrix.version }}'
 
       - name: Check diagnostics appear on disk
         env:
-          DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
+          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
         run: |
           cd ../action
           npx tsx ./pr-checks/diagnostics-without-db.ts
@@ -108,7 +108,7 @@ jobs:
       contents: read
       security-events: read
     timeout-minutes: 5
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/__export-file-baseline-information.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Export file baseline information
     if: github.triggering_actor != 'dependabot[bot]'
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -100,12 +100,12 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__extractor-ram-threads.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Extractor ram and threads options test
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: java

.github/workflows/__global-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Proxy test
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "false"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'false'
       - name: Block direct internet access to force proxy usage
         run: |
           apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1

.github/workflows/__go-custom-queries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: Custom queries"
+name: 'PR Check - Go: Custom queries'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Go: Custom queries"
+    name: 'Go: Custom queries'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -93,5 +93,5 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: diagnostic when Go is changed after init step"
+name: 'PR Check - Go: diagnostic when Go is changed after init step'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -44,9 +44,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-    name: "Go: diagnostic when Go is changed after init step"
+    name: 'Go: diagnostic when Go is changed after init step'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -75,17 +75,17 @@ jobs:
       # Deliberately change Go after the `init` step
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.20"
+          go-version: '1.20'
       - name: Build code
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: diagnostic when `file` is not installed"
+name: 'PR Check - Go: diagnostic when `file` is not installed'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -44,9 +44,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-    name: "Go: diagnostic when `file` is not installed"
+    name: 'Go: diagnostic when `file` is not installed'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Remove `file` program
         run: |
           echo $(which file)
@@ -81,12 +81,12 @@ jobs:
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: workaround for indirect tracing"
+name: 'PR Check - Go: workaround for indirect tracing'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -44,9 +44,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-    name: "Go: workaround for indirect tracing"
+    name: 'Go: workaround for indirect tracing'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: tracing with autobuilder step"
+name: 'PR Check - Go: tracing with autobuilder step'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -46,27 +46,27 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "Go: tracing with autobuilder step"
+    name: 'Go: tracing with autobuilder step'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -106,5 +106,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: tracing with custom build steps"
+name: 'PR Check - Go: tracing with custom build steps'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -46,27 +46,27 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "Go: tracing with custom build steps"
+    name: 'Go: tracing with custom build steps'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: tracing with legacy workflow"
+name: 'PR Check - Go: tracing with legacy workflow'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -46,27 +46,27 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "Go: tracing with legacy workflow"
+    name: 'Go: tracing with legacy workflow'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -100,5 +100,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go.yml

@@ -19,10 +19,10 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 jobs:
   go-custom-queries:
-    name: "Go: Custom queries"
+    name: 'Go: Custom queries'
     permissions:
       contents: read
       security-events: read
@@ -31,7 +31,7 @@ jobs:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-diagnostic:
-    name: "Go: diagnostic when Go is changed after init step"
+    name: 'Go: diagnostic when Go is changed after init step'
     permissions:
       contents: read
       security-events: read
@@ -39,7 +39,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-no-file-program:
-    name: "Go: diagnostic when `file` is not installed"
+    name: 'Go: diagnostic when `file` is not installed'
     permissions:
       contents: read
       security-events: read
@@ -47,7 +47,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround:
-    name: "Go: workaround for indirect tracing"
+    name: 'Go: workaround for indirect tracing'
     permissions:
       contents: read
       security-events: read
@@ -55,7 +55,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-autobuilder:
-    name: "Go: tracing with autobuilder step"
+    name: 'Go: tracing with autobuilder step'
     permissions:
       contents: read
       security-events: read
@@ -63,7 +63,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-custom-build-steps:
-    name: "Go: tracing with custom build steps"
+    name: 'Go: tracing with custom build steps'
     permissions:
       contents: read
       security-events: read
@@ -71,7 +71,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-legacy-workflow:
-    name: "Go: tracing with legacy workflow"
+    name: 'Go: tracing with legacy workflow'
     permissions:
       contents: read
       security-events: read

.github/workflows/__init-with-registries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Download using registries"
+name: 'PR Check - Packaging: Download using registries'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Download using registries"
+    name: 'Packaging: Download using registries'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,12 +55,12 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Init with registries
         uses: ./../action/init
         with:
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: ./.github/codeql/codeql-config-registries.yml
           languages: javascript

.github/workflows/__javascript-source-root.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Custom source root
     if: github.triggering_actor != 'dependabot[bot]'
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Move codeql-action
         run: |
           mkdir ../new-source-root

.github/workflows/__job-run-uuid-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Job run UUID added to SARIF
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -60,12 +60,12 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__language-aliases.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Language aliases
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,14 +51,14 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: C#,java-kotlin,typescript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: "Check languages"
+      - name: 'Check languages'
         run: |
           expected_languages="csharp,java,javascript"
           actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

.github/workflows/__linux-arm64.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: PR Check - Runner images
+name: PR Check - Linux Arm64
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,44 +41,22 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: runner-images-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
-  runner-images:
+  linux-arm64:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-22.04
-            version: linked
-          - os: ubuntu-22.04-arm
-            version: linked
-          - os: ubuntu-24.04
-            version: linked
           - os: ubuntu-24.04-arm
-            version: linked
-          - os: ubuntu-26.04
-            version: linked
-          - os: ubuntu-26.04-arm
-            version: linked
-          - os: windows-2022
-            version: linked
-          - os: windows-2025
-            version: linked
-          - os: macos-15-large
-            version: linked
-          - os: macos-15-xlarge
-            version: linked
-          - os: macos-26-large
-            version: linked
-          - os: macos-26-xlarge
-            version: linked
-    name: Runner images
+            version: nightly-latest
+    name: Linux Arm64
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -102,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: ${{ env.LANGUAGES }}
@@ -124,5 +102,5 @@ jobs:
             echo "Found database for $lang"
           done
     env:
-      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby${{ startsWith(matrix.os, 'macos') && ',swift' || '' }}
+      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__local-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Local CodeQL bundle
     if: github.triggering_actor != 'dependabot[bot]'
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst

.github/workflows/__multi-language-autodetect.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -58,37 +58,37 @@ jobs:
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
           - os: macos-15-xlarge
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
           - os: macos-15-xlarge
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
     name: Multi-language repository
     if: github.triggering_actor != 'dependabot[bot]'
@@ -114,8 +114,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Install Python 3.13.15 for older CLI versions
         # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
         # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
@@ -123,7 +123,7 @@ jobs:
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: "3.13.15"
+          python-version: '3.13.15'
 
       - name: Use Xcode 16
         # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
@@ -133,7 +133,7 @@ jobs:
       - uses: ./../action/init
         id: init
         with:
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__overlay-init-fallback.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Overlay database init fallback
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: actions # Any language without overlay support will do

