Deprecate isInTestMode in favour of a more clearly named method

.github/workflows/__multi-language-autodetect.yml

@@ -116,14 +116,13 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Python 3.13.15 for older CLI versions
-        # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
-        # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
+      - name: Install Python 3.13 for older CLI versions
+        # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.13.15'
+          python-version: '3.13'
 
       - name: Use Xcode 16
         # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.

eslint.config.mjs

@@ -140,6 +140,18 @@ export default [
       "no-async-foreach/no-async-foreach": "error",
       "no-sequences": "error",
       "no-shadow": "off",
+
+      // A basic check that we don't use `exportVariable` from `@actions/core`. This rule depends on
+      // the module being imported as `core`, but that is a good enough check for us.
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector:
+            "MemberExpression[object.name='core'][property.name='exportVariable']",
+          message: "Use `exportVariable` from `environment.ts` instead.",
+        },
+      ],
+
       // This is overly restrictive with unsetting `EnvVar`s
       "@typescript-eslint/no-dynamic-delete": "off",
       "@typescript-eslint/no-shadow": "error",
@@ -157,6 +169,15 @@ export default [
       ],
     },
   },
+  {
+    files: ["src/environment.ts"],
+
+    // We allow `exportVariable` from `@actions/core` to be used in this file
+    // since it defines the wrapper around it that other modules use.
+    rules: {
+      "no-restricted-syntax": "off",
+    },
+  },
   {
     files: ["**/*.ts", "**/*.js"],
 

pr-checks/checks/multi-language-autodetect.yml

@@ -20,14 +20,13 @@ env:
 installGo: true
 installDotNet: true
 steps:
-  - name: Install Python 3.13.15 for older CLI versions
-    # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
-    # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
+  - name: Install Python 3.13 for older CLI versions
+    # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
     # See https://github.com/github/codeql-action/pull/3212
     if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
     uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
     with:
-      python-version: "3.13.15"
+      python-version: "3.13"
 
   - name: Use Xcode 16
     # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.

queries/default-setup-environment-variables.ql

@@ -23,7 +23,8 @@ predicate isSafeForDefaultSetup(string envVar) {
       "GITHUB_BASE_REF", "GITHUB_EVENT_NAME", "GITHUB_JOB", "GITHUB_RUN_ATTEMPT", "GITHUB_RUN_ID",
       "GITHUB_SHA", "GITHUB_REPOSITORY", "GITHUB_SERVER_URL", "GITHUB_TOKEN", "GITHUB_WORKFLOW",
       "GITHUB_WORKSPACE", "GOFLAGS", "ImageVersion", "JAVA_TOOL_OPTIONS", "RUNNER_ARCH",
-      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE"
+      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE",
+      "NODE_ENV"
     ]
 }
 

src/actions-util.ts

@@ -30,7 +30,6 @@ declare const __CODEQL_ACTION_VERSION__: string;
 export interface ActionsEnv {
   getRequiredInput: (name: string) => string;
   getOptionalInput: (name: string) => string | undefined;
-  exportVariable: (name: string, value: string) => void;
 }
 
 /**
@@ -40,7 +39,6 @@ export function getActionsEnv(): ActionsEnv {
   return {
     getRequiredInput,
     getOptionalInput,
-    exportVariable: core.exportVariable,
   };
 }
 

src/analyze-action.ts

@@ -214,9 +214,10 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
 
 async function run({
   startedAt,
+  env,
   logger,
   actions,
-}: ActionState<["Base", "Logger", "Actions"]>) {
+}: ActionState<["Base", "Env", "Logger", "Actions"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
 
