Fix test for toolcache

* Add `bundleName` argument to `getCodeQLBundleDownloadURL`
* Add `languages` argument to `setupCodeQL`.

The logic now tries to find the platform-language pkg before defaulting
to the full bundle. We keep the toolcache clean by adding the pl version
to the tool version.

.eslintignore

@@ -0,0 +1,5 @@
+**/webpack.config.js
+lib/**
+runner/dist/**
+src/testdata/**
+tests/**

.eslintrc.json

@@ -0,0 +1,59 @@
+
+{
+    "parser": "@typescript-eslint/parser",
+    "parserOptions": {
+        "project": "./tsconfig.json"
+    },
+    "plugins": ["@typescript-eslint", "filenames", "github", "import", "no-async-foreach"],
+    "extends": [
+        "eslint:recommended",
+        "plugin:@typescript-eslint/recommended",
+        "plugin:@typescript-eslint/recommended-requiring-type-checking",
+        "plugin:github/recommended",
+        "plugin:github/typescript"
+    ],
+    "rules": {
+        "filenames/match-regex": ["error", "^[a-z0-9-]+(\\.test)?$"],
+        "import/extensions": "error",
+        "import/no-amd": "error",
+        "import/no-commonjs": "error",
+        "import/no-dynamic-require": "error",
+        "import/no-extraneous-dependencies": ["error", {"devDependencies": false}],
+        "import/no-namespace": "off",
+        "import/no-unresolved": "error",
+        "import/no-webpack-loader-syntax": "error",
+        "no-async-foreach/no-async-foreach": "error",
+        "no-console": "off",
+        "no-sequences": "error",
+        "one-var": ["error", "never"],
+        "sort-imports": ["error", { "allowSeparatedGroups": true }]
+    },
+    "overrides": [{
+        // "temporarily downgraded during transition to eslint
+        "files": "**",
+        "rules": {
+            "@typescript-eslint/ban-types": "off",
+            "@typescript-eslint/explicit-module-boundary-types": "off",
+            "@typescript-eslint/no-explicit-any": "off",
+            "@typescript-eslint/no-unsafe-assignment": "off",
+            "@typescript-eslint/no-unsafe-call": "off",
+            "@typescript-eslint/no-unsafe-member-access": "off",
+            "@typescript-eslint/no-unsafe-return": "off",
+            "@typescript-eslint/no-unused-vars": "off",
+            "@typescript-eslint/no-var-requires": "off",
+            "@typescript-eslint/prefer-regexp-exec": "off",
+            "@typescript-eslint/require-await": "off",
+            "@typescript-eslint/restrict-template-expressions": "off",
+            "eslint-comments/no-use": "off",
+            "func-style": "off",
+            "github/array-foreach": "off",
+            "github/no-then": "off",
+            "import/no-extraneous-dependencies": "off",
+            "no-shadow": "off",
+            "no-sparse-arrays": "off",
+            "no-throw-literal": "off",
+            "no-useless-escape": "off",
+            "sort-imports": "off"
+        }
+    }]
+}

.git-blame-ignore-revs

@@ -1,3 +0,0 @@
-# .git-blame-ignore-revs
-# Added trailing commas to adhere to new eslint rules
-b16296be30e150034524d6dd0b0418fc6b184267

.gitattributes

@@ -1,9 +1 @@
 lib/*.js linguist-generated=true
-.github/workflows/__* linguist-generated=true
-
-# Reduce incidence of needless merge conflicts on CHANGELOG.md
-# The man page at
-# https://mirrors.edge.kernel.org/pub/software/scm/git/docs/gitattributes.html
-# suggests that this might interleave lines arbitrarily, but empirically
-# it keeps added chunks contiguous
-CHANGELOG.md                merge=union

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
-    url: https://support.github.com/request
-    about: Contact Support 
+    url: https://support.github.com/contact?subject=Code+Scanning+Beta+Support&tags=code-scanning-support
+    about: Contact Support about code scanning

.github/actions/check-codescanning-config/action.yml

@@ -1,72 +0,0 @@
-name: Check Code-Scanning Config
-description: |
-    Checks the code scanning configuration file generated by the
-    action to ensure it contains the expected contents
-inputs:
-  languages:
-    required: false
-    description: The languages field passed to the init action.
-
-  packs:
-    required: false
-    description: The packs field passed to the init action.
-
-  queries:
-    required: false
-    description: The queries field passed to the init action.
-
-  config-file-test:
-    required: false
-    description: |
-      The location of the config file to use. If empty,
-      then no config file is used.
-
-  expected-config-file-contents:
-    required: true
-    description: |
-      A JSON string containing the exact contents of the config file.
-
-  tools:
-    required: true
-    description: |
-      The version of CodeQL passed to the `tools` input of the init action.
-      This can be any of the following:
-
-      - A local path to a tarball containing the CodeQL tools, or
-      - A URL to a GitHub release assets containing the CodeQL tools, or
-      - A special value `linked` which is forcing the use of the CodeQL tools
-        that the action has been bundled with.
-
-      If not specified, the Action will check in several places until it finds
-      the CodeQL tools.
-
-runs:
-  using: composite
-  steps:
-    - uses: ./../action/init
-      with:
-        languages: ${{ inputs.languages }}
-        config-file: ${{ inputs.config-file-test }}
-        queries: ${{ inputs.queries }}
-        packs: ${{ inputs.packs }}
-        tools: ${{ inputs.tools }}
-        db-location: ${{ runner.temp }}/codescanning-config-cli-test
-      env:
-        CODEQL_ACTION_TEST_MODE: 'true'
-
-    - name: Install dependencies
-      shell: bash
-      run: npm install --location=global ts-node js-yaml
-
-    - name: Check config
-      working-directory: ${{ github.action_path }}
-      shell: bash
-      env:
-        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
-      run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
-    - name: Clean up
-      shell: bash
-      if: always()
-      run: |
-        rm -rf $RUNNER_TEMP/codescanning-config-cli-test
-        rm -rf $RUNNER_TEMP/user-config.yaml

.github/actions/check-codescanning-config/index.ts

@@ -1,49 +0,0 @@
-
-import * as core from '@actions/core'
-import * as yaml from 'js-yaml'
-import * as fs from 'fs'
-import * as assert from 'assert'
-
-const actualConfig = loadActualConfig()
-
-function sortConfigArrays(config) {
-  for (const key of Object.keys(config)) {
-    const value = config[key];
-    if (key === 'queries' && Array.isArray(value)) {
-      config[key] = value.sort();
-    }
-  }
-  return config;
-}
-
-const rawExpectedConfig = process.argv[3].trim()
-if (!rawExpectedConfig) {
-  core.setFailed('No expected configuration provided')
-} else {
-  core.startGroup('Expected generated user config')
-  core.info(yaml.dump(JSON.parse(rawExpectedConfig)))
-  core.endGroup()
-}
-
-const expectedConfig = rawExpectedConfig ? JSON.parse(rawExpectedConfig) : undefined;
-
-assert.deepStrictEqual(
-  sortConfigArrays(actualConfig),
-  sortConfigArrays(expectedConfig),
-  'Expected configuration does not match actual configuration'
-);
-
-
-function loadActualConfig() {
-  if (!fs.existsSync(process.argv[2])) {
-    core.info('No configuration file found')
-    return undefined
-  } else {
-    const rawActualConfig = fs.readFileSync(process.argv[2], 'utf8')
-    core.startGroup('Actual generated user config')
-    core.info(rawActualConfig)
-    core.endGroup()
-
-    return yaml.load(rawActualConfig)
-  }
-}

.github/actions/check-sarif/action.yml

@@ -1,20 +0,0 @@
-name: Check SARIF
-description: Checks a SARIF file to see if certain queries were run and others were not run.
-inputs:
-  sarif-file:
-    required: true
-    description: The SARIF file to check
-
-  queries-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should be included in this SARIF file.
-
-  queries-not-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should NOT be included in this SARIF file.
-
-runs:
-  using: node24
-  main: index.js

.github/actions/check-sarif/index.js

@@ -1,43 +0,0 @@
-'use strict'
-
-const core = require('@actions/core')
-const fs = require('fs')
-
-const sarif = JSON.parse(fs.readFileSync(core.getInput('sarif-file'), 'utf8'))
-const rules = sarif.runs[0].tool.extensions.flatMap(ext => ext.rules || [])
-const ruleIds = rules.map(rule => rule.id)
-
-// Check that all the expected queries ran
-const expectedQueriesRun = getQueryIdsInput('queries-run')
-const queriesThatShouldHaveRunButDidNot = expectedQueriesRun.filter(queryId => !ruleIds.includes(queryId))
-
-if (queriesThatShouldHaveRunButDidNot.length > 0) {
-  core.setFailed(`The following queries were expected to run but did not: ${queriesThatShouldHaveRunButDidNot.join(', ')}`)
-}
-
-// Check that all the unexpected queries did not run
-const expectedQueriesNotRun = getQueryIdsInput('queries-not-run')
-
-const queriesThatShouldNotHaveRunButDid = expectedQueriesNotRun.filter(queryId => ruleIds.includes(queryId))
-
-if (queriesThatShouldNotHaveRunButDid.length > 0) {
-  core.setFailed(`The following queries were NOT expected to have run but did: ${queriesThatShouldNotHaveRunButDid.join(', ')}`)
-}
-
-
-core.startGroup('All queries run')
-rules.forEach(rule => {
-  core.info(`${rule.id}: ${(rule.properties && rule.properties.name) || rule.name}`)
-})
-core.endGroup()
-
-core.startGroup('Full SARIF')
-core.info(JSON.stringify(sarif, null, 2))
-core.endGroup()
-
-function getQueryIdsInput(name) {
-  return core.getInput(name)
-    .split(',')
-    .map(q => q.trim())
-    .filter(q => q.length > 0)
-}