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Config and input passed to the CLI"
+name: 'PR Check - Packaging: Config and input passed to the CLI'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Config and input passed to the CLI"
+    name: 'Packaging: Config and input passed to the CLI'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging3.yml"
+          config-file: '.github/codeql/codeql-config-packaging3.yml'
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Config and input"
+name: 'PR Check - Packaging: Config and input'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Config and input"
+    name: 'Packaging: Config and input'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging3.yml"
+          config-file: '.github/codeql/codeql-config-packaging3.yml'
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Config file"
+name: 'PR Check - Packaging: Config file'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Config file"
+    name: 'Packaging: Config file'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,18 +93,18 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging.yml"
+          config-file: '.github/codeql/codeql-config-packaging.yml'
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Action input"
+name: 'PR Check - Packaging: Action input'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Action input"
+    name: 'Packaging: Action input'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging2.yml"
+          config-file: '.github/codeql/codeql-config-packaging2.yml'
           languages: javascript
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
 
       - name: Check results
         uses: ./../action/.github/actions/check-sarif

.github/workflows/__per-language-bundle-validation.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -35,40 +35,40 @@ jobs:
       matrix:
         include:
           - language: actions
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             expected-extractors: actions javascript
           - language: cpp
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: manual
             build-command: gcc -o main main.c
           - language: csharp
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: none
           - language: go
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: autobuild
           - language: java
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: none
           - language: javascript
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: python
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: ruby
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: rust
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: swift
-            os: macos-26-xlarge
+            os: macos-latest-xlarge
             version: linked
             build-mode: autobuild
     name: Per-language bundles
@@ -95,8 +95,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action

.github/workflows/__remote-config.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Remote config file
     if: github.triggering_actor != 'dependabot[bot]'
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__resolve-environment-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Resolve environment
     if: github.triggering_actor != 'dependabot[bot]'
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go,javascript-typescript

.github/workflows/__ruby.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,17 +34,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: macos-26
+          - os: macos-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
     name: Ruby analysis
     if: github.triggering_actor != 'dependabot[bot]'
@@ -61,8 +61,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: ruby

.github/workflows/__rust.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -36,13 +36,13 @@ jobs:
         include:
           - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.1
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Rust analysis
     if: github.triggering_actor != 'dependabot[bot]'
@@ -59,8 +59,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: rust

.github/workflows/__split-workflow.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,17 +54,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: macos-26
+          - os: macos-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
     name: Split workflow
     if: github.triggering_actor != 'dependabot[bot]'
@@ -90,11 +90,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging3.yml"
+          config-file: '.github/codeql/codeql-config-packaging3.yml'
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +103,7 @@ jobs:
       - uses: ./../action/analyze
         with:
           skip-queries: true
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Assert No Results
@@ -114,7 +114,7 @@ jobs:
           fi
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Assert Results
         run: |

.github/workflows/__start-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: Start proxy
     if: github.triggering_actor != 'dependabot[bot]'
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Setup proxy for registries
         id: proxy
         uses: ./../action/start-proxy
@@ -101,5 +101,5 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
     env:
-      CODEQL_ACTION_PROXY_API_REQUESTS: "true"
+      CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__submit-sarif-failure.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Submit SARIF after failure
     if: github.triggering_actor != 'dependabot[bot]'
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./init
         with:
@@ -76,7 +76,7 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: "/test-codeql-version:${{ matrix.version }}"
+          category: '/test-codeql-version:${{ matrix.version }}'
     env:
       CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
       CODEQL_ACTION_UPLOAD_FAILED_SARIF: true

.github/workflows/__swift-autobuild.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
     name: Swift analysis using autobuild
     if: github.triggering_actor != 'dependabot[bot]'
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__swift-custom-build.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: linked
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: default
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
     name: Swift analysis using a custom build command
     if: github.triggering_actor != 'dependabot[bot]'
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -107,5 +107,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__unset-environment.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Test unsetting environment variables
     if: github.triggering_actor != 'dependabot[bot]'
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__unsupported-macos.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -62,8 +62,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Check xcode_select_link
         run: |
           readlink /private/var/db/xcode_select_link
@@ -86,7 +86,7 @@ jobs:
         if: false
         uses: ./analyze
         with:
-          category: "/test-codeql-version:${{ matrix.version }}"
+          category: '/test-codeql-version:${{ matrix.version }}'
     env:
       CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
       CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
@@ -100,7 +100,7 @@ jobs:
       contents: read
       security-events: read
     timeout-minutes: 5
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -114,7 +114,7 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Download workflow artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: test-mode-sarif-*
           path: sarif

.github/workflows/__upload-ref-sha-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -92,12 +92,12 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           upload: never
       - uses: ./../action/upload-sarif
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
             analysis-kinds: code-scanning
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
             analysis-kinds: code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`
@@ -87,8 +87,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -99,8 +99,8 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           upload: never
           output: ${{ runner.temp }}/results
 
@@ -109,15 +109,15 @@ jobs:
         uses: ./../action/upload-sarif
         id: upload-sarif
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
-      - name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
+      - name: 'Fail for missing output from `upload-sarif` step for `code-scanning`'
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
-      - name: "Fail for missing output from `upload-sarif` step for `code-quality`"
+      - name: 'Fail for missing output from `upload-sarif` step for `code-quality`'
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -126,12 +126,12 @@ jobs:
         id: upload-single-sarif-code-scanning
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results/javascript.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
-      - name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
+      - name: 'Fail for missing output from `upload-single-sarif-code-scanning` step'
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
         run: exit 1
       - name: Upload single SARIF file for Code Quality
@@ -139,12 +139,12 @@ jobs:
         id: upload-single-sarif-code-quality
         if: contains(matrix.analysis-kinds, 'code-quality')
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
-      - name: "Fail for missing output from `upload-single-sarif-code-quality` step"
+      - name: 'Fail for missing output from `upload-single-sarif-code-quality` step'
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -156,12 +156,12 @@ jobs:
         id: upload-single-non-sarif
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
-      - name: "Fail for missing output from `upload-single-non-sarif` step"
+      - name: 'Fail for missing output from `upload-single-non-sarif` step'
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
     env:

.github/workflows/__with-checkout-path.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Use a custom `checkout_path`
     if: github.triggering_actor != 'dependabot[bot]'
@@ -81,8 +81,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.