@@ -287,7 +288,7 @@ async function run({
 
     const apiDetails = getApiDetails();
     const outputDir = actionsUtil.getRequiredInput("output");
-    core.exportVariable(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
+    env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
     const threads = util.getThreadsFlag(
       actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"],
       logger,
@@ -456,7 +457,7 @@ async function run({
         `expect-error input was set to true but no error was thrown.`,
       );
     }
-    core.exportVariable(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+    env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
   } catch (unwrappedError) {
     const error = util.wrapError(unwrappedError);
     if (

src/api-client.ts

@@ -17,6 +17,7 @@ import {
   ReadOnlyEnv,
   RegistryProxyVars,
   getEnv,
+  exportVariable,
 } from "./environment";
 import { Logger } from "./logging";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
@@ -316,7 +317,7 @@ export async function getAnalysisKey(): Promise<string> {
   const jobName = getRequiredEnvParam("GITHUB_JOB");
 
   analysisKey = `${workflowPath}:${jobName}`;
-  core.exportVariable(EnvVar.ANALYSIS_KEY, analysisKey);
+  exportVariable(EnvVar.ANALYSIS_KEY, analysisKey);
   return analysisKey;
 }
 

src/autobuild-action.ts

@@ -68,7 +68,11 @@ async function sendCompletedStatusReport(
   }
 }
 
-async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
+async function run({
+  startedAt,
+  env,
+  logger,
+}: ActionState<["Base", "Env", "Logger"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
 
@@ -135,7 +139,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
     return;
   }
 
-  core.exportVariable(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
+  env.export(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
 
   await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
 }

src/autobuild.ts

@@ -1,11 +1,9 @@
-import * as core from "@actions/core";
-
 import { getTemporaryDirectory, getWorkflowEventName } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { ActionsEnvVars, EnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar, exportVariable } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -136,16 +134,16 @@ export async function setupCppAutobuild(codeql: CodeQL, logger: Logger) {
             : ""
         }`,
       );
-      core.exportVariable(envVar, "false");
+      exportVariable(envVar, "false");
     } else {
       logger.info(
         `Enabling ${featureName}. This can be disabled by setting the ${envVar} environment variable to 'false'. See ${DocUrl.DEFINE_ENV_VARIABLES} for more information.`,
       );
-      core.exportVariable(envVar, "true");
+      exportVariable(envVar, "true");
     }
   } else {
     logger.info(`Disabling ${featureName}.`);
-    core.exportVariable(envVar, "false");
+    exportVariable(envVar, "false");
   }
 }
 
@@ -165,7 +163,7 @@ export async function runAutobuild(
     await codeQL.runAutobuild(config, language);
   }
   if (language === BuiltInLanguage.go) {
-    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
+    exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
   }
   logger.endGroup();
 }

src/codeql.ts

@@ -17,7 +17,7 @@ import type { VersionInfo } from "./cli/types";
 import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar, getEnv, exportVariable } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -1054,7 +1054,7 @@ async function getCodeQLForCmd(
         }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
         "continue using this version of the CodeQL Action.",
     );
-    core.exportVariable(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    exportVariable(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
   }
   return codeql;
 }

src/config-utils.ts

@@ -2,7 +2,6 @@ import * as fs from "fs";
 import * as path from "path";
 import { performance } from "perf_hooks";
 
-import * as core from "@actions/core";
 import * as yaml from "js-yaml";
 
 import { ActionState } from "./action-common";
@@ -46,7 +45,7 @@ import {
   makeTelemetryDiagnostic,
 } from "./diagnostics";
 import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportVariable } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
 import {
@@ -965,10 +964,10 @@ async function setCppTrapCachingEnvironmentVariables(
       );
     } else if (config.trapCaches[BuiltInLanguage.cpp]) {
       logger.info("Enabling TRAP caching for C/C++.");
-      core.exportVariable(envVar, "true");
+      exportVariable(envVar, "true");
     } else {
       logger.debug(`Disabling TRAP caching for C/C++.`);
-      core.exportVariable(envVar, "false");
+      exportVariable(envVar, "false");
     }
   }
 }

src/debug-artifacts.ts

@@ -11,7 +11,7 @@ import { dbIsFinalized } from "./analyze";
 import { scanArtifactsForTokens } from "./artifact-scanner";
 import { type CodeQL } from "./codeql";
 import { Config } from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportVariable } from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
 import { Logger, withGroup } from "./logging";
@@ -330,7 +330,7 @@ export async function uploadArtifacts(
   // some issues early.
   if (isInTestMode()) {
     await scanArtifactsForTokens(toUpload, logger);
-    core.exportVariable("CODEQL_ACTION_ARTIFACT_SCAN_FINISHED", "true");
+    exportVariable("CODEQL_ACTION_ARTIFACT_SCAN_FINISHED", "true");
   }
 
   const suffix = getArtifactSuffix(getOptionalInput("matrix"));

src/environment.ts

@@ -1,3 +1,5 @@
+import * as core from "@actions/core";
+
 /**
  * Environment variables used by Default Setup to communicate the private registry proxy configuration.
  */
@@ -211,8 +213,20 @@ export enum ActionsEnvVars {
   RUNNER_TOOL_CACHE = "RUNNER_TOOL_CACHE",
 }
 