.github/actions/prepare-mergeback-branch/action.yml

@@ -1,104 +0,0 @@
-name: "Prepare mergeback branch"
-description: Prepares a mergeback branch and opens a PR for it
-inputs:
-  base:
-    description: "The name of the base branch"
-    required: true
-  head:
-    description: "The name of the head branch"
-    required: true
-  branch:
-    description: "The name of the branch to create."
-    required: true
-  version:
-    description: "The new version"
-    required: true
-  token:
-    description: "The token to use"
-    required: true
-  dry-run:
-    description: "Set to true to skip creating the PR. The branch will still be pushed."
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Create mergeback branch
-      shell: bash
-      env:
-        VERSION: "${{ inputs.version }}"
-        NEW_BRANCH: "${{ inputs.branch }}"
-      run: |
-        set -exu
-
-        # Ensure we are on the new branch
-        git checkout "${NEW_BRANCH}"
-
-        # Update the version number ready for the next release
-        npm version patch --no-git-tag-version
-
-        # Update the changelog, adding a new version heading directly above the most recent existing one
-        awk '!f && /##/{print "'"## [UNRELEASED]\n\nNo user facing changes.\n"'"; f=1}1' CHANGELOG.md > temp && mv temp CHANGELOG.md
-        git add .
-        git commit -m "Update changelog and version after ${VERSION}"
-
-    # Update the build artifacts with the new version number
-    - name: Rebuild the Action
-      shell: bash
-      run: |
-        set -exu
-        npm ci
-        npm run build
-
-    - name: Check for rebuild changes
-      id: rebuild_changes
-      shell: bash
-      run: |
-        set -exu
-        git add --all
-        if git diff --cached --quiet; then
-          echo "has_changes=false" >> "${GITHUB_OUTPUT}"
-        else
-          echo "has_changes=true" >> "${GITHUB_OUTPUT}"
-        fi
-
-    - name: Commit rebuild
-      if: steps.rebuild_changes.outputs.has_changes == 'true'
-      shell: bash
-      run: |
-        set -exu
-        git commit -m "Rebuild"
-
-    - name: Push mergeback branch
-      shell: bash
-      env:
-        NEW_BRANCH: "${{ inputs.branch }}"
-      run: git push origin "${NEW_BRANCH}"
-
-    - name: Create PR
-      shell: bash
-      if: inputs.dry-run != 'true'
-      env:
-        VERSION: "${{ inputs.version }}"
-        BASE_BRANCH: "${{ inputs.base }}"
-        HEAD_BRANCH: "${{ inputs.head }}"
-        NEW_BRANCH: "${{ inputs.branch }}"
-        GITHUB_TOKEN: "${{ inputs.token }}"
-      run: |
-        set -exu
-        pr_title="Mergeback ${VERSION} ${HEAD_BRANCH} into ${BASE_BRANCH}"
-        pr_body=$(cat << EOF
-          This PR bumps the version number and updates the changelog after the ${VERSION} release.
-
-          Please do the following:
-
-          - [ ] Approve running the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".
-        EOF
-        )
-
-        gh pr create \
-          --head "${NEW_BRANCH}" \
-          --base "${BASE_BRANCH}" \
-          --title "${pr_title}" \
-          --body "${pr_body}" \
-          --assignee "${GITHUB_ACTOR}"

.github/actions/prepare-test/action.yml

@@ -1,79 +0,0 @@
-name: "Prepare test"
-description: Performs some preparation to run tests
-inputs:
-  version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'toolcache', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
-    required: true
-  use-all-platform-bundle:
-    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
-    required: false
-  setup-kotlin:
-    description: "If true, we setup kotlin"
-    default: 'true'
-    required: true
-outputs:
-  tools-url:
-    description: "The value that should be passed as the 'tools' input of the 'init' step."
-    value: ${{ steps.get-url.outputs.tools-url }}
-runs:
-  using: composite
-  steps:
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-        mv ../action/.github/workflows .github
-    - id: get-url
-      name: Determine URL
-      shell: bash
-      env:
-        VERSION: ${{ inputs.version }}
-        USE_ALL_PLATFORM_BUNDLE: ${{ inputs.use-all-platform-bundle }}
-      run: |
-        set -e # Fail this Action if `gh release list` fails.
-
-        if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
-          echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "linked" ]]; then
-          echo "tools-url=linked" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "toolcache" ]]; then
-          echo "tools-url=toolcache" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "default" ]]; then
-          echo "tools-url=" >> "$GITHUB_OUTPUT"
-          exit 0
-        fi
-
-        if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
-          artifact_name="codeql-bundle.tar.gz"
-        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          artifact_name="codeql-bundle-linux64.tar.gz"
-        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          artifact_name="codeql-bundle-osx64.tar.gz"
-        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          artifact_name="codeql-bundle-win64.tar.gz"
-        else
-          echo "::error::Unrecognized OS $RUNNER_OS"
-          exit 1
-        fi
-
-        if [[ "$VERSION" == *"nightly"* ]]; then
-          version=`echo "$VERSION" | sed -e 's/^.*\-//'`
-          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
-        elif [[ "$VERSION" == *"stable"* ]]; then
-          version=`echo "$VERSION" | sed -e 's/^.*\-//'`
-          echo "tools-url=https://github.com/github/codeql-action/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
-        else
-          echo "::error::Unrecognized version specified!"
-          exit 1
-        fi
-
-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
-      if: ${{ inputs.setup-kotlin == 'true' }}
-      with:
-        version: 1.8.21

.github/actions/query-filter-test/action.yml

@@ -1,62 +0,0 @@
-name: Query Filter Test
-description: Runs a test of query filters using the check SARIF action
-inputs:
-  sarif-file:
-    required: true
-    description: The SARIF file to check
-
-  queries-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should be included in this SARIF file.
-
-  queries-not-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should NOT be included in this SARIF file.
-
-  config-file:
-    required: true
-    description: |
-      The location of the codeql configuration file to use.
-
-  tools:
-    required: true
-    description: |
-      The version of CodeQL passed to the `tools` input of the init action.
-      This can be any of the following:
-
-      - A local path to a tarball containing the CodeQL tools, or
-      - A URL to a GitHub release assets containing the CodeQL tools, or
-      - A special value `linked` which is forcing the use of the CodeQL tools
-        that the action has been bundled with.
-
-      If not specified, the Action will check in several places until it finds
-      the CodeQL tools.
-
-runs:
-  using: composite
-  steps:
-    - uses: ./../action/init
-      with:
-        languages: javascript
-        config-file: ${{ inputs.config-file }}
-        tools: ${{ inputs.tools }}
-        db-location: ${{ runner.temp }}/query-filter-test
-      env:
-        CODEQL_ACTION_TEST_MODE: "true"
-    - uses: ./../action/analyze
-      with:
-        output: ${{ runner.temp }}/results
-        upload: never
-      env:
-        CODEQL_ACTION_TEST_MODE: "true"
-    - name: Check SARIF
-      uses: ./../action/.github/actions/check-sarif
-      with:
-        sarif-file:  ${{ inputs.sarif-file }}
-        queries-run: ${{ inputs.queries-run}}
-        queries-not-run: ${{ inputs.queries-not-run}}
-    - name: Cleanup after test
-      shell: bash
-      run: rm -rf "$RUNNER_TEMP/results" "$RUNNER_TEMP/query-filter-test"

.github/actions/release-branches/action.yml

@@ -1,28 +0,0 @@
-name: 'Release branches'
-description: 'Determine branches for release & backport'
-inputs:
-  major_version:
-    description: 'The version as extracted from the package.json file'
-    required: true
-  latest_tag:
-    description: 'The most recent tag published to the repository'
-    required: true
-outputs:
-  backport_source_branch:
-    description: "The release branch for the given tag"
-    value: ${{ steps.branches.outputs.backport_source_branch }}
-  backport_target_branches:
-    description: "JSON encoded list of branches to target with backports"
-    value: ${{ steps.branches.outputs.backport_target_branches }}
-runs:
-  using: "composite"
-  steps:
-    - id: branches
-      env:
-        MAJOR_VERSION: ${{ inputs.major_version }}
-        LATEST_TAG: ${{ inputs.latest_tag }}
-      run: |
-        npx tsx ./pr-checks/release-branches.ts \
-            --major-version "$MAJOR_VERSION" \
-            --latest-tag "$LATEST_TAG"
-      shell: bash

.github/actions/release-initialise/action.yml

@@ -1,32 +0,0 @@
-name: 'Prepare release job'
-description: 'Prepare for updating a release branch'
-
-runs:
-  using: "composite"
-  steps:
-
-    - name: Dump environment
-      run: env
-      shell: bash
-
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: '${{ toJson(github) }}'
-      run: echo "$GITHUB_CONTEXT"
-      shell: bash
-
-    - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 24
-        cache: 'npm'
-
-    - name: Install JavaScript dependencies
-      shell: bash
-      run: npm ci
-
-    - name: Update git config
-      run: |
-        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-        git config --global user.name "github-actions[bot]"
-      shell: bash

.github/actions/update-bundle/action.yml

@@ -1,14 +0,0 @@
-name: Update default CodeQL bundle
-description: Updates 'src/defaults.json' to point to a new CodeQL bundle release.
-
-runs:
-  using: composite
-  steps:
-    - name: Install ts-node
-      shell: bash
-      run: npm install -g ts-node
-
-    - name: Run update script
-      working-directory: ${{ github.action_path }}
-      shell: bash
-      run: ts-node ./index.ts