.github/workflows/codeql.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Sunday.
-    - cron: "30 1 * * 0"
+    - cron: '30 1 * * 0'
   workflow_dispatch:
 
 defaults:
@@ -19,39 +19,121 @@ env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
-  analyze:
+  # Identify the CodeQL tool versions to use in the analysis job.
+  check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
+    outputs:
+      versions: ${{ steps.compare.outputs.versions }}
 
+    permissions:
+      contents: read
+      # We currently need `security-events: read` to access feature flags.
+      security-events: read
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Set up default CodeQL bundle
+      id: setup-default
+      uses: ./setup-codeql
+    - name: Set up linked CodeQL bundle
+      id: setup-linked
+      uses: ./setup-codeql
+      with:
+        tools: linked
+    - name: Compare default and linked CodeQL bundle versions
+      id: compare
+      env:
+        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+      run: |
+        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+
+        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+        # required status check.
+        #
+        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+        # the same as running with `tools: null`.
+        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+          VERSIONS_JSON='[null]'
+        else
+          VERSIONS_JSON='[null, "linked"]'
+        fi
+
+        # Output a JSON-encoded list with the distinct versions to test against.
+        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+
+  analyze-javascript:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs: [check-codeql-versions]
     strategy:
       fail-fast: false
       matrix:
-        language:
-          - actions
-          - javascript
+        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
+        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
+    runs-on: ${{ matrix.os }}
 
     permissions:
       contents: read
       security-events: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: ./init
-        id: init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config-file: ./.github/codeql/codeql-config-${{ matrix.language }}.yml
-      # confirm steps.init.outputs.codeql-path points to the codeql binary
-      - name: Print CodeQL Version
-        run: >
-          "$CODEQL" version --format=json
-        env:
-          CODEQL: ${{steps.init.outputs.codeql-path}}
-      - name: Perform CodeQL Analysis
-        uses: ./analyze
-        with:
-          category: "/language:${{ matrix.language }}"
-          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Initialize CodeQL
+      uses: ./init
+      id: init
+      with:
+        languages: javascript
+        config-file: ./.github/codeql/codeql-config-javascript.yml
+        tools: ${{ matrix.tools }}
+    # confirm steps.init.outputs.codeql-path points to the codeql binary
+    - name: Print CodeQL Version
+      run: >
+        "$CODEQL" version --format=json
+      env:
+        CODEQL: ${{steps.init.outputs.codeql-path}}
+    - name: Perform CodeQL Analysis
+      uses: ./analyze
+      with:
+        category: "/language:javascript"
+        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+
+  analyze-other:
+    if: github.triggering_actor != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Initialize CodeQL
+      uses: ./init
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: none
+        config: >
+          paths-ignore:
+            - lib
+            - tests
+          queries:
+            - uses: security-and-quality
+    - name: Perform CodeQL Analysis
+      uses: ./analyze
+      with:
+        category: "/language:${{ matrix.language }}"
+        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}

.github/workflows/codescanning-config-cli.yml

@@ -10,13 +10,13 @@ env:
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -41,187 +41,187 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
-            version: linked
-          - os: ubuntu-26.04
-            version: default
-          - os: ubuntu-26.04
-            version: nightly-latest
+        - os: ubuntu-latest
+          version: linked
+        - os: ubuntu-latest
+          version: default
+        - os: ubuntu-latest
+          version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
     name: Code Scanning Configuration tests
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Check out repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24
-          cache: "npm"
+    - name: Set up Node.js
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+        cache: 'npm'
 
-      - name: Install dependencies
-        run: npm ci
+    - name: Install dependencies
+      run: npm ci
 
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: ${{ matrix.version }}
 
-      - name: Empty file
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: "{}"
-          # Request multiple languages so later checks can reuse the combined bundle.
-          languages: javascript,python
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Empty file
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: "{}"
+        # Request multiple languages so later checks can reuse the combined bundle.
+        languages: javascript,python
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Packs from input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+    - name: Packs from input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+          }
+        languages: javascript
+        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Packs from input with +
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+          }
+        languages: javascript
+        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries from input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+          }
+        languages: javascript
+        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries from input with +
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+          }
+        languages: javascript
+        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries and packs from input with +
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+          }
+        languages: javascript
+        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries and packs from config
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
+            "packs": {
+              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
             }
-          languages: javascript
-          packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          }
+        languages: javascript
+        config-file-test: .github/codeql/queries-and-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Packs from input with +
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-            }
-          languages: javascript
-          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Queries and packs from config overriden by input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+            "packs": ["codeql/javascript-queries"]
+          }
+        languages: javascript
+        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        packs: codeql/javascript-queries
+        config-file-test: .github/codeql/queries-and-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Queries from input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-            }
-          languages: javascript
-          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Queries and packs from config merging with input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": {
+              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
+            },
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+            ]
+          }
+        languages: javascript
+        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        packs: + codeql/javascript-queries
+        config-file-test: .github/codeql/queries-and-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Queries from input with +
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-            }
-          languages: javascript
-          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Multi-language packs from config
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": {
+              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
+              "ruby": ["codeql/ruby-queries"]
+            },
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+            ]
+          }
+        languages: javascript,ruby
+        config-file-test: .github/codeql/multi-language-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Queries and packs from input with +
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-            }
-          languages: javascript
-          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Queries and packs from config
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-              "packs": {
-                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-              }
-            }
-          languages: javascript
-          config-file-test: .github/codeql/queries-and-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Queries and packs from config overriden by input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-              "packs": ["codeql/javascript-queries"]
-            }
-          languages: javascript
-          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          packs: codeql/javascript-queries
-          config-file-test: .github/codeql/queries-and-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Queries and packs from config merging with input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": {
-                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-              },
-              "queries": [
-                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-              ]
-            }
-          languages: javascript
-          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          packs: + codeql/javascript-queries
-          config-file-test: .github/codeql/queries-and-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Multi-language packs from config
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": {
-                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-                "ruby": ["codeql/ruby-queries"]
-              },
-              "queries": [
-                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-              ]
-            }
-          languages: javascript,ruby
-          config-file-test: .github/codeql/multi-language-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Other config properties
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "name": "Config using all properties",
-              "packs": ["codeql/javascript-queries" ],
-              "disable-default-queries": true,
-              "paths-ignore": ["xxx"],
-              "paths": ["yyy"]
-            }
-          languages: javascript
-          packs: + codeql/javascript-queries
-          config-file-test: .github/codeql/other-config-properties.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Other config properties
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "name": "Config using all properties",
+            "packs": ["codeql/javascript-queries" ],
+            "disable-default-queries": true,
+            "paths-ignore": ["xxx"],
+            "paths": ["yyy"]
+          }
+        languages: javascript
+        packs: + codeql/javascript-queries
+        config-file-test: .github/codeql/other-config-properties.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/debug-artifacts-failure-safe.yml

@@ -47,7 +47,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
 
     steps:
       - name: Dump GitHub event
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/debug-artifacts-safe.yml