+/** Environment variables which are not specific to CodeQL. */
+export enum SystemEnvVar {
+  /**
+   * Used by Node and related tools to indicate what kind of environment we are running in.
+   */
+  NODE_ENV = "NODE_ENV",
+}
+
 /** A type representing all known environment variables. */
-export type KnownEnvVar = EnvVar | ActionsEnvVars | RegistryProxyVars;
+export type KnownEnvVar =
+  | EnvVar
+  | ActionsEnvVars
+  | RegistryProxyVars
+  | SystemEnvVar;
 
 /**
  * Gets an environment variable, but throws an error if it is not set.
@@ -289,6 +303,26 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
   public entries(): Array<[string, T]> {
     return Object.entries(this.vars);
   }
+
+  /**
+   * Gets a value indicating whether we should skip uploads of
+   * all kinds (SARIF results, status reports, DBs, ...).
+   *
+   * This is not guaranteed to be set in all test environments.
+   */
+  public isSkippingUploadsInTests(): boolean {
+    return this.getOptional(EnvVar.TEST_MODE) === "true";
+  }
+
+  /**
+   * Gets a value indicative of whether we are in a testing environment
+   * by testing whether the value of the `NODE_ENV` variable is "test".
+   * This is expected to be the case if e.g. `ava` is running the tests
+   * or if this instance was constructed by `getTestEnv`.
+   */
+  public isTestingEnv(): boolean {
+    return this.getOptional(SystemEnvVar.NODE_ENV) === "test";
+  }
 }
 
 /**
@@ -307,6 +341,26 @@ export class Env<
     this.changed = true;
   }
 
+  /**
+   * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
+   * when running unit tests. This is important, because otherwise `core.exportVariable`
+   * sets environment variables for other steps in a workflow when we run unit tests in CI.
+   *
+   * @param name The name of the environment variable to set and export.
+   * @param val The value to set and export for the environment variable.
+   */
+  public export(name: string, val: T): void {
+    // Setting the environment variable for this instance is always OK, including
+    // in tests, since we use fresh `Env` instances whenever needed. This allows
+    // tests to pass that rely on that part of the `core.exportVariable` behaviour.
+    this.set(name, val);
+
+    // Call `core.exportVariable` whenever we are not in a test environment.
+    if (!this.isTestingEnv()) {
+      core.exportVariable(name, val);
+    }
+  }
+
   /** Gets a value indicating whether `set` was called at least once. */
   public hasChanged(): boolean {
     return this.changed;
@@ -317,3 +371,34 @@ export class Env<
 export function getEnv(env: NodeJS.ProcessEnv = process.env): Env {
   return new Env(env);
 }
+
+/**
+ * Returns whether we are in test mode. This is used by CodeQL Action PR checks.
+ *
+ * In test mode, we skip several uploads (SARIF results, status reports, DBs, ...).
+ *
+ * @deprecated
+ *  The purpose of this function is ambiguous. Use `isSkippingUploadsInTests` on
+ *  a `ReadOnlyEnv` instance instead for equivalent behaviour. Use `isTestingEnv`
+ *  to determine if we are running in a unit test.
+ */
+export function isInTestMode(): boolean {
+  return getEnv().isSkippingUploadsInTests();
+}
+
+/**
+ * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
+ * when running unit tests. This is important, because otherwise `core.exportVariable`
+ * sets environment variables for other steps in a workflow when we run unit tests in CI.
+ *
+ * @deprecated Use `export` on an `Env` instance instead.
+ */
+export function exportVariable(name: string, val: any): void {
+  const env = getEnv();
+
+  if (typeof val === "string") {
+    env.export(name, val);
+  } else {
+    env.export(name, JSON.stringify(val));
+  }
+}