.github/actions/update-bundle/index.ts

@@ -1,67 +0,0 @@
-import * as fs from 'fs';
-import * as github from '@actions/github';
-
-interface BundleInfo {
-  bundleVersion: string;
-  cliVersion: string;
-}
-
-interface Defaults {
-  bundleVersion: string;
-  cliVersion: string;
-  priorBundleVersion: string;
-  priorCliVersion: string;
-}
-
-function getCodeQLCliVersionForRelease(release): string {
-  // We do not currently tag CodeQL bundles based on the CLI version they contain.
-  // Instead, we use a marker file `cli-version-<version>.txt` to record the CLI version.
-  // This marker file is uploaded as a release asset for all new CodeQL bundles.
-  const cliVersionsFromMarkerFiles = release.assets
-    .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
-    .filter((v) => v)
-    .map((v) => v as string);
-  if (cliVersionsFromMarkerFiles.length > 1) {
-    throw new Error(
-      `Release ${release.tag_name} has multiple CLI version marker files.`
-    );
-  } else if (cliVersionsFromMarkerFiles.length === 0) {
-    throw new Error(
-      `Failed to find the CodeQL CLI version for release ${release.tag_name}.`
-    );
-  }
-  return cliVersionsFromMarkerFiles[0];
-}
-
-async function getBundleInfoFromRelease(release): Promise<BundleInfo> {
-  return {
-    bundleVersion: release.tag_name,
-    cliVersion: getCodeQLCliVersionForRelease(release)
-  };
-}
-
-async function getNewDefaults(currentDefaults: Defaults): Promise<Defaults> {
-  const release = github.context.payload.release;
-  console.log('Updating default bundle as a result of the following release: ' +
-    `${JSON.stringify(release)}.`)
-
-  const bundleInfo = await getBundleInfoFromRelease(release);
-  return {
-    bundleVersion: bundleInfo.bundleVersion,
-    cliVersion: bundleInfo.cliVersion,
-    priorBundleVersion: currentDefaults.bundleVersion,
-    priorCliVersion: currentDefaults.cliVersion
-  };
-}
-
-async function main() {
-  const previousDefaults: Defaults = JSON.parse(fs.readFileSync('../../../src/defaults.json', 'utf8'));
-  const newDefaults = await getNewDefaults(previousDefaults);
-  // Update the source file in the repository. Calling workflows should subsequently rebuild
-  // the Action to update `lib/defaults.json`.
-  fs.writeFileSync('../../../src/defaults.json', JSON.stringify(newDefaults, null, 2) + "\n");
-}
-
-// Ideally, we'd await main() here, but that doesn't work well with `ts-node`.
-// So instead we rely on the fact that Node won't exit until the event loop is empty.
-main();

.github/actions/verify-debug-artifact-scan-completed/action.yml

@@ -1,6 +0,0 @@
-name: Verify that the best-effort debug artifact scan completed
-description: Verifies that the best-effort debug artifact scan completed successfully during tests
-runs:
-  using: node24
-  main: index.js
-  post: post.js

.github/actions/verify-debug-artifact-scan-completed/index.js

@@ -1,2 +0,0 @@
-// The main step is a no-op, since we can only verify artifact scan completion in the post step.
-console.log("Will verify artifact scan completion in the post step.");

.github/actions/verify-debug-artifact-scan-completed/post.js

@@ -1,11 +0,0 @@
-// Post step - runs after the workflow completes, when artifact scan has finished
-const process = require("process");
-
-const scanFinished = process.env.CODEQL_ACTION_ARTIFACT_SCAN_FINISHED;
-
-if (scanFinished !== "true") {
-  console.error("Error: Best-effort artifact scan did not complete. Expected CODEQL_ACTION_ARTIFACT_SCAN_FINISHED=true");
-  process.exit(1);
-}
-
-console.log("✓ Best-effort artifact scan completed successfully");

.github/codeql/codeql-config-javascript.yml

@@ -1,17 +0,0 @@
-name: "CodeQL config"
-queries:
-  - name: Run custom queries
-    uses: ./queries
-  # Run all extra query suites, both because we want to
-  # and because it'll act as extra testing. This is why
-  # we include both even though one is a superset of the
-  # other, because we're testing the parsing logic and
-  # that the suites exist in the codeql bundle.
-  - uses: security-and-quality
-  - uses: security-experimental
-  - uses: security-extended
-paths-ignore:
-  - lib
-  - tests
-  - "**/*.test.ts"
-  - "**/testing-util.ts"

.github/codeql/codeql-config.yml

@@ -0,0 +1,14 @@
+name: "CodeQL config"
+queries: 
+  - name: Run custom queries
+    uses: ./queries
+  # Run all extra query suites, both because we want to
+  # and because it'll act as extra testing. This is why
+  # we include both even though one is a superset of the
+  # other, because we're testing the parsing logic and
+  # that the suites exist in the codeql bundle.
+  - uses: security-extended
+  - uses: security-and-quality
+paths-ignore:
+  - tests
+  - lib

.github/copilot-instructions.md

@@ -1,40 +0,0 @@
-# CodeQL Action - Copilot Instructions
-
-The CodeQL Action is used in GitHub Actions workflows to run CodeQL scans using the CodeQL CLI.
-
-## Overview
-
-- The repository contains two TypeScript projects.
-- The main TypeScript codebase is in the `src` directory, with accompanying unit tests in `.test.ts` files in the same directory.
-- The main codebase is compiled to bundled JavaScript code, which is also contained in the repository in the `lib` directory.
-- A secondary TypeScript codebase with scripts that are only used for development purposes or by CI is in the `pr-checks` directory. This codebase is not compiled to bundled JavaScript. It is executed directly with `tsx`, which handles compilation internally.
-
-## Review instructions
-
-- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Word your comments constructively as suggestions for improvements. Do not word suggestions as commands.
-- If you want to comment on a change that you believe will fail a CI check, do not present the CI failure you expect as a fact. Instead, write that you think a change "may" lead to a failure in CI. Suggest that, if such a failure manifests, the changes you are commenting on may be the place responsible for the failure and are worth looking at.
-- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one.
-- If a change is a net improvement, for example because it improves on an existing limitation of existing code, do not complain about pre-existing problems that remain. You may comment on them, but you should make it clear that the thing you are commenting on is not new by writing e.g. "Not new in this PR, but [..]" followed by your description of the issue and a suggestion that it could be improved at the same time with e.g. "Consider whether this is worth addressing as part of this PR as well."
-
-## Generated code
-
-The main codebase of the CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from. The secondary TypeScript codebase has sources in the `pr-checks` directory, which are executed directly with `tsx` and not compiled to JavaScript in the `lib` folder.
-
-GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that start with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.
-
-## Release process
-
-Changes that are merged to the `main` branch are not used in production straight away. Instead, changes from `main` must first be released using the release process, which has to be manually triggered by a staff member. Therefore, it is possible for further changes to be made to the code after some changes have been merged to `main` but before they are released. Once the release process automation is started, a series of PRs are automatically generated:
-
-- A release-PR is a PR which matches all of the following patterns:
-
-  - PR title starts with the exact prefix: `Merge main into releases/v`
-    - Equivalent regex: `^Merge main into releases\/v`
-  - AND head (source) branch matches the update-branch pattern:
-    - Regex: `^update-v[0-9]+(?:\.[0-9]+)*(?:-[a-f0-9]+)?` (e.g. `update-v3.29.9-cc722e476`)
-  - AND base (target) branch matches a release branch:
-    - Regex: `^releases\/v` (e.g. `releases/v3`)
-
-- Consider all files in release-PRs to have already been reviewed and do not review them, except for the following two files:
-  - `CHANGELOG.md`
-  - `package.json`

.github/dependabot.yml

@@ -1,42 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directories:
-      - "/"
-      - "/pr-checks"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    labels:
-      - Rebuild
-    # Ignore incompatible dependency updates
-    ignore:
-      # This is broken due to the way configuration files have changed.
-      # This might be fixed when we move to eslint v9.
-      - dependency-name: "eslint-plugin-import"
-        versions: [">=2.30.0"]
-    groups:
-      npm-minor:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-  - package-ecosystem: github-actions
-    directories:
-      - "/.github/workflows"
-      - "/.github/actions"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    labels:
-      - Rebuild
-    groups:
-      actions-minor:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"

.github/instructions/release-merge.instructions.md

@@ -1,16 +0,0 @@
----
-applyTo: "CHANGELOG.md,src/defaults.json,lib/defaults.json,src/api-compatibility.json"
----
-
-# Merging release, mergeback, and backport PRs
-
-The release process creates a cascade of PRs (`main` → `releases/vN`, then
-`releases/vN` → `main` mergeback, then `releases/vN` → `releases/v(N-1)`
-backport). These PRs reliably touch `CHANGELOG.md`, `src/defaults.json` /
-`lib/defaults.json` (bundle/CLI version bump), and `src/api-compatibility.json`.
-
-Such PRs **must be merged with a merge commit**. Never squash or rebase, as
-that breaks the branch linkage the release automation relies on.
-
-When arming auto-merge on these PRs, use `--merge` (e.g. `gh pr merge --merge`),
-not `--squash` or `--rebase`.