@@ -45,7 +45,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
 
     steps:
       - name: Check out repository
@@ -84,7 +84,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/deflake.yml

@@ -61,7 +61,6 @@ on:
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
       - "PR Check - Ruby analysis"
-      - "PR Check - Runner images"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"
       - "PR Check - Start proxy"

.github/workflows/post-release-mergeback.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       baseBranch:
-        description: "The base branch to merge into"
+        description: 'The base branch to merge into'
         default: main
         required: false
 
@@ -24,7 +24,7 @@ defaults:
 
 jobs:
   merge-back:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     environment: Automation
     if: github.repository == 'github/codeql-action'
     env:
@@ -41,16 +41,16 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: "${{ toJson(github) }}"
+          GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "${GITHUB_CONTEXT}"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0 # ensure we have all tags and can push commits
+          fetch-depth: 0  # ensure we have all tags and can push commits
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install JavaScript dependencies
         run: npm ci

.github/workflows/pr-checks.yml

@@ -25,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-26.04, macos-26, windows-2025]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         node-version: [20, 24]
     permissions:
       contents: read
@@ -64,14 +64,14 @@ jobs:
           npm ci
 
       - name: Verify compiled JS up to date
-        run: npx tsx pr-checks/check-unchanged.ts --language javascript
+        run: .github/workflows/script/check-js.sh
 
       - name: Run unit tests
         if: always()
         run: npm test
 
       - name: Lint
-        if: always() && matrix.os != 'windows-2025'
+        if: always() && matrix.os != 'windows-latest'
         run: npm run lint-ci
 
       - name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
         # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
         # rather than the event. The same results are uploaded by the `pull_request` run and again
         # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -93,7 +93,7 @@ jobs:
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     concurrency:
@@ -122,22 +122,14 @@ jobs:
         id: install-deps
         run: npm ci
 
-      - name: Verify YAML is correctly formatted
-        run: npx tsx pr-checks/check-unchanged.ts --language yaml
-
       - name: Verify PR checks up to date
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
 
-      - name: Typecheck pr-checks scripts
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        working-directory: pr-checks
-        run: npm run typecheck
-
       - name: Run pr-checks tests
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         working-directory: pr-checks
-        run: npm run test
+        run: npx tsx --test
 
       - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}

.github/workflows/prepare-release.yml

@@ -29,7 +29,7 @@ defaults:
 jobs:
   prepare:
     name: "Release info"
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     if: github.repository == 'github/codeql-action'
 
     permissions:

.github/workflows/publish-immutable-action.yml

@@ -1,10 +1,10 @@
-name: "Publish Immutable Action Version"
+name: 'Publish Immutable Action Version'
 
 on:
   push:
     tags:
       # Match version tags, but not the major version tags.
-      - "v[0-9]+.**"
+      - 'v[0-9]+.**'
 
 defaults:
   run:

.github/workflows/python312-windows.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Monday.
-    - cron: "0 0 * * 1"
+    - cron: '0 0 * * 1'
   workflow_dispatch:
 
 concurrency:
@@ -29,25 +29,25 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: windows-2025
+    runs-on: windows-latest
 
     steps:
-      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
-        with:
-          python-version: 3.12
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+      with:
+        python-version: 3.12
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Prepare test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: default
+    - name: Prepare test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: default
 
-      - name: Initialize CodeQL
-        uses: ./../action/init
-        with:
-          tools: linked
-          languages: python
+    - name: Initialize CodeQL
+      uses: ./../action/init
+      with:
+        tools: linked
+        languages: python
 
-      - name: Analyze
-        uses: ./../action/analyze
+    - name: Analyze
+      uses: ./../action/analyze

.github/workflows/query-filters.yml

@@ -3,13 +3,13 @@ name: Query filters tests
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -25,51 +25,51 @@ jobs:
     name: Query Filters Tests
     if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Check out repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24
-          cache: npm
+    - name: Install Node.js
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+        cache: npm
 
-      - name: Install dependencies
-        run: npm ci
+    - name: Install dependencies
+      run: npm ci
 
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: linked
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: linked
 
-      - name: Check SARIF for default queries with Single include, Single exclude
-        uses: ./../action/.github/actions/query-filter-test
-        with:
-          sarif-file: ${{ runner.temp }}/results/javascript.sarif
-          queries-run: js/zipslip
-          queries-not-run: js/path-injection
-          config-file: ./.github/codeql/codeql-config-query-filters1.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Check SARIF for default queries with Single include, Single exclude
+      uses: ./../action/.github/actions/query-filter-test
+      with:
+        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/zipslip
+        queries-not-run: js/path-injection
+        config-file: ./.github/codeql/codeql-config-query-filters1.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Check SARIF for query packs with Single include, Single exclude
-        uses: ./../action/.github/actions/query-filter-test
-        with:
-          sarif-file: ${{ runner.temp }}/results/javascript.sarif
-          queries-run: js/zipslip,javascript/example/empty-or-one-block
-          queries-not-run: js/path-injection
-          config-file: ./.github/codeql/codeql-config-query-filters2.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Check SARIF for query packs with Single include, Single exclude
+      uses: ./../action/.github/actions/query-filter-test
+      with:
+        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/zipslip,javascript/example/empty-or-one-block
+        queries-not-run: js/path-injection
+        config-file: ./.github/codeql/codeql-config-query-filters2.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Check SARIF for query packs and local queries with Single include, Single exclude
-        uses: ./../action/.github/actions/query-filter-test
-        with:
-          sarif-file: ${{ runner.temp }}/results/javascript.sarif
-          queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-          queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-          config-file: ./.github/codeql/codeql-config-query-filters3.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Check SARIF for query packs and local queries with Single include, Single exclude
+      uses: ./../action/.github/actions/query-filter-test
+      with:
+        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
+        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
+        config-file: ./.github/codeql/codeql-config-query-filters3.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/rebuild.yml

@@ -12,7 +12,7 @@ defaults:
 jobs:
   rebuild:
     name: Rebuild Action
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
     env:
@@ -33,7 +33,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Remove label
         if: github.event_name == 'pull_request'

.github/workflows/rollback-release.yml

@@ -34,7 +34,7 @@ jobs:
   rollback:
     name: "Create rollback release"
     if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     timeout-minutes: 45
 