src/init-action-post.ts

@@ -21,7 +21,7 @@ import {
   DependencyCachingUsageReport,
   getDependencyCacheUsage,
 } from "./dependency-caching";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar, getEnv, exportVariable } from "./environment";
 import { initFeatures } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import * as initActionPostHelper from "./init-action-post-helper";
@@ -166,7 +166,7 @@ function getFinalJobStatus(config: Config | undefined): JobStatus {
   let jobStatus: JobStatus;
 
   if (process.env[EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY] === "true") {
-    core.exportVariable(EnvVar.JOB_STATUS, JobStatus.SuccessStatus);
+    exportVariable(EnvVar.JOB_STATUS, JobStatus.SuccessStatus);
     jobStatus = JobStatus.SuccessStatus;
   } else if (config !== undefined) {
     // - We have computed a CodeQL config
@@ -191,7 +191,7 @@ function getFinalJobStatus(config: Config | undefined): JobStatus {
 
   // This shouldn't be necessary, but in the odd case that we run more than one
   // `init` post step, ensure the job status is consistent between them.
-  core.exportVariable(EnvVar.JOB_STATUS, jobStatus);
+  exportVariable(EnvVar.JOB_STATUS, jobStatus);
   return jobStatus;
 }
 

src/init-action.ts

@@ -93,7 +93,6 @@ import {
   checkActionVersion,
   getErrorMessage,
   BuildMode,
-  getOptionalEnvVar,
 } from "./util";
 import { checkWorkflow } from "./workflow";
 
@@ -253,7 +252,7 @@ async function run(
     );
     const repositoryProperties = repositoryPropertiesResult.orElse({});
 
-    core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true");
+    actionState.env.export(EnvVar.INIT_ACTION_HAS_RUN, "true");
 
     // path.resolve() respects the intended semantics of source-root. If
     // source-root is relative, it is relative to the GITHUB_WORKSPACE. If
@@ -369,7 +368,7 @@ async function run(
         );
       }
       if (semver.lt(actualVer, publicPreview)) {
-        core.exportVariable(EnvVar.EXPERIMENTAL_FEATURES, "true");
+        actionState.env.export(EnvVar.EXPERIMENTAL_FEATURES, "true");
         logger.info("Experimental Rust analysis enabled");
       }
     }
@@ -517,9 +516,9 @@ async function run(
     }
 
     // Forward Go flags
-    const goFlags = process.env["GOFLAGS"];
+    const goFlags = actionState.env.getOptional("GOFLAGS");
     if (goFlags) {
-      core.exportVariable("GOFLAGS", goFlags);
+      actionState.env.export("GOFLAGS", goFlags);
       core.warning(
         "Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.",
       );
@@ -565,7 +564,7 @@ async function run(
 
             // Store the original location of our wrapper script somewhere where we can
             // later retrieve it from and cross-check that it hasn't been changed.
-            core.exportVariable(EnvVar.GO_BINARY_LOCATION, goWrapperPath);
+            actionState.env.export(EnvVar.GO_BINARY_LOCATION, goWrapperPath);
           } catch (e) {
             logger.warning(
               `Analyzing Go on Linux, but failed to install wrapper script. Tracing custom builds may fail: ${e}`,
@@ -574,7 +573,7 @@ async function run(
         } else {
           // Store the location of the original Go binary, so we can check that no setup tasks were performed after the
           // `init` Action ran.
-          core.exportVariable(EnvVar.GO_BINARY_LOCATION, goBinaryPath);
+          actionState.env.export(EnvVar.GO_BINARY_LOCATION, goBinaryPath);
         }
       } catch (e) {
         logger.warning(
@@ -609,12 +608,12 @@ async function run(
     // threads it would ask extractors to use. See help text for the "--ram" and "--threads"
     // options at https://codeql.github.com/docs/codeql-cli/manual/database-trace-command/
     // for details.
-    core.exportVariable(
+    actionState.env.export(
       "CODEQL_RAM",
       process.env["CODEQL_RAM"] ||
         getCodeQLMemoryLimit(getOptionalInput("ram"), logger).toString(),
     );
-    core.exportVariable(
+    actionState.env.export(
       "CODEQL_THREADS",
       process.env["CODEQL_THREADS"] ||
         getThreadsFlagValue(getOptionalInput("threads"), logger).toString(),
@@ -622,12 +621,15 @@ async function run(
 