.github/pull_request_template.md

@@ -1,82 +1,4 @@
-<!--
-    For GitHub staff: Remember that this is a public repository. Do not link to internal resources.
-                      If necessary, link to this PR from an internal issue and include further details there.
-
-    Everyone: Include a summary of the context of this change, what it aims to accomplish, and why you
-              chose the approach you did if applicable. Indicate any open questions you want to answer
-              during the review process and anything you want reviewers to pay particular attention to.
-
-    See https://github.com/github/codeql-action/blob/main/CONTRIBUTING.md for additional information.
--->
-
-### Risk assessment
-
-For internal use only. Please select the risk level of this change:
-
-- **Low risk:** Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
-- **High risk:** Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.
-
-#### Which use cases does this change impact?
-
-<!-- Delete options that don't apply. If in doubt, do not delete an option. -->
-
-Workflow types:
-
-- **Advanced setup** - Impacts users who have custom CodeQL workflows.
-- **Managed** - Impacts users with `dynamic` workflows (Default Setup, Code Quality, ...).
-
-Products:
-
-- **Code Scanning** - The changes impact analyses when `analysis-kinds: code-scanning`.
-- **Code Quality** - The changes impact analyses when `analysis-kinds: code-quality`.
-- **Other first-party** - The changes impact other first-party analyses.
-- **Third-party analyses** - The changes affect the `upload-sarif` action.
-
-Environments:
-
-- **Dotcom** - Impacts CodeQL workflows on `github.com` and/or GitHub Enterprise Cloud with Data Residency.
-- **GHES** - Impacts CodeQL workflows on GitHub Enterprise Server.
-- **Testing/None** - This change does not impact any CodeQL workflows in production.
-
-#### How did/will you validate this change?
-
-<!-- Delete options that don't apply. -->
-
-- **Test repository** - This change will be tested on a test repository before merging.
-- **Unit tests** - I am depending on unit test coverage (i.e. tests in `.test.ts` files).
-- **End-to-end tests** - I am depending on PR checks (i.e. tests in `pr-checks`).
-- **Other** - Please provide details.
-- **None** - I am not validating these changes.
-
-#### If something goes wrong after this change is released, what are the mitigation and rollback strategies?
-
-<!-- Delete strategies that don't apply. -->
-
-- **Feature flags** - All new or changed code paths can be fully disabled with corresponding feature flags.
-- **Rollback** - Change can only be disabled by rolling back the release or releasing a new version with a fix.
-- **Development/testing only** - This change cannot cause any failures in production.
-- **Other** - Please provide details.
-
-#### How will you know if something goes wrong after this change is released?
-
-<!-- Delete options that don't apply. -->
-
-- **Telemetry** - I rely on existing telemetry or have made changes to the telemetry.
-    - **Dashboards** - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
-    - **Alerts** - New or existing monitors will trip if something goes wrong with this change.
-- **Other** - Please provide details.
-
-#### Are there any special considerations for merging or releasing this change?
-
-<!--
-    Consider whether this change depends on a different change in another repository that should be released first.
--->
-
-- **No special considerations** - This change can be merged at any time.
-- **Special considerations** - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.
-
 ### Merge / deployment checklist
 
-- Confirm this change is backwards compatible with existing workflows.
-- Consider adding a [changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) entry for this change.
-- Confirm the [readme](https://github.com/github/codeql-action/blob/main/README.md) and docs have been updated if necessary.
+- [ ] Confirm this change is backwards compatible with existing workflows.
+- [ ] Confirm the [readme](https://github.com/github/codeql-action/blob/master/README.md) has been updated if necessary.

.github/sizeup.yml

@@ -1,55 +0,0 @@
-labeling:
-  applyCategoryLabels: true
-  categoryLabelPrefix: "size/"
-
-commenting:
-  addCommentWhenScoreThresholdHasBeenExceeded: false
-
-sizeup:
-  categories:
-    - name: extra small
-      lte: 25
-      label:
-        name: XS
-        description: Should be very easy to review
-        color: 3cbf00
-    - name: small
-      lte: 100
-      label:
-        name: S
-        description: Should be easy to review
-        color: 5d9801
-    - name: medium
-      lte: 250
-      label:
-        name: M
-        description: Should be of average difficulty to review
-        color: 7f7203
-    - name: large
-      lte: 500
-      label:
-        name: L
-        description: May be hard to review
-        color: a14c05
-    - name: extra large
-      lte: 1000
-      label:
-        name: XL
-        description: May be very hard to review
-        color: c32607
-    - name: extra extra large
-      label:
-        name: XXL
-        description: May be extremely hard to review
-        color: e50009
-  ignoredFilePatterns:
-    - ".github/workflows/__*"
-    - "lib/**/*"
-    - "package-lock.json"
-  testFilePatterns:
-    - "**/*.test.ts"
-  scoring:
-    # This formula and the aliases below it are written in prefix notation.
-    # For an explanation of how this works, please see:
-    # https://github.com/lerebear/sizeup-core/blob/main/README.md#prefix-notation
-    formula: "- - + additions deletions comments whitespace"

.github/update-release-branch.py

@@ -0,0 +1,178 @@
+import datetime
+from github import Github
+import random
+import requests
+import subprocess
+import sys
+
+# The branch being merged from.
+# This is the one that contains day-to-day development work.
+MAIN_BRANCH = 'main'
+# The branch being merged into.
+# This is the release branch that users reference.
+LATEST_RELEASE_BRANCH = 'v1'
+# Name of the remote
+ORIGIN = 'origin'
+
+# Runs git with the given args and returns the stdout.
+# Raises an error if git does not exit successfully.
+def run_git(*args):
+  cmd = ['git', *args]
+  p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+  if (p.returncode != 0):
+    raise Exception('Call to ' + ' '.join(cmd) + ' exited with code ' + str(p.returncode) + ' stderr:' + p.stderr.decode('ascii'))
+  return p.stdout.decode('ascii')
+
+# Returns true if the given branch exists on the origin remote
+def branch_exists_on_remote(branch_name):
+  return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
+
+# Opens a PR from the given branch to the release branch
+def open_pr(repo, all_commits, short_main_sha, branch_name):
+  # Sort the commits into the pull requests that introduced them,
+  # and any commits that don't have a pull request
+  pull_requests = []
+  commits_without_pull_requests = []
+  for commit in all_commits:
+    pr = get_pr_for_commit(repo, commit)
+    
+    if pr is None:
+      commits_without_pull_requests.append(commit)
+    elif not any(p for p in pull_requests if p.number == pr.number):
+      pull_requests.append(pr)
+
+  print('Found ' + str(len(pull_requests)) + ' pull requests')
+  print('Found ' + str(len(commits_without_pull_requests)) + ' commits not in a pull request')
+
+  # Sort PRs and commits by age
+  pull_requests = sorted(pull_requests, key=lambda pr: pr.number)
+  commits_without_pull_requests = sorted(commits_without_pull_requests, key=lambda c: c.commit.author.date)
+  
+  # Start constructing the body text
+  body = 'Merging ' + short_main_sha + ' into ' + LATEST_RELEASE_BRANCH
+
+  conductor = get_conductor(repo, pull_requests, commits_without_pull_requests)
+  body += '\n\nConductor for this PR is @' + conductor
+
+  # List all PRs merged
+  if len(pull_requests) > 0:
+    body += '\n\nContains the following pull requests:'
+    for pr in pull_requests:
+      merger = get_merger_of_pr(repo, pr)
+      body += '\n- #' + str(pr.number)
+      body += ' - ' + pr.title
+      body += ' (@' + merger + ')'
+  
+  # List all commits not part of a PR
+  if len(commits_without_pull_requests) > 0:
+    body += '\n\nContains the following commits not from a pull request:'
+    for commit in commits_without_pull_requests:
+      body += '\n- ' + commit.sha
+      body += ' - ' + get_truncated_commit_message(commit)
+      body += ' (@' + commit.author.login + ')'
+
+  title = 'Merge ' + MAIN_BRANCH + ' into ' + LATEST_RELEASE_BRANCH
+
+  # Create the pull request
+  pr = repo.create_pull(title=title, body=body, head=branch_name, base=LATEST_RELEASE_BRANCH)
+  print('Created PR #' + str(pr.number))
+
+  # Assign the conductor
+  pr.add_to_assignees(conductor)
+  print('Assigned PR to ' + conductor)
+
+# Gets the person who should be in charge of the mergeback PR
+def get_conductor(repo, pull_requests, other_commits):
+  # If there are any PRs then use whoever merged the last one
+  if len(pull_requests) > 0:
+    return get_merger_of_pr(repo, pull_requests[-1])
+  
+  # Otherwise take the author of the latest commit
+  return other_commits[-1].author.login
+
+# Gets a list of the SHAs of all commits that have happened on main
+# since the release branched off.
+# This will not include any commits that exist on the release branch
+# that aren't on main.
+def get_commit_difference(repo):
+  commits = run_git('log', '--pretty=format:%H', ORIGIN + '/' + LATEST_RELEASE_BRANCH + '...' + MAIN_BRANCH).strip().split('\n')
+
+  # Convert to full-fledged commit objects
+  commits = [repo.get_commit(c) for c in commits]
+
+  # Filter out merge commits for PRs
+  return list(filter(lambda c: not is_pr_merge_commit(c), commits))
+
+# Is the given commit the automatic merge commit from when merging a PR
+def is_pr_merge_commit(commit):
+  return commit.committer.login == 'web-flow' and len(commit.parents) > 1
+
+# Gets a copy of the commit message that should display nicely
+def get_truncated_commit_message(commit):
+  message = commit.commit.message.split('\n')[0]
+  if len(message) > 60:
+    return message[:57] + '...'
+  else:
+    return message
+
+# Converts a commit into the PR that introduced it to the main branch.
+# Returns the PR object, or None if no PR could be found.
+def get_pr_for_commit(repo, commit):
+  prs = commit.get_pulls()
+  
+  if prs.totalCount > 0:
+    # In the case that there are multiple PRs, return the earliest one
+    prs = list(prs)
+    sorted(prs, key=lambda pr: int(pr.number))
+    return prs[0]
+  else:
+    return None
+
+# Get the person who merged the pull request.
+# For most cases this will be the same as the author, but for PRs opened
+# by external contributors getting the merger will get us the GitHub
+# employee who reviewed and merged the PR.
+def get_merger_of_pr(repo, pr):
+  return repo.get_commit(pr.merge_commit_sha).author.login
+
+def main():
+  if len(sys.argv) != 3:
+    raise Exception('Usage: update-release.branch.py <github token> <repository nwo>')
+  github_token = sys.argv[1]
+  repository_nwo = sys.argv[2]
+
+  repo = Github(github_token).get_repo(repository_nwo)
+
+  # Print what we intend to go
+  print('Considering difference between ' + MAIN_BRANCH + ' and ' + LATEST_RELEASE_BRANCH)
+  short_main_sha = run_git('rev-parse', '--short', MAIN_BRANCH).strip()
+  print('Current head of ' + MAIN_BRANCH + ' is ' + short_main_sha)
+
+  # See if there are any commits to merge in
+  commits = get_commit_difference(repo)
+  if len(commits) == 0:
+    print('No commits to merge from ' + MAIN_BRANCH + ' to ' + LATEST_RELEASE_BRANCH)
+    return
+
+  # The branch name is based off of the name of branch being merged into
+  # and the SHA of the branch being merged from. Thus if the branch already
+  # exists we can assume we don't need to recreate it.
+  new_branch_name = 'update-' + LATEST_RELEASE_BRANCH + '-' + short_main_sha
+  print('Branch name is ' + new_branch_name)
+
+  # Check if the branch already exists. If so we can abort as this script
+  # has already run on this combination of branches.
+  if branch_exists_on_remote(new_branch_name):
+    print('Branch ' + new_branch_name + ' already exists. Nothing to do.')
+    return
+  
+  # Create the new branch and push it to the remote
+  print('Creating branch ' + new_branch_name)
+  run_git('checkout', '-b', new_branch_name, MAIN_BRANCH)
+  run_git('push', ORIGIN, new_branch_name)
+
+  # Open a PR to update the branch
+  open_pr(repo, commits, short_main_sha, new_branch_name)
+
+if __name__ == '__main__':
+  main()