     # Don't set the deployment environment for test runs

.github/workflows/script/check-js.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -eu
+
+# Sanity check that repo is clean to start with
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then this workflow needs attention...
+    >&2 echo "Failed: Repo should be clean before testing!"
+    exit 1
+fi
+# Wipe the lib directory in case there are extra unnecessary files in there
+rm -rf lib
+# Generate the JavaScript files
+npm run-script build
+# Check that repo is still clean
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then the PR needs attention
+    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
+    git status
+
+    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
+    echo "" >> $GITHUB_STEP_SUMMARY
+    echo '```diff' >> $GITHUB_STEP_SUMMARY
+    git diff --output="$RUNNER_TEMP/js.diff"
+    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
+    echo '```' >> $GITHUB_STEP_SUMMARY
+
+    # Reset bundled files to allow other checks to test for changes
+    git checkout lib
+
+    # Fail this check
+    exit 1
+fi
+echo "Success: JavaScript files are up to date"

.github/workflows/test-codeql-bundle-all.yml

@@ -1,17 +1,17 @@
-name: "PR Check - CodeQL Bundle All"
+name: 'PR Check - CodeQL Bundle All'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -27,9 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
-            version: nightly-latest
-    name: "CodeQL Bundle All"
+        - os: ubuntu-latest
+          version: nightly-latest
+    name: 'CodeQL Bundle All'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -37,26 +37,26 @@ jobs:
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: true
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "9.x"
-      - id: init
-        uses: ./../action/init
-        with:
-          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-          languages: cpp,csharp,go,java,javascript,python,ruby
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
+    - name: Check out repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: ${{ matrix.version }}
+        use-all-platform-bundle: true
+    - name: Install .NET
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      with:
+        dotnet-version: '9.x'
+    - id: init
+      uses: ./../action/init
+      with:
+        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
+        languages: cpp,csharp,go,java,javascript,python,ruby
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Build code
+      run: ./build.sh
+    - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/update-bundle.yml

@@ -20,7 +20,7 @@ defaults:
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests
@@ -30,7 +30,7 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: "${{ toJson(github) }}"
+          GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "$GITHUB_CONTEXT"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -44,7 +44,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
@@ -113,12 +113,11 @@ jobs:
           echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
           echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"
 
-      - name: Create changenote
+      - name: Create changelog note
         run: |
           npx tsx pr-checks/bundle-changelog.ts
 
-      - name: Push changenote
+      - name: Push changelog note
         run: |
-          git add unreleased-change-notes
-          git commit -m "Add changenote"
+          git commit -am "Add changelog note"
           git push

.github/workflows/update-release-branch.yml

@@ -26,7 +26,7 @@ jobs:
   update:
     name: "Update release branch"
     timeout-minutes: 45
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch'
     needs: [prepare]
     env:
@@ -38,48 +38,48 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-      - uses: ./.github/actions/release-initialise
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0  # Need full history for calculation of diffs
+    - uses: ./.github/actions/release-initialise
 
-      # when the workflow has been manually triggered on main,
-      # we know that we definitely want the release branch to exist
-      - name: Ensure release branch exists
-        run: |
-          echo "MAJOR_VERSION ${MAJOR_VERSION}"
-          RELEASE_BRANCH=releases/${MAJOR_VERSION}
-          if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-              echo "Branch $RELEASE_BRANCH already exists"
-              echo ""
-          else
-              echo "Creating $RELEASE_BRANCH branch"
-              git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-              git push --set-upstream origin ${RELEASE_BRANCH}
-              git branch --show-current
-              echo ""
-          fi
-          echo "Returning to branch: ${REF_NAME}"
-          git checkout ${REF_NAME}
+    # when the workflow has been manually triggered on main,
+    # we know that we definitely want the release branch to exist
+    - name: Ensure release branch exists
+      run: |
+        echo "MAJOR_VERSION ${MAJOR_VERSION}"
+        RELEASE_BRANCH=releases/${MAJOR_VERSION}
+        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
+            echo "Branch $RELEASE_BRANCH already exists"
+            echo ""
+        else
+            echo "Creating $RELEASE_BRANCH branch"
+            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
+            git push --set-upstream origin ${RELEASE_BRANCH}
+            git branch --show-current
+            echo ""
+        fi
+        echo "Returning to branch: ${REF_NAME}"
+        git checkout ${REF_NAME}
 
-      - name: Update current release branch
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo SOURCE_BRANCH=${REF_NAME}
-          echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-          npx tsx ./pr-checks/update-release-branch.ts \
-            --repository-nwo ${{ github.repository }} \
-            --source-branch '${{ env.REF_NAME }}' \
-            --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-            --is-primary-release \
-            --conductor ${GITHUB_ACTOR}
+    - name: Update current release branch
+      if: github.event_name == 'workflow_dispatch'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        echo SOURCE_BRANCH=${REF_NAME}
+        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
+        npx tsx ./pr-checks/update-release-branch.ts \
+          --repository-nwo ${{ github.repository }} \
+          --source-branch '${{ env.REF_NAME }}' \
+          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
+          --is-primary-release \
+          --conductor ${GITHUB_ACTOR}
 
   backport:
     name: "Create backport"
     timeout-minutes: 45
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     environment: Automation
     needs: [prepare]
     if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -94,28 +94,28 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-      - name: Generate token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+    - name: Generate token
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+      id: app-token
+      with:
+        app-id: ${{ vars.AUTOMATION_APP_ID }}
+        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-          token: ${{ steps.app-token.outputs.token }}
-      - uses: ./.github/actions/release-initialise
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0  # Need full history for calculation of diffs
+        token: ${{ steps.app-token.outputs.token }}
+    - uses: ./.github/actions/release-initialise
 
-      - name: Update older release branch
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo SOURCE_BRANCH=${SOURCE_BRANCH}
-          echo TARGET_BRANCH=${TARGET_BRANCH}
-          npx tsx ./pr-checks/update-release-branch.ts \
-            --repository-nwo ${{ github.repository }} \
-            --source-branch ${SOURCE_BRANCH} \
-            --target-branch ${TARGET_BRANCH} \
-            --conductor ${GITHUB_ACTOR}
+    - name: Update older release branch
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        echo SOURCE_BRANCH=${SOURCE_BRANCH}
+        echo TARGET_BRANCH=${TARGET_BRANCH}
+        npx tsx ./pr-checks/update-release-branch.ts \
+          --repository-nwo ${{ github.repository }} \
+          --source-branch ${SOURCE_BRANCH} \
+          --target-branch ${TARGET_BRANCH} \
+          --conductor ${GITHUB_ACTOR}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci

.vscode/settings.json

@@ -15,7 +15,7 @@
   "search.exclude": {
     "**/node_modules": true,
     "build": true,
-    "lib": true
+    "lib": true,
   },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
   // an intermediate stage where many files are modified. This setting suppresses these warnings.
@@ -26,9 +26,4 @@
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
-  "[yaml]": {
-    "editor.tabSize": 2,
-    "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
-  "prettier.prettierPath": "./node_modules/prettier"
 }

CHANGELOG.md

@@ -6,17 +6,6 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 No user facing changes.
 