     // Disable Kotlin extractor if feature flag set
     if (await features.getValue(Feature.DisableKotlinAnalysisEnabled)) {
-      core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
+      actionState.env.export(
+        "CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN",
+        "true",
+      );
     }
 
     // Emergency override to force the CodeQL CLI back to the JGit-based Git backend.
     if (await features.getValue(Feature.ForceJGit)) {
-      core.exportVariable("CODEQL_GIT_BACKEND", "jgit");
+      actionState.env.export("CODEQL_GIT_BACKEND", "jgit");
     }
 
     const kotlinLimitVar =
@@ -636,7 +638,7 @@ async function run(
       (await codeQlVersionAtLeast(codeql, "2.20.3")) &&
       !(await codeQlVersionAtLeast(codeql, "2.20.4"))
     ) {
-      core.exportVariable(kotlinLimitVar, "2.1.20");
+      actionState.env.export(kotlinLimitVar, "2.1.20");
     }
 
     // Restore dependency cache(s), if they exist.
@@ -685,7 +687,7 @@ async function run(
       config.buildMode === BuildMode.None &&
       config.languages.includes(BuiltInLanguage.java)
     ) {
-      core.exportVariable(
+      actionState.env.export(
         EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS,
         "true",
       );
@@ -743,7 +745,7 @@ async function run(
     const tracerConfig = await getCombinedTracerConfig(logger, codeql, config);
     if (tracerConfig !== undefined) {
       for (const [key, value] of Object.entries(tracerConfig.env)) {
-        core.exportVariable(key, value);
+        actionState.env.export(key, value);
       }
     }
 
@@ -751,10 +753,10 @@ async function run(
     if (await features.getValue(Feature.JavaNetworkDebugging)) {
       // Get the existing value of `JAVA_TOOL_OPTIONS`, if any.
       const existingJavaToolOptions =
-        getOptionalEnvVar(JavaEnvVars.JAVA_TOOL_OPTIONS) || "";
+        actionState.env.getOptional(JavaEnvVars.JAVA_TOOL_OPTIONS) ?? "";
 
       // Add the network debugging options.
-      core.exportVariable(
+      actionState.env.export(
         JavaEnvVars.JAVA_TOOL_OPTIONS,
         `${existingJavaToolOptions} -Djavax.net.debug=all`,
       );

src/init.test.ts

@@ -1,14 +1,13 @@
 import * as fs from "fs";
 import path from "path";
 
-import * as core from "@actions/core";
 import * as github from "@actions/github";
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
 
 import * as actionsUtil from "./actions-util";
 import { createStubCodeQL } from "./codeql";
-import { ActionsEnvVars } from "./environment";
+import * as environment from "./environment";
 import { Feature } from "./feature-flags";
 import {
   checkPacksForOverlayCompatibility,
@@ -85,7 +84,7 @@ for (const { runnerEnv, ErrorConstructor, message } of [
     `cleanupDatabaseClusterDirectory throws a ${ErrorConstructor.name} when cleanup fails on ${runnerEnv} runner`,
     async (t) => {
       await withTmpDir(async (tmpDir: string) => {
-        process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;
+        process.env[environment.ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;
 