.github/workflows/__go.yml

@@ -1,80 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: Manual Check - go
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  workflow_dispatch:
-    inputs:
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-jobs:
-  go-custom-queries:
-    name: 'Go: Custom queries'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-custom-queries.yml
-    with:
-      dotnet-version: ${{ inputs.dotnet-version }}
-      go-version: ${{ inputs.go-version }}
-  go-indirect-tracing-workaround-diagnostic:
-    name: 'Go: diagnostic when Go is changed after init step'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-indirect-tracing-workaround-no-file-program:
-    name: 'Go: diagnostic when `file` is not installed'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-indirect-tracing-workaround:
-    name: 'Go: workaround for indirect tracing'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-tracing-autobuilder:
-    name: 'Go: tracing with autobuilder step'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-tracing-autobuilder.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-tracing-custom-build-steps:
-    name: 'Go: tracing with custom build steps'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-tracing-legacy-workflow:
-    name: 'Go: tracing with legacy workflow'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
-    with:
-      go-version: ${{ inputs.go-version }}

.github/workflows/check-expected-release-files.yml

@@ -1,33 +0,0 @@
-name: Check Expected Release Files
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/check-expected-release-files.yml
-      - src/defaults.json
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check-expected-release-files:
-    runs-on: ubuntu-slim
-
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout CodeQL Action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Check Expected Release Files
-        run: |
-          bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")"
-          set -x
-          for expected_file in "codeql-bundle.tar.gz" "codeql-bundle-linux64.tar.gz" "codeql-bundle-osx64.tar.gz" "codeql-bundle-win64.tar.gz"; do
-            curl --location --fail --head --request GET "https://github.com/github/codeql-action/releases/download/$bundle_version/$expected_file" > /dev/null
-          done

.github/workflows/codeql.yml

@@ -2,138 +2,30 @@ name: "CodeQL action"
 
 on:
   push:
-    branches: [main, releases/v*]
+    branches: [main, v1]
   pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    # Weekly on Sunday.
-    - cron: '30 1 * * 0'
-  workflow_dispatch:
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
-  # Identify the CodeQL tool versions to use in the analysis job.
-  check-codeql-versions:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    outputs:
-      versions: ${{ steps.compare.outputs.versions }}
-
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up default CodeQL bundle
-      id: setup-default
-      uses: ./setup-codeql
-    - name: Set up linked CodeQL bundle
-      id: setup-linked
-      uses: ./setup-codeql
-      with:
-        tools: linked
-    - name: Compare default and linked CodeQL bundle versions
-      id: compare
-      env:
-        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-      run: |
-        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
-
-        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-        # required status check.
-        #
-        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-        # the same as running with `tools: null`.
-        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-          VERSIONS_JSON='[null]'
-        else
-          VERSIONS_JSON='[null, "linked"]'
-        fi
-
-        # Output a JSON-encoded list with the distinct versions to test against.
-        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
-
-  analyze-javascript:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: [check-codeql-versions]
+  build:
     strategy:
-      fail-fast: false
       matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
-        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
+        os: [ubuntu-latest,windows-latest,macos-latest]
     runs-on: ${{ matrix.os }}
 
-    permissions:
-      contents: read
-      security-events: write
-
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      id: init
+    - uses: actions/checkout@v2
+      with:
+        # Must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head of the pull request.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    - uses: ./init
       with:
         languages: javascript
-        config-file: ./.github/codeql/codeql-config-javascript.yml
-        tools: ${{ matrix.tools }}
-    # confirm steps.init.outputs.codeql-path points to the codeql binary
-    - name: Print CodeQL Version
-      run: >
-        "$CODEQL" version --format=json
-      env:
-        CODEQL: ${{steps.init.outputs.codeql-path}}
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
-
-  analyze-other:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: none
-        config: >
-          paths-ignore:
-            - lib
-            - tests
-          queries:
-            - uses: security-and-quality
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:${{ matrix.language }}"
-        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+        config-file: ./.github/codeql/codeql-config.yml
+    - uses: ./analyze

.github/workflows/codescanning-config-cli.yml

@@ -1,227 +0,0 @@
-# Tests that the generated code scanning config file contains the expected contents
-
-name: Code-Scanning config CLI tests
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  # Diff informed queries add an additional query filter which is not yet
-  # taken into account by these tests.
-  CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
-
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  code-scanning-config-tests:
-    if: github.triggering_actor != 'dependabot[bot]'
-    continue-on-error: true
-
-    permissions:
-      contents: read
-      packages: read
-      security-events: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - os: ubuntu-latest
-          version: linked
-        - os: ubuntu-latest
-          version: default
-        - os: ubuntu-latest
-          version: nightly-latest
-
-    # Code-Scanning config not created because environment variable is not set
-    name: Code Scanning Configuration tests
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Set up Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: 24
-        cache: 'npm'
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-
-    - name: Empty file
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: "{}"
-        # Request multiple languages so later checks can reuse the combined bundle.
-        languages: javascript,python
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-            }
-          }
-        languages: javascript
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config overriden by input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql/javascript-queries"]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config merging with input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Multi-language packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-              "ruby": ["codeql/ruby-queries"]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript,ruby
-        config-file-test: .github/codeql/multi-language-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Other config properties
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "name": "Config using all properties",
-            "packs": ["codeql/javascript-queries" ],
-            "disable-default-queries": true,
-            "paths-ignore": ["xxx"],
-            "paths": ["yyy"]
-          }
-        languages: javascript
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/other-config-properties.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/debug-artifacts-failure-safe.yml

@@ -1,117 +0,0 @@
-# Checks logs, SARIF, and database bundle debug artifacts exist
-# when the analyze step fails.
-name: PR Check - Debug artifacts after failure
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  upload-artifacts:
-    if: github.triggering_actor != 'dependabot[bot]'
-    strategy:
-      fail-fast: false
-      matrix:
-        version:
-        - stable-v2.20.3
-        - default
-        - linked
-        - nightly-latest
-    name: Upload debug artifacts after failure in analyze
-    continue-on-error: true
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dump GitHub event
-        run: cat "${GITHUB_EVENT_PATH}"
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: ^1.13.1
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '9.x'
-      - name: Assert best-effort artifact scan completed
-        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
-      - uses: ./../action/init
-        with:
-          languages: cpp,csharp,go,java,javascript,python
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          debug: true
-          debug-artifact-name: my-debug-artifacts
-          debug-database-name: my-db
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
-        id: analysis
-        env:
-          # Forces a failure in this step.
-          CODEQL_ACTION_EXTRA_OPTIONS: '{ "database": { "finalize": ["--invalid-option"] } }'
-        with:
-          expect-error: true
-  download-and-check-artifacts:
-    name: Download and check debug artifacts after failure in analyze
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: upload-artifacts
-    timeout-minutes: 45
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      - name: Check expected artifacts exist
-        run: |
-          LANGUAGES="cpp csharp go java javascript python"
-          for version in $VERSIONS; do
-            echo "Artifacts from version $version:"
-            pushd "./my-debug-artifacts-${version//./}"
-            for language in $LANGUAGES; do
-              echo "- Checking $language"
-              if [[ ! -f "my-db-$language-partial.zip" ]] ; then
-                echo "Missing a partial database bundle for $language"
-                exit 1
-              fi
-              if [[ ! -d "log" ]] ; then
-                echo "Missing database initialization logs"
-                exit 1
-              fi
-              if [[ ! "$language" == "go" ]] && [[ ! -d "$language/log" ]] ; then
-                echo "Missing logs for $language"
-                exit 1
-              fi
-            done
-            popd
-          done
-        env:
-          GO111MODULE: auto