-## 4.39.3 - 04 Nov 2026
-
-- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
-
-## 4.39.2 - 03 Nov 2026
-
-- Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)
-- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)
-- Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See [this blog post for more information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/). The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). This check will be rolled out following this release of the CodeQL Action. [#4221](https://github.com/github/codeql-action/pull/4221)
-- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze` Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#4243](https://github.com/github/codeql-action/pull/4243)
-
 ## 4.39.1 - 21 Oct 2026
 
 - Update default CodeQL bundle version to [2.27.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#4256](https://github.com/github/codeql-action/pull/4256)

action.yml

@@ -1,10 +1,10 @@
-name: "CodeQL: Stub"
+name: 'CodeQL: Stub'
 description: "Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead."
-author: "GitHub"
+author: 'GitHub'
 runs:
-  using: "composite"
+  using: 'composite'
   steps:
-    - name: "Stub"
+    - name: 'Stub'
       run: |
         echo 'This is a stub. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.'
         exit 1

autobuild/action.yml

@@ -1,6 +1,6 @@
-name: "CodeQL: Autobuild"
-description: "Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead."
-author: "GitHub"
+name: 'CodeQL: Autobuild'
+description: 'Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead.'
+author: 'GitHub'
 inputs:
   token:
     description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission."
@@ -16,4 +16,4 @@ inputs:
     required: false
 runs:
   using: node24
-  main: "../lib/autobuild-entry.js"
+  main: '../lib/autobuild-entry.js'

init/action.yml

@@ -1,6 +1,6 @@
-name: "CodeQL: Init"
-description: "Set up CodeQL"
-author: "GitHub"
+name: 'CodeQL: Init'
+description: 'Set up CodeQL'
+author: 'GitHub'
 inputs:
   tools:
     description: >-
@@ -56,7 +56,7 @@ inputs:
       - `code-scanning`: The default, security-focused analysis.
       - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
                         with `code-scanning`.
-    default: "code-scanning"
+    default: 'code-scanning'
     required: true
   token:
     description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
@@ -100,7 +100,7 @@ inputs:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
   quality-queries:
-    description: "[Internal] DEPRECATED. Comma-separated list of code quality queries to run."
+    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
     required: false
   packs:
     description: >-
@@ -140,7 +140,7 @@ inputs:
       This will result in more output being produced which may be useful when debugging certain issues.
       Debugging mode is enabled automatically when step debug logging is turned on.
     required: false
-    default: "false"
+    default: 'false'
   debug-artifact-name:
     description: >-
       The name of the artifact to store debugging information in.
@@ -181,5 +181,5 @@ outputs:
     description: The version of the CodeQL binary used for analysis
 runs:
   using: node24
-  main: "../lib/init-entry.js"
-  post: "../lib/init-post-entry.js"
+  main: '../lib/init-entry.js'
+  post: '../lib/init-post-entry.js'

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.4",
-  "cliVersion": "2.27.4",
-  "priorBundleVersion": "codeql-bundle-v2.27.3",
-  "priorCliVersion": "2.27.3"
+  "bundleVersion": "codeql-bundle-v2.27.3",
+  "cliVersion": "2.27.3",
+  "priorBundleVersion": "codeql-bundle-v2.27.2",
+  "priorCliVersion": "2.27.2"
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.4",
+  "version": "4.39.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.4",
+      "version": "4.39.2",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -33,7 +33,7 @@
         "js-yaml": "^5.5.0",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
-        "node-forge": "^1.4.1",
+        "node-forge": "^1.4.0",
         "semver": "^7.8.5",
         "undici": "^7.30.1",
         "uuid": "^14.0.3"
@@ -59,10 +59,9 @@
         "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jsdoc": "^65.4.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
-        "glob": "^14.0.3",
+        "glob": "^13.0.6",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
-        "prettier": "^3.9.10",
         "sinon": "^22.1.0",
         "typescript": "^6.0.3",
         "typescript-eslint": "^8.72.0"
@@ -1811,12 +1810,6 @@
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@isaacs/nonrecursive-glob-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
-      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
-      "license": "BlueOak-1.0.0"
-    },
     "node_modules/@mapbox/node-pre-gyp": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -3530,6 +3523,7 @@
     },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -3539,6 +3533,7 @@
       "version": "6.2.3",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
       "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -4443,6 +4438,7 @@
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -4453,6 +4449,7 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/comment-parser": {
@@ -4577,6 +4574,7 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -4831,6 +4829,7 @@
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-abstract": {
@@ -6273,14 +6272,14 @@
       }
     },
     "node_modules/glob": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
-      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^11.0.2",
+        "minimatch": "^10.2.2",
         "minipass": "^7.1.3",
-        "path-scurry": "^3.0.0"
+        "path-scurry": "^2.0.2"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6324,13 +6323,12 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
-      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/nonrecursive-glob-match": "^1.0.2",
-        "brace-expansion": "^5.0.12"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6859,6 +6857,7 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7169,6 +7168,7 @@
     },
     "node_modules/isexe": {
       "version": "2.0.0",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/js-string-escape": {
@@ -7478,9 +7478,9 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="
     },
     "node_modules/lru-cache": {
-      "version": "11.5.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
-      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -8198,9 +8198,9 @@
       }
     },
     "node_modules/node-forge": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.1.tgz",
-      "integrity": "sha512-w5/MfWaeMrpR/5ba6fZyAUTLSuE6aYz7H/3cYrqwZEmf5eQS3IaaLgJt4MBv7HglGFWmV22K8h4U18RJQmw/ow==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
+      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
         "node": ">= 6.13.0"
@@ -8571,6 +8571,7 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8582,9 +8583,9 @@
       "license": "MIT"
     },
     "node_modules/path-scurry": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
-      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
@@ -8669,9 +8670,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.10.tgz",
-      "integrity": "sha512-skGHTH1Yb9QvaTC4hWnRTzEYtCpApF0UMBPz+t/0ZPzP8ihefo/btKd+QA7pUE0fEwA1SbS/NmhyEcstdXOIdA==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.4.1.tgz",
+      "integrity": "sha512-G+YdqtITVZmOJje6QkXQWzl3fSfMxFwm1tjTyo9exhkmWSqC4Yhd1+lug++IlR2mvRVAxEDDWYkQdeSztajqgg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -9170,6 +9171,7 @@
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -9180,6 +9182,7 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -9265,6 +9268,7 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
       "engines": {
         "node": ">=14"
       },
@@ -9451,6 +9455,7 @@
     },
     "node_modules/string-width": {
       "version": "4.2.3",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -9536,6 +9541,7 @@
     },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -10273,6 +10279,7 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -10562,7 +10569,7 @@
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-        "glob": "^14.0.3",
+        "glob": "^13.0.6",
         "lite-matter": "^0.1.2",
         "mdast-util-from-markdown": "^2.1.0",
         "semver": "^7.8.5",