         const dbLocation = path.resolve(tmpDir, "dbs");
         fs.mkdirSync(dbLocation, { recursive: true });
@@ -546,7 +545,7 @@ test.serial(
 test.serial(
   "file coverage deprecation warning for org-owned repo with default setup recommends repo property",
   (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
     github.context.payload = {
       repository: {
@@ -573,7 +572,7 @@ test.serial(
 test.serial(
   "file coverage deprecation warning for org-owned repo with advanced setup recommends env var and repo property",
   (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
     github.context.payload = {
       repository: {
@@ -601,7 +600,7 @@ test.serial(
 test.serial(
   "file coverage deprecation warning for user-owned repo with default setup recommends advanced setup",
   (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
     github.context.payload = {
       repository: {
@@ -627,7 +626,7 @@ test.serial(
 test.serial(
   "file coverage deprecation warning for user-owned repo with advanced setup recommends env var",
   (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
     github.context.payload = {
       repository: {
@@ -652,7 +651,7 @@ test.serial(
 test.serial(
   "file coverage deprecation warning for unknown owner type with default setup recommends advanced setup",
   (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
     github.context.payload = { repository: undefined };
     const messages: LoggedMessage[] = [];
@@ -673,7 +672,7 @@ test.serial(
 test.serial(
   "file coverage deprecation warning for unknown owner type with advanced setup recommends env var",
   (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
     github.context.payload = { repository: undefined };
     const messages: LoggedMessage[] = [];
@@ -695,7 +694,7 @@ test.serial(
   (t) => {
     process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION"] =
       "true";
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportVariableStub = sinon.stub(environment, "exportVariable");
     const messages: LoggedMessage[] = [];
     logFileCoverageOnPrsDeprecationWarning(getRecordingLogger(messages));
     t.is(messages.length, 0);

src/init.ts

@@ -1,7 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";
@@ -17,7 +16,7 @@ import {
 import { GitHubApiDetails } from "./api-client";
 import { CodeQL, setupCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportVariable } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -411,5 +410,5 @@ export function logFileCoverageOnPrsDeprecationWarning(logger: Logger): void {
   }
 
   logger.warning(message);
-  core.exportVariable(EnvVar.DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION, "true");
+  exportVariable(EnvVar.DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION, "true");
 }

src/overlay/caching.test.ts

@@ -8,6 +8,7 @@ import * as sinon from "sinon";
 import * as actionsUtil from "../actions-util";
 import * as apiClient from "../api-client";
 import type { ResolveDatabaseOutput } from "../codeql";
+import * as environment from "../environment";
 import * as gitUtils from "../git-utils";
 import { BuiltInLanguage } from "../languages";
 import { getRunnerLogger } from "../logging";
@@ -82,7 +83,7 @@ const testDownloadOverlayBaseDatabaseFromCache = makeMacro({
 
       sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
 
-      sinon.stub(utils, "isInTestMode").returns(testCase.isInTestMode);
+      sinon.stub(environment, "isInTestMode").returns(testCase.isInTestMode);
 
       if (testCase.restoreCacheResult instanceof Error) {
         sinon

src/setup-codeql-action.ts

@@ -184,7 +184,7 @@ async function run(
     core.setOutput("codeql-path", codeql.getPath());
     core.setOutput("codeql-version", (await codeql.getVersion()).version);
 
-    core.exportVariable(EnvVar.SETUP_CODEQL_ACTION_HAS_RUN, "true");
+    actionState.env.export(EnvVar.SETUP_CODEQL_ACTION_HAS_RUN, "true");
   } catch (unwrappedError) {
     const error = wrapError(unwrappedError);
     core.setFailed(error.message);

src/setup-codeql.ts

@@ -3,7 +3,6 @@ import { OutgoingHttpHeaders } from "http";
 import * as path from "path";
 import { performance } from "perf_hooks";
 
-import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";
 import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
@@ -29,7 +28,7 @@ import {
   makeDiagnostic,
   makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar, exportVariable, getEnv } from "./environment";
 import {
   CODEQL_VERSION_ZSTD_BUNDLE,
   CodeQLDefaultVersionInfo,
@@ -1071,7 +1070,7 @@ export async function setupCodeQLBundle(
 