.github/workflows/debug-artifacts-safe.yml

@@ -1,111 +0,0 @@
-# Checks logs, SARIF, and database bundle debug artifacts exist.
-name: PR Check - Debug artifact upload
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  upload-artifacts:
-    if: github.triggering_actor != 'dependabot[bot]'
-    strategy:
-      fail-fast: false
-      matrix:
-        version:
-        - stable-v2.20.3
-        - default
-        - linked
-        - nightly-latest
-    name: Upload debug artifacts
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: ^1.13.1
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '9.x'
-      - name: Assert best-effort artifact scan completed
-        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
-      - uses: ./../action/init
-        id: init
-        with:
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          debug: true
-          debug-artifact-name: my-debug-artifacts
-          debug-database-name: my-db
-          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-          languages: cpp,csharp,go,java,javascript,python,ruby
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
-        id: analysis
-  download-and-check-artifacts:
-    name: Download and check debug artifacts
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: upload-artifacts
-    timeout-minutes: 45
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      - name: Check expected artifacts exist
-        run: |
-          VERSIONS="stable-v2.20.3 default linked nightly-latest"
-          LANGUAGES="cpp csharp go java javascript python"
-          for version in $VERSIONS; do
-            pushd "./my-debug-artifacts-${version//./}"
-            echo "Artifacts from version $version:"
-            for language in $LANGUAGES; do
-              echo "- Checking $language"
-              if [[ ! -f "$language.sarif" ]] ; then
-                echo "Missing a SARIF file for $language"
-                exit 1
-              fi
-              if [[ ! -f "my-db-$language.zip" ]] ; then
-                echo "Missing a database bundle for $language"
-                exit 1
-              fi
-              if [[ ! -d "$language/log" ]] ; then
-                echo "Missing logs for $language"
-                exit 1
-              fi
-            done
-            popd
-          done
-        env:
-          GO111MODULE: auto

.github/workflows/deflake.yml

@@ -1,106 +0,0 @@
-# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
-# already passed CI before being merged. Therefore if they fail, we should make sure that there
-# wasn't a transient failure by rerunning the failed jobs once before investigating further.
-name: Deflake
-
-on:
-  workflow_run:
-    types: [completed]
-    # Exclude workflows that have significant side effects, like publishing releases. It's OK to
-    # retry CodeQL analysis.
-    workflows:
-      - Check Expected Release Files
-      - Code-Scanning config CLI tests
-      - CodeQL action
-      - Manual Check - go
-      - "PR Check - All-platform bundle"
-      - "PR Check - Analysis kinds"
-      - "PR Check - Analyze: 'ref' and 'sha' from inputs"
-      - "PR Check - autobuild-action"
-      - "PR Check - Autobuild direct tracing (custom working directory)"
-      - "PR Check - Autobuild working directory"
-      - "PR Check - Build mode autobuild"
-      - "PR Check - Build mode manual"
-      - "PR Check - Build mode none"
-      - "PR Check - Build mode rollback"
-      - "PR Check - Bundle: Caching checks"
-      - "PR Check - Bundle: From nightly"
-      - "PR Check - Bundle: From toolcache"
-      - "PR Check - Bundle: Zstandard checks"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
-      - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
-      - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
-      - "PR Check - Config export"
-      - "PR Check - Config input"
-      - "PR Check - Custom source root"
-      - "PR Check - Debug artifact upload"
-      - "PR Check - Debug artifacts after failure"
-      - "PR Check - Diagnostic export"
-      - "PR Check - Export file baseline information"
-      - "PR Check - Extractor ram and threads options test"
-      - "PR Check - Go: Custom queries"
-      - "PR Check - Go: diagnostic when Go is changed after init step"
-      - "PR Check - Go: diagnostic when `file` is not installed"
-      - "PR Check - Go: tracing with autobuilder step"
-      - "PR Check - Go: tracing with custom build steps"
-      - "PR Check - Go: tracing with legacy workflow"
-      - "PR Check - Go: workaround for indirect tracing"
-      - "PR Check - Job run UUID added to SARIF"
-      - "PR Check - Language aliases"
-      - "PR Check - Local CodeQL bundle"
-      - "PR Check - Multi-language repository"
-      - "PR Check - Overlay database init fallback"
-      - "PR Check - Packaging: Action input"
-      - "PR Check - Packaging: Config and input"
-      - "PR Check - Packaging: Config and input passed to the CLI"
-      - "PR Check - Packaging: Config file"
-      - "PR Check - Packaging: Download using registries"
-      - "PR Check - Proxy test"
-      - "PR Check - Remote config file"
-      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
-      - "PR Check - Ruby analysis"
-      - "PR Check - Rust analysis"
-      - "PR Check - Split workflow"
-      - "PR Check - Start proxy"
-      - "PR Check - Submit SARIF after failure"
-      - "PR Check - Swift analysis using a custom build command"
-      - "PR Check - Swift analysis using autobuild"
-      - "PR Check - Test different uses of `upload-sarif`"
-      - "PR Check - Test unsetting environment variables"
-      - "PR Check - Upload-sarif: ref and sha from inputs"
-      - "PR Check - Use a custom `checkout_path`"
-      - PR Checks
-      - Query filters tests
-      - Test that the workaround for python 3.12 on windows works
-
-jobs:
-  rerun-on-failure:
-    name: Rerun failed jobs
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      github.event.workflow_run.run_attempt == 1 &&
-      (
-        github.event.workflow_run.head_branch == 'main' ||
-        startsWith(github.event.workflow_run.head_branch, 'releases/') ||
-        github.event.workflow_run.event == 'merge_group'
-      )
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NAME: ${{ github.event.workflow_run.name }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          echo "Rerunning failed jobs for workflow run ${RUN_ID}"
-          gh run rerun "${RUN_ID}" --failed
-          echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/integration-testing.yml

@@ -0,0 +1,491 @@
+name: "Integration Testing"
+
+on:
+  push:
+    branches: [main, v1]
+  pull_request:
+
+jobs:
+  multi-language-repo_test-autodetect-languages:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+    - uses: ./../action/init
+    - name: Build code
+      shell: bash
+      run: ./build.sh
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+    - run: |
+        cd "$RUNNER_TEMP/codeql_databases"
+        # List all directories as there will be precisely one directory per database
+        # but there may be other files in this directory such as query suites.
+        if [ "$(ls -d */ | wc -l)" != 6 ] || \
+           [[ ! -d cpp ]] || \
+           [[ ! -d csharp ]] || \
+           [[ ! -d go ]] || \
+           [[ ! -d java ]] || \
+           [[ ! -d javascript ]] || \
+           [[ ! -d python ]]; then
+          echo "Did not find expected number of databases. Database dir contains: $(ls)"
+          exit 1
+        fi
+
+  multi-language-repo_test-custom-queries-and-remote-config:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+    - uses: ./../action/init
+      with:
+        languages: cpp,csharp,java,javascript,python
+        config-file: github/codeql-action/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
+    - name: Build code
+      shell: bash
+      run: ./build.sh
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  # Currently is not possible to analyze Go in conjunction with other languages in macos
+  multi-language-repo_test-go-custom-queries:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/setup-go@v2
+      if: ${{ matrix.os ==  'macos-latest' }}
+      with:
+        go-version: '^1.13.1'
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+    - uses: ./../action/init
+      with:
+        languages: go
+        config-file: ./.github/codeql/custom-queries.yml
+    - name: Build code
+      shell: bash
+      run: ./build.sh
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  multi-language-repo_rubocop:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 2.6
+    - name: Install Code Scanning integration
+      run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+    - name: Install dependencies
+      run: bundle install
+    - name: Rubocop run
+      run: |
+        bash -c "
+          bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+          [[ $? -ne 2 ]]
+        "
+    - uses: ./../action/upload-sarif
+      with:
+        sarif_file: rubocop.sarif
+      env:
+        TEST_MODE: true
+
+  single-language-bundles:
+    # These are 21 jobs, run them only if the earlier multi-language job suceeded
+    # needs: multi-language-repo_test-autodetect-languages
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        language: ["none", "cpp", "csharp", "go", "java", "javascript", "python"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Move codeql-action
+        shell: bash
+        run: |
+            mkdir ../action
+            mv * .github ../action/
+            mv ../action/tests/multi-language-repo/{*,.github} .
+
+      # The next 2 steps are mutually exclusive.
+      # In one case, we setup codeql for a single language.
+      # In the other, we setup codeql for a platform
+      - name: Test language-specific bundle
+        uses: ./../action/init
+        if: matrix.language != 'none'
+        with:
+          languages: ${{ matrix.language }}
+      - name: Test platform-secific bundle
+        uses: ./../action/init
+        if: matrix.language == 'none'
+
+      - name: Build code
+        shell: bash
+        run: ./build.sh
+      - uses: ./../action/analyze
+        env:
+          TEST_MODE: true
+
+      - name: Check ToolCache (language-specific bundle)
+        if: matrix.language != 'none'
+        shell: bash
+        run: test -n "$(find  -maxdepth 1 -name "codeql-bundle-0.0.0-*.${OS}-${{matrix.language}}" -print -quit)"
+
+  test-proxy:
+    runs-on: ubuntu-latest
+    container:
+      image: ubuntu:18.04
+      options: --dns 127.0.0.1
+    services:
+      squid-proxy:
+        image: datadog/squid:latest
+        ports:
+          - 3128:3128
+    env:
+      https_proxy: http://squid-proxy:3128
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+    - uses: ./../action/init
+      with:
+        languages: javascript
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  runner-analyze-javascript-ubuntu:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        # Pass --config-file here, but not for other jobs in this workflow.
+        # This means we're testing the config file parsing in the runner
+        # but not slowing down all jobs unnecessarily as it doesn't add much
+        # testing the parsing on different operating systems and languages.
+        runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Run analyze
+      run: |
+        runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-javascript-windows:
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages javascript --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Run analyze
+      run: |
+        runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-javascript-macos:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Run analyze
+      run: |
+        runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-ubuntu:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      run: |
+        . ./codeql-runner/codeql-env.sh
+        dotnet build
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-windows:
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: powershell
+      run: |
+        cat ./codeql-runner/codeql-env.sh | Invoke-Expression
+        dotnet build
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-macos:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: bash
+      run: |
+        . ./codeql-runner/codeql-env.sh
+        dotnet build
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+
+  runner-analyze-csharp-autobuild-ubuntu:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      run: |
+        ../action/runner/dist/codeql-runner-linux autobuild
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-windows:
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: powershell
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe autobuild
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-macos:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: bash
+      run: |
+        ../action/runner/dist/codeql-runner-macos autobuild
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-upload-sarif:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Upload with runner
+      run: |
+        # Deliberately don't use TEST_MODE here. This is specifically testing
+        # the compatibility with the API.
+        runner/dist/codeql-runner-linux upload --sarif-file src/testdata/empty-sarif.sarif --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}