package.json

@@ -1,12 +1,11 @@
 {
   "name": "codeql",
-  "version": "4.39.4",
+  "version": "4.39.2",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
     "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
     "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
-    "format-yaml": "prettier --write --parser yaml '**/*.{yml,yaml}'",
     "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
     "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
     "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
@@ -14,8 +13,7 @@
     "test": "npm run ava -- src/",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh",
-    "typecheck": "tsc --noEmit"
+    "update-pr-checks": "./pr-checks/sync.sh"
   },
   "license": "MIT",
   "workspaces": [
@@ -43,7 +41,7 @@
     "js-yaml": "^5.5.0",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
-    "node-forge": "^1.4.1",
+    "node-forge": "^1.4.0",
     "semver": "^7.8.5",
     "undici": "^7.30.1",
     "uuid": "^14.0.3"
@@ -69,10 +67,9 @@
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-jsdoc": "^65.4.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
-    "prettier": "^3.9.10",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.72.0"
@@ -96,7 +93,7 @@
     "eslint-plugin-jsx-a11y": {
       "semver": ">=6.3.1"
     },
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
     "undici": "^7.30.1"
   }
 }

pr-checks/api-client.ts

@@ -8,3 +8,14 @@ export function getApiClient(token: string): ApiClient {
   const opts = githubUtils.getOctokitOptions(token);
   return new githubUtils.GitHub(opts);
 }
+
+/** Resolves the GitHub API token to use, from `GH_TOKEN` or `GITHUB_TOKEN`. */
+export function resolveToken(env: NodeJS.ProcessEnv): string {
+  const token = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
+  if (!token) {
+    throw new Error(
+      "Missing authentication token. Set GH_TOKEN or GITHUB_TOKEN.",
+    );
+  }
+  return token;
+}

pr-checks/bundle-changelog.test.ts

@@ -10,13 +10,17 @@ import { afterEach, beforeEach, describe, it } from "node:test";
 
 import {
   CLI_VERSION_ENV_VAR,
-  getChangenote,
   getCLIVersion,
   getPRNumber,
   getPRUrl,
   PR_URL_ENV_VAR,
+  updateChangelog,
 } from "./bundle-changelog";
-import { isValidChangenoteContent } from "./changelog/validate";
+import {
+  EMPTY_CHANGELOG,
+  NO_CHANGES_STR,
+  UNRELEASED_PLACEHOLDER,
+} from "./changelog";
 
 let testDir: string;
 
@@ -81,15 +85,58 @@ describe("getPRNumber", async () => {
   });
 });
 
-describe("getChangenote", async () => {
-  await it("returns a note linking to the bundle release and the PR", async () => {
-    assert.equal(
-      getChangenote("1.2.3", testPrUrl),
-      "- Update default CodeQL bundle version to [1.2.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v1.2.3). [#42](https://github.com/github/codeql-action/pulls/42)\n",
-    );
+const testChangelog = `${EMPTY_CHANGELOG.trimEnd()}
+
+## 4.23.7
+
+- Other change
+
+## 4.23.6
+
+${NO_CHANGES_STR}`;
+
+const expectedChangelog = `# CodeQL Action Changelog
+
+## ${UNRELEASED_PLACEHOLDER}
+
+- Update default CodeQL bundle version to
+
+## 4.23.7
+
+- Other change
+
+## 4.23.6
+
+${NO_CHANGES_STR}`;
+
+describe("updateChangelog", async () => {
+  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
+    const result = updateChangelog(EMPTY_CHANGELOG, "");
+    assert.ok(!result.includes(NO_CHANGES_STR));
   });
 
-  await it("returns valid changenote content", async () => {
-    assert.ok(isValidChangenoteContent(getChangenote("1.2.3", testPrUrl)));
+  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
+    const result = updateChangelog(
+      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
+      "",
+    );
+    assert.ok(result.includes(NO_CHANGES_STR));
+  });
+
+  await it("throws if there are no sections", async () => {
+    assert.throws(() => {
+      updateChangelog(
+        "# CodeQL Action Changelog",
+        "- Update default CodeQL bundle version to",
+      );
+    });
+  });
+
+  await it("adds note at the end of the first section", async () => {
+    const result = updateChangelog(
+      testChangelog,
+      "- Update default CodeQL bundle version to",
+    );
+    assert.deepEqual(result, expectedChangelog);
   });
 });

pr-checks/bundle-changelog.ts

@@ -1,13 +1,17 @@
 #!/usr/bin/env npx tsx
 
 /**
- * Creates a changenote file for an update to the default CodeQL CLI bundle.
+ * Updates the changelog with a change note for an updated CodeQL CLI bundle.
  */
 
 import * as fs from "node:fs";
-import * as path from "node:path";
 
-import { CHANGENOTES_DIR, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
+import {
+  parseChangelog,
+  renderChangelog,
+  UNRELEASED_PLACEHOLDER,
+} from "./changelog";
+import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
 import { getErrorMessage } from "./util";
 
 export const CLI_VERSION_ENV_VAR = "CLI_VERSION";
@@ -54,19 +58,42 @@ export function getPRNumber(prUrl: string) {
 }
 
 /**
- * Returns the contents of the changenote file for an update to the default
- * CodeQL CLI bundle.
+ * Updates `changelog` by adding `changelogNote` to the first section.
  *
- * @param cliVersion The CodeQL CLI version of the new default bundle.
- * @param prUrl The URL of the PR that updates the default bundle.
- * @throws If the PR number can't be determined from `prUrl`.
+ * @param contents The existing changelog contents.
+ * @param changelogNote The note to add to the first section.
  */
-export function getChangenote(cliVersion: string, prUrl: string): string {
-  // The GitHub Release for the new bundle version.
-  const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
+export function updateChangelog(contents: string, changelogNote: string) {
+  // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
+  contents = contents.replace(
+    `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`,
+    `## ${UNRELEASED_PLACEHOLDER}\n`,
+  );
 