   // Record that this job now has a copy of the CodeQL tools, so that a later step doesn't delete
   // the toolcache out from under the path we are about to return.
-  core.exportVariable(EnvVar.HAS_SET_UP_CODEQL, "true");
+  exportVariable(EnvVar.HAS_SET_UP_CODEQL, "true");
 
   return {
     codeqlFolder,

src/status-report.ts

@@ -23,7 +23,13 @@ import type { ComputedInput, InputName } from "./config/inputs";
 import { parseRegistriesWithoutCredentials } from "./config/pack-registries";
 import type { DependencyCacheRestoreStatusReport } from "./dependency-caching";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment";
+import {
+  EnvVar,
+  getEnv,
+  ReadOnlyEnv,
+  RegistryProxyVars,
+  exportVariable,
+} from "./environment";
 import { getRef } from "./git-utils";
 import * as json from "./json";
 import type { Logger } from "./logging";
@@ -71,9 +77,7 @@ export function getDisplayActionName(actionName: ActionName): string {
  * environment and returns it.
  * If a new UUID is generated, it is also exported as an environment variable.
  */
-export function getJobUUID(
-  action: ActionState<["Logger", "ReadOnlyEnv", "Actions"]>,
-) {
+export function getJobUUID(action: ActionState<["Logger", "Env", "Actions"]>) {
   // Check if we already have a UUID for the analysis and return it if so.
   const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID);
 
@@ -86,7 +90,7 @@ export function getJobUUID(
   const jobRunUuid = uuid.v4();
   action.logger.info(`Job run UUID is ${jobRunUuid}.`);
 
-  action.actions.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid);
+  action.env.export(EnvVar.JOB_RUN_UUID, jobRunUuid);
   return jobRunUuid;
 }
 
@@ -268,12 +272,12 @@ export function getJobStatusDisplayName(status: JobStatus): string {
  */
 function setJobStatusIfUnsuccessful(actionStatus: ActionStatus) {
   if (actionStatus === "user-error") {
-    core.exportVariable(
+    exportVariable(
       EnvVar.JOB_STATUS,
       process.env[EnvVar.JOB_STATUS] ?? JobStatus.ConfigErrorStatus,
     );
   } else if (actionStatus === "failure" || actionStatus === "aborted") {
-    core.exportVariable(
+    exportVariable(
       EnvVar.JOB_STATUS,
       process.env[EnvVar.JOB_STATUS] ?? JobStatus.FailureStatus,
     );
@@ -376,7 +380,7 @@ export async function createStatusReportBase(
     let workflowStartedAt = process.env[EnvVar.WORKFLOW_STARTED_AT];
     if (workflowStartedAt === undefined) {
       workflowStartedAt = actionStartedAt.toISOString();
-      core.exportVariable(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt);
+      exportVariable(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt);
     }
     const runnerOs = getRequiredEnvParam("RUNNER_OS");
     const codeQlCliVersion = getCachedCodeQlVersion(
@@ -388,7 +392,7 @@ export async function createStatusReportBase(
     // re-export the testing environment variable so that it is available to subsequent steps,
     // even if it was only set for this step
     if (testingEnvironment) {
-      core.exportVariable(EnvVar.TESTING_ENVIRONMENT, testingEnvironment);
+      exportVariable(EnvVar.TESTING_ENVIRONMENT, testingEnvironment);
     }
     const isSteadyStateDefaultSetupRun =
       process.env["CODE_SCANNING_IS_STEADY_STATE_DEFAULT_SETUP"] === "true";

src/testing-utils.ts

@@ -184,6 +184,12 @@ export function makeMacro<Args extends unknown[]>(
 }
 
 export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env {
+  // In unit tests run by `ava`, this environment variable is set for the process,
+  // but we default to an empty environment here for `testEnv`, so we must set it
+  // explicitly to ensure that we get test-specific behaviour in functions when
+  // we need it.
+  testEnv["NODE_ENV"] = "test";
+
   return getEnv(testEnv);
 }
 
@@ -202,10 +208,6 @@ class TestActionsEnv implements ActionsEnv {
   public getOptionalInput(_name: string): string | undefined {
     return undefined;
   }
-
-  public exportVariable(name: string, value: string): void {
-    this.env.set(name, value);
-  }
 }
 