.github/workflows/label-pr-size.yml

@@ -1,26 +0,0 @@
-name: Label PR with size
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - edited
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  sizeup:
-    name: Label PR with size
-    runs-on: ubuntu-slim
-    if: github.event.pull_request.merged != true
-
-    steps:
-      - name: Run sizeup
-        uses: lerebear/sizeup-action@b7beb3dd273e36039e16e48e7bc690c189e61951 # 0.8.12
-        with:
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          configuration-file-path: ".github/sizeup.yml"

.github/workflows/post-release-mergeback.yml

@@ -1,165 +0,0 @@
-# This workflow runs after a merge to any release branch of the action. It:
-# 1. Tags the merge commit on the release branch that represents the new release with an `vN.x.y`
-#    tag
-# 2. Updates the `vN` tag to refer to this merge commit.
-# 3. Iff vN == vLatest, merges any changes from the release back into the main branch.
-#    Typically, this is two commits – one to update the version number and one to rebuild.
-name: Tag release and merge back
-
-on:
-  workflow_dispatch:
-    inputs:
-      baseBranch:
-        description: 'The base branch to merge into'
-        default: main
-        required: false
-
-  push:
-    branches:
-      - releases/v*
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  merge-back:
-    runs-on: ubuntu-latest
-    environment: Automation
-    if: github.repository == 'github/codeql-action'
-    env:
-      BASE_BRANCH: "${{ github.event.inputs.baseBranch || 'main' }}"
-      HEAD_BRANCH: "${{ github.head_ref || github.ref }}"
-
-    permissions:
-      contents: write # needed to create tags and push commits
-      pull-requests: write
-
-    steps:
-      - name: Dump environment
-        run: env
-
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
-        run: echo "${GITHUB_CONTEXT}"
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install JavaScript dependencies
-        run: npm ci
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Get version and new branch
-        id: getVersion
-        run: |
-          VERSION="v$(jq '.version' -r 'package.json')"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          short_sha="${GITHUB_SHA:0:8}"
-          NEW_BRANCH="mergeback/${VERSION}-to-${BASE_BRANCH}-${short_sha}"
-          echo "newBranch=${NEW_BRANCH}" >> $GITHUB_OUTPUT
-          LATEST_RELEASE_BRANCH=$(git branch -r | grep -E "origin/releases/v[0-9]+$" | sed 's/origin\///g' | sort -V | tail -1 | xargs)
-          echo "latest_release_branch=${LATEST_RELEASE_BRANCH}" >> $GITHUB_OUTPUT
-
-      - name: Dump branches
-        env:
-          NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
-        run: |
-          echo "BASE_BRANCH ${BASE_BRANCH}"
-          echo "HEAD_BRANCH ${HEAD_BRANCH}"
-          echo "NEW_BRANCH ${NEW_BRANCH}"
-          echo "LATEST_RELEASE_BRANCH ${LATEST_RELEASE_BRANCH}"
-          echo "GITHUB_REF ${GITHUB_REF}"
-
-      - name: Create mergeback branch
-        env:
-          NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
-        run: |
-          git checkout -b "${NEW_BRANCH}"
-
-      - name: Check for tag
-        id: check
-        env:
-          VERSION: "${{ steps.getVersion.outputs.version }}"
-        run: |
-          set +e # don't fail on an errored command
-          git ls-remote --tags origin | grep "${VERSION}"
-          exists="$?"
-          if [ "${exists}" -eq 0 ]; then
-            echo "Tag ${VERSION} exists. Not going to re-release."
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "Tag ${VERSION} does not exist yet."
-          fi
-
-      # we didn't tag the release during the update-release-branch workflow because the
-      # commit that actually makes it to the release branch is a merge commit,
-      # and not yet known during the first workflow. We tag now because we know the correct commit.
-      - name: Tag release
-        if: steps.check.outputs.exists != 'true'
-        env:
-          VERSION: ${{ steps.getVersion.outputs.version }}
-        run: |
-          # Create the `vx.y.z` tag
-          git tag --annotate "${VERSION}" --message "${VERSION}"
-          # Update the `vx` tag
-          major_version_tag=$(cut -d '.' -f1 <<< "${VERSION}")
-          # Use `--force` to overwrite the major version tag
-          git tag --annotate "${major_version_tag}" --message "${major_version_tag}" --force
-          # Push the tags, using:
-          # - `--atomic` to make sure we either update both tags or neither (an intermediate state,
-          #   e.g. where we update the vN.x.y tag on the remote but not the vN tag, could result in
-          #   unwanted Dependabot updates, e.g. from vN to vN.x.y)
-          # - `--force` since we're overwriting the `vN` tag
-          git push origin --atomic --force refs/tags/"${VERSION}" refs/tags/"${major_version_tag}"
-
-      - name: Prepare partial Changelog
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-        run: |
-          npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG"
-
-          echo "::group::Partial CHANGELOG"
-          cat $PARTIAL_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
-
-      - name: Create the GitHub release
-        if: steps.check.outputs.exists != 'true'
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-          VERSION: "${{ steps.getVersion.outputs.version }}"
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          # Do not mark this release as latest. The most recent CLI release must be marked as latest.
-          gh release create \
-            "$VERSION" \
-            --latest=false \
-            --title "$VERSION" \
-            --notes-file "$PARTIAL_CHANGELOG"
-
-      - name: Create mergeback branch and PR
-        if: ${{ endsWith(github.ref_name, steps.getVersion.outputs.latest_release_branch) }}
-        uses: ./.github/actions/prepare-mergeback-branch
-        with:
-          base: "${{ env.BASE_BRANCH }}"
-          head: "${{ env.HEAD_BRANCH }}"
-          branch: "${{ steps.getVersion.outputs.newBranch }}"
-          version: "${{ steps.getVersion.outputs.version }}"
-          token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/pr-checks.yml

@@ -1,250 +1,78 @@
-name: PR Checks
+name: "PR checks"
 
 on:
-  workflow_dispatch:
-  workflow_call:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'workflow_call' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
+  push:
+    branches: [main, v1]
+  pull_request:
 
 jobs:
-  unit-tests:
-    name: Unit Tests
-    if: github.triggering_actor != 'dependabot[bot]'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        node-version: [20, 24]
-    permissions:
-      contents: read
-      security-events: write # needed to upload ESLint results
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
-
-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-unit-tests-${{ github.ref }}-${{ github.event_name }}-${{ matrix.os }}-node${{ matrix['node-version'] }}
-
-    steps:
-      - name: Prepare git (Windows)
-        if: runner.os == 'Windows'
-        run: git config --global core.autocrlf false
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "npm"
-
-      # Install a new enough version of `npm` to understand `min-release-age`
-      # that is still compatible with Node 20.
-      - name: Install newer npm
-        if: matrix.node-version == 20
-        run: npm install -g npm@11.19.1
-
-      - name: Install dependencies
-        run: |
-          # Use the system Bash shell to ensure we can run commands like `npm ci`
-          # that are not available in the default shell on Windows.
-          npm config set script-shell bash
-          npm ci
-
-      - name: Verify compiled JS up to date
-        run: .github/workflows/script/check-js.sh
-
-      - name: Run unit tests
-        if: always()
-        run: npm test
-
-      - name: Lint
-        if: always() && matrix.os != 'windows-latest'
-        run: npm run lint-ci
-
-      - name: Upload sarif
-        uses: ./upload-sarif
-        # The merge queue deletes its `gh-readonly-queue` ref as soon as the queue entry resolves,
-        # so uploading against it races with that deletion. Both the `merge_group` run and the
-        # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
-        # rather than the event. The same results are uploaded by the `pull_request` run and again
-        # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
-        with:
-          sarif_file: eslint.sarif
-          category: eslint
-
-  # These checks do not need to be run as part of the same matrix that we use for the `unit-tests`
-  # job.
-  other-checks:
-    name: Other checks
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
+  lint-js:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }}
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v2
+    - name: Run Lint
+      run: npm run-script lint
 