-  const prNumber = getPRNumber(prUrl);
-  return `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})\n`;
+  const changelog = parseChangelog(contents);
+
+  if (changelog.sections.length === 0) {
+    throw new Error("The changelog contains no existing sections.");
+  }
+
+  // Add the changelog note to the bottom of the first section.
+  const firstSection = changelog.sections[0];
+  const lastLine = firstSection.bodyLines.pop();
+
+  if (lastLine !== undefined && lastLine.trim() !== "") {
+    // We expect the last line to be empty. If it isn't for some reason,
+    // add it back.
+    firstSection.bodyLines.push(lastLine);
+  }
+
+  firstSection.bodyLines.push(changelogNote);
+
+  // If the last line is empty as expected, then add it back in after the new note.
+  if (lastLine?.trim() === "") {
+    firstSection.bodyLines.push(lastLine);
+  }
+
+  return renderChangelog(changelog);
 }
 
 function main() {
@@ -74,19 +101,22 @@ function main() {
     const cliVersion = getCLIVersion();
     const prUrl = getPRUrl();
 
-    // Include the CLI version in the file name so that changenotes for
-    // different bundle updates don't conflict.
-    const changenotePath = path.join(
-      CHANGENOTES_DIR,
-      `update-bundle-${cliVersion}.md`,
-    );
-    fs.writeFileSync(changenotePath, getChangenote(cliVersion, prUrl));
+    // The GitHub Release for the new bundle version.
+    const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
+
+    // Get the PR number from the PR URL.
+    const prNumber = getPRNumber(prUrl);
+    const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`;
+
+    let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
+
+    changelog = updateChangelog(changelog, changelogNote);
+
+    fs.writeFileSync(CHANGELOG_FILE, changelog);
 
     return 0;
   } catch (err) {
-    console.error(
-      `Failed to create changenote for bundle update: ${getErrorMessage(err)}`,
-    );
+    console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`);
     return -1;
   }
 }

pr-checks/check-unchanged.ts

@@ -1,153 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { parseArgs } from "node:util";
-
-import * as core from "@actions/core";
-
-import { runCommand, runGit } from "./command";
-import { LIB_ROOT, PR_CHECKS_DIR, REPO_ROOT } from "./config";
-import { getErrorMessage } from "./util";
-
-/**
- * Checks whether the repo is clean by running `git status --porcelain`.
- * If the repository is not clean, the changes are printed to stdout.
- *
- * @returns `true` if the repo is clean or `false` otherwise.
- */
-function isRepoClean(): boolean {
-  const stdout = runGit(["status", "--porcelain"]);
-
-  if (stdout === "") {
-    return true;
-  }
-
-  console.log(stdout);
-  return false;
-}
-
-/**
- * Checks whether the repository is clean to begin with, then runs {@link body}, and finally
- * checks if the repository is still clean.
- *
- * @param body The function to run.
- * @returns `true` if the repo is clean or `false` otherwise.
- */
-function checkUnchanged(body: () => void): boolean {
-  // Sanity check that repo is clean to start with
-  if (isRepoClean()) {
-    console.info("Repository is clean.");
-  } else {
-    // If we get a fail here then this workflow needs attention...
-    console.error("The repository contains uncomitted changes!");
-    return false;
-  }
-
-  body();
-
-  // Check that repo is still clean
-  const result = isRepoClean();
-  if (result) {
-    console.info("Repository is still clean.");
-  } else {
-    console.info("Repository is now dirty.");
-  }
-  return result;
-}
-
-/**
- * Produces a full diff for the repository and adds it to the workflow job summary
- * under the {@link summaryHeader} header.
- */
-async function addDiffToSummary(summaryHeader: string) {
-  const diffFile = path.join(
-    process.env["RUNNER_TEMP"] ?? PR_CHECKS_DIR,
-    "summary.diff",
-  );
-
-  try {
-    runCommand("git", ["status"]);
-    runCommand("git", ["diff", `--output=${diffFile}`], {
-      execOptions: { cwd: REPO_ROOT },
-    });
-
-    core.summary.addHeading(summaryHeader, 3);
-    core.summary.addCodeBlock(fs.readFileSync(diffFile, "utf-8"), "diff");
-    await core.summary.write();
-
-    try {
-      fs.rmSync(diffFile);
-    } catch (err) {
-      console.warn(
-        `Failed to remove temporary diff file from '${diffFile}': ${getErrorMessage(err)}`,
-      );
-    }
-  } catch (err) {
-    console.error(
-      `Failed to add full diff to summary for '${summaryHeader}': ${getErrorMessage(err)}`,
-    );
-  }
-}
-
-/**
- * Rebuilds the JavaScript by cleaning up and running `npm run build`.
- */
-function rebuildJavaScript() {
-  // Wipe the lib directory in case there are extra unnecessary files in there
-  console.info(`Removing ${LIB_ROOT}...`);
-  fs.rmSync(LIB_ROOT, { recursive: true, force: true });
-
-  // Generate the JavaScript files
-  runCommand("npm", ["run", "build"], { execOptions: { shell: true } });
-}
-
-/**
- * Formats YAML files with `npm run format-yaml`.
- */
-function formatYAML() {
-  runCommand("npm", ["run", "format-yaml"], { execOptions: { shell: true } });
-}
-
-async function main() {
-  const { values: options } = parseArgs({
-    options: { language: { type: "string", default: "javascript" } },
-  });
-  console.info(`Checking that ${options.language} files are unchanged.`);
-
-  if (options.language === "javascript") {
-    if (!checkUnchanged(rebuildJavaScript)) {
-      // If we get a fail here then the PR needs attention
-      console.error("Failed: JavaScript files are not up to date.");
-      console.error("Run 'rm -rf lib && npm run build' to update.");
-
-      await addDiffToSummary("Transpiled JS diff");
-
-      // Reset bundled files to allow other checks to test for changes
-      runCommand("git", ["checkout", "lib"]);
-
-      return 1;
-    }
-
-    console.info("Success: JavaScript files are up to date");
-  } else if (options.language === "yaml") {
-    if (!checkUnchanged(formatYAML)) {
-      // If we get a fail here then the PR needs attention
-      console.error("Failed: YAML files are not correctly formatted.");
-      console.error("Run 'npm run format-yaml' to format them.");
-
-      await addDiffToSummary("YAML formatting changes");
-
-      return 1;
-    }
-
-    console.info("Success: YAML files are correctly formatted");
-  } else {
-    console.error(`Unknown language: ${options.language}`);
-    return 1;
-  }
-
-  return 0;
-}
-
-process.exit(await main());

pr-checks/checks/all-platform-bundle.yml

@@ -3,7 +3,7 @@ description: "Tests using an all-platform CodeQL Bundle"
 operatingSystems:
   - ubuntu
   - os: macos
-    runner-image: macos-26-xlarge
+    runner-image: macos-latest-xlarge
   - windows
 versions:
   - nightly-latest

pr-checks/checks/analyze-ref-input.yml

@@ -14,5 +14,5 @@ steps:
     run: ./build.sh
   - uses: ./../action/analyze
     with:
-      ref: "refs/heads/main"
-      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+      ref: 'refs/heads/main'
+      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'