 /**

src/upload-lib.ts

@@ -14,7 +14,7 @@ import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import { getConfig } from "./config-utils";
 import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportVariable } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
 import * as gitUtils from "./git-utils";
@@ -126,7 +126,7 @@ async function combineSarifFilesUsingCLI(
       logger.warning(
         `Uploading multiple SARIF runs with the same category is deprecated ${deprecationWarningMessage}. Please update your workflow to upload a single run per category. ${deprecationMoreInformationMessage}`,
       );
-      core.exportVariable("CODEQL_MERGE_SARIF_DEPRECATION_WARNING", "true");
+      exportVariable("CODEQL_MERGE_SARIF_DEPRECATION_WARNING", "true");
     }
 
     // If not, use the naive method of combining the files.
@@ -1032,7 +1032,7 @@ export function validateUniqueCategory(
           `Category: (${id ? id : "none"}) Tool: (${tool ? tool : "none"})`,
       );
     }
-    core.exportVariable(sentinelEnvVar, sentinelEnvVar);
+    exportVariable(sentinelEnvVar, sentinelEnvVar);
   }
 }
 

src/util.ts

@@ -14,13 +14,23 @@ import * as apiCompatibility from "./api-compatibility.json";
 import type { CodeQL } from "./codeql";
 import type { Pack } from "./config/db-config";
 import type { Config } from "./config-utils";
-import { EnvVar, getRequiredEnvParam } from "./environment";
+import {
+  EnvVar,
+  getRequiredEnvParam,
+  isInTestMode,
+  exportVariable,
+} from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 
 // Re-export for backwards compatibility to avoid updating a lot of imports elsewhere.
-export { getRequiredEnvParam, getOptionalEnvVar, getEnv } from "./environment";
+export {
+  getRequiredEnvParam,
+  getOptionalEnvVar,
+  getEnv,
+  isInTestMode,
+} from "./environment";
 
 /**
  * The name of the file containing the base database OIDs, as stored in the
@@ -542,7 +552,7 @@ export function checkGitHubVersionInRange(
     );
   }
   hasBeenWarnedAboutVersion = true;
-  core.exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
+  exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
 }
 
 export enum DisallowedAPIVersionReason {
@@ -586,11 +596,11 @@ export function assertNever(value: never): never {
  * knowing what version of CodeQL we're running.
  */
 export function initializeEnvironment(version: string) {
-  core.exportVariable(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
-  core.exportVariable(EnvVar.FEATURE_SANDWICH, "false");
-  core.exportVariable(EnvVar.FEATURE_SARIF_COMBINE, "true");
-  core.exportVariable(EnvVar.FEATURE_WILL_UPLOAD, "true");
-  core.exportVariable(EnvVar.VERSION, version);
+  exportVariable(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
+  exportVariable(EnvVar.FEATURE_SANDWICH, "false");
+  exportVariable(EnvVar.FEATURE_SARIF_COMBINE, "true");
+  exportVariable(EnvVar.FEATURE_WILL_UPLOAD, "true");
+  exportVariable(EnvVar.VERSION, version);
 }
 
 export class HTTPError extends Error {
@@ -711,15 +721,6 @@ export function isGoodVersion(versionSpec: string) {
   return !BROKEN_VERSIONS.includes(versionSpec);
 }
 
-/**
- * Returns whether we are in test mode. This is used by CodeQL Action PR checks.
- *
- * In test mode, we skip several uploads (SARIF results, status reports, DBs, ...).
- */
-export function isInTestMode(): boolean {
-  return process.env[EnvVar.TEST_MODE] === "true";
-}
-
 /**
  * Returns whether we specifically want to skip uploading SARIF files.
  */
@@ -948,7 +949,7 @@ export async function checkDiskUsage(
       } else {
         logger.debug(message);
       }
-      core.exportVariable(EnvVar.HAS_WARNED_ABOUT_DISK_SPACE, "true");
+      exportVariable(EnvVar.HAS_WARNED_ABOUT_DISK_SPACE, "true");
     }
     return {
       numAvailableBytes: diskUsage.bavail * blockSizeInBytes,
@@ -997,7 +998,7 @@ export function checkActionVersion(
           "https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/",
       );
       // set LOG_VERSION_DEPRECATION env var to prevent the warning from being logged multiple times
-      core.exportVariable(EnvVar.LOG_VERSION_DEPRECATION, "true");
+      exportVariable(EnvVar.LOG_VERSION_DEPRECATION, "true");
     }
   }
 }