-      - name: Check for incorrect addresses in package-lock.json
-        run: |
-          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
-              'package-lock.json'; then
-            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
-            exit 1
-          fi
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: "npm"
-
-      - name: Install dependencies
-        id: install-deps
-        run: npm ci
-
-      - name: Verify PR checks up to date
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: .github/workflows/script/verify-pr-checks.sh
-
-      - name: Run pr-checks tests
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        working-directory: pr-checks
-        run: npx tsx --test
-
-      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: npx tsx pr-checks/changenotes.ts validate
-
-      - name: Verify all Actions use the same Node version
-        id: head-version
-        run: |
-          NODE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
-          echo "NODE_VERSION: ${NODE_VERSION}"
-          if [[ $(echo "$NODE_VERSION" | wc -l) -gt 1 ]]; then
-            echo "::error::More than one node version used in 'action.yml' files."
-            exit 1
-          fi
-          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Fetch base commit
-        id: fetch-base
-        # Forks and Dependabot PRs don't have permission to write comments, so skip the repo size
-        # check in those cases.
-        if: >-
-          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.event.pull_request.user.login != 'dependabot[bot]'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Compare against the merge base so the size delta reflects only the commits actually
-          # added by this PR, ignoring any changes that have landed on the base branch since the
-          # PR branched off.
-          merge_base=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_SHA...$HEAD_SHA" --jq '.merge_base_commit.sha')
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-
-      - name: Check repo size
-        if: steps.fetch-base.outcome == 'success'
-        working-directory: pr-checks
-        env:
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: npx tsx check-repo-size.ts --output-dir "$RUNNER_TEMP/repo-size"
-
-      - name: Upload repo size comment
-        if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: repo-size-comment
-          path: ${{ runner.temp }}/repo-size/
-          if-no-files-found: error
-
-      - name: "Backport: Check out base ref"
-        id: checkout-base
-        if: ${{ startsWith(github.head_ref, 'backport-') }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.base_ref }}
-
-      - name: "Backport: Verify Node versions unchanged"
-        if: steps.checkout-base.outcome == 'success'
-        env:
-          HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}
-        run: |
-          BASE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
-          echo "HEAD_VERSION: ${HEAD_VERSION}"
-          echo "BASE_VERSION: ${BASE_VERSION}"
-          if [[ "$BASE_VERSION" != "$HEAD_VERSION" ]]; then
-            echo "::error::Cannot change the Node version of an Action in a backport PR."
-            exit 1
-          fi
-
-  post-repo-size-comment:
-    name: Post repo size comment
-    needs: other-checks
-    # Keep write permissions isolated from the job that checks out and tests PR code. This job only
-    # posts the candidate comment body produced by the read-only `pr-checks` job.
-    if: >-
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
-      needs.other-checks.result == 'success'
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 10
-
-    concurrency:
-      cancel-in-progress: true
-      group: check-repo-size-${{ github.event.pull_request.number }}
+  check-js:
+    runs-on: ubuntu-latest
 
     steps:
-      - name: Download repo size comment
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: repo-size-comment
-          path: repo-size-comment
+    - uses: actions/checkout@v2
+    - name: Check generated JavaScript
+      run: |
+        # Sanity check that repo is clean to start with
+        if [ ! -z "$(git status --porcelain)" ]; then
+          # If we get a fail here then this workflow needs attention...
+          >&2 echo "Failed: Repo should be clean before testing!"
+          exit 1
+        fi
+        # Wipe the lib directory incase there are extra unnecessary files in there
+        rm -rf lib
+        # Generate the JavaScript files
+        npm run-script build
+        # Check that repo is still clean
+        if [ ! -z "$(git status --porcelain)" ]; then
+          # If we get a fail here then the PR needs attention
+          >&2 echo "Failed: JavaScript files are not up to date. Run 'npm run-script build' to update"
+          git status
+          exit 1
+        fi
+        echo "Success: JavaScript files are up to date"
 
-      - name: Post repo size comment
-        env:
-          COMMENT_MARKER: "<!-- repo-size-diff-bot -->"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          significant=$(jq -r '.significant' repo-size-comment/metadata.json)
-          comment_id=$(
-            gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-              --paginate \
-              --jq ".[] | select(.body | contains(\"$COMMENT_MARKER\")) | .id" \
-              | head -n 1
-          )
+  check-node-modules:
+    runs-on: ubuntu-latest
 
-          if [[ -n "$comment_id" ]]; then
-            echo "Updating existing comment $comment_id."
-            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --field body=@repo-size-comment/body.md
-          elif [[ "$significant" == "true" ]]; then
-            echo "Creating new repo size comment."
-            gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --field body=@repo-size-comment/body.md
-          else
-            echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
-          fi
+    steps:
+    - uses: actions/checkout@v2
+    - name: Check node modules up to date
+      run: |
+        # Sanity check that repo is clean to start with
+        if [ ! -z "$(git status --porcelain)" ]; then
+          # If we get a fail here then this workflow needs attention...
+          >&2 echo "Failed: Repo should be clean before testing!"
+          exit 1
+        fi
+        # Reinstall modules and then clean to remove absolute paths
+        # Use 'npm ci' instead of 'npm install' as this is intended to be reproducible
+        npm ci
+        npm run removeNPMAbsolutePaths
+        # Check that repo is still clean
+        if [ ! -z "$(git status --porcelain)" ]; then
+          # If we get a fail here then the PR needs attention
+          >&2 echo "Failed: node_modules are not up to date. Run 'npm ci' and 'npm run removeNPMAbsolutePaths' to update"
+          git status
+          exit 1
+        fi
+        echo "Success: node_modules are up to date"
+
+  npm-test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest,macos-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: npm run-script test
+      run: npm run-script test

.github/workflows/prepare-release.yml

@@ -1,77 +0,0 @@
-name: Prepare release
-on:
-  workflow_call:
-    outputs:
-      version:
-        description: "The version that is being released."
-        value: ${{ jobs.prepare.outputs.version }}
-      major_version:
-        description: "The major version of the release."
-        value: ${{ jobs.prepare.outputs.major_version }}
-      latest_tag:
-        description: "The most recent, existing release tag."
-        value: ${{ jobs.prepare.outputs.latest_tag }}
-      backport_source_branch:
-        description: "The release branch for the given tag."
-        value: ${{ jobs.prepare.outputs.backport_source_branch }}
-      backport_target_branches:
-        description: "JSON encoded list of branches to target with backports."
-        value: ${{ jobs.prepare.outputs.backport_target_branches }}
-
-  push:
-    paths:
-      - .github/workflows/prepare-release.yml
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Release info"
-    runs-on: ubuntu-latest
-    if: github.repository == 'github/codeql-action'
-
-    permissions:
-      contents: read
-
-    outputs:
-      version: ${{ steps.versions.outputs.version }}
-      major_version: ${{ steps.versions.outputs.major_version }}
-      latest_tag: ${{ steps.versions.outputs.latest_tag }}
-      backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}
-      backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-
-      - name: Configure runner for release
-        uses: ./.github/actions/release-initialise
-
-      - name: Get version tags
-        id: versions
-        run: |
-          VERSION="v$(jq '.version' -r 'package.json')"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          MAJOR_VERSION=$(cut -d '.' -f1 <<< "${VERSION}")
-          echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
-          LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-          echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
-
-      - name: Determine older release branches
-        id: branches
-        uses: ./.github/actions/release-branches
-        with:
-          major_version: ${{ steps.versions.outputs.major_version }}
-          latest_tag: ${{ steps.versions.outputs.latest_tag }}
-
-      - name: Print release information
-        run: |
-          echo 'version: ${{ steps.versions.outputs.version }}'
-          echo 'major_version: ${{ steps.versions.outputs.major_version }}'
-          echo 'latest_tag: ${{ steps.versions.outputs.latest_tag }}'
-          echo 'backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}'
-          echo 'backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}'

.github/workflows/publish-immutable-action.yml

@@ -1,27 +0,0 @@
-name: 'Publish Immutable Action Version'
-
-on:
-  push:
-    tags:
-      # Match version tags, but not the major version tags.
-      - 'v[0-9]+.**'
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  publish:
-    runs-on: ubuntu-slim
-    permissions:
-      contents: read
-      id-token: write
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Publish immutable release
-        id: publish
-        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/python312-windows.yml

@@ -1,53 +0,0 @@
-name: Test that the workaround for python 3.12 on windows works
-
-on:
-  push:
-    branches: [main, releases/v*]
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    # Weekly on Monday.
-    - cron: '0 0 * * 1'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  test-setup-python-scripts:
-    if: github.triggering_actor != 'dependabot[bot]'
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-    runs-on: windows-latest
-
-    steps:
-    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-      with:
-        python-version: 3.12
-
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Prepare test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: default
-
-    - name: Initialize CodeQL
-      uses: ./../action/init
-      with:
-        tools: linked
-        languages: python
-
-    - name: Analyze
-      uses: ./../action/analyze

.github/workflows/query-filters.yml

@@ -1,75 +0,0 @@
-name: Query filters tests
-
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  query-filters:
-    name: Query Filters Tests
-    if: github.triggering_actor != 'dependabot[bot]'
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Install Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: 24
-        cache: npm
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: linked
-
-    - name: Check SARIF for default queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters1.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Check SARIF for query packs with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters2.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Check SARIF for query packs and local queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-        config-file: ./.github/codeql/codeql-config-query-filters3.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/rebuild.yml

@@ -1,142 +0,0 @@
-name: Rebuild Action
-
-on:
-  pull_request:
-    types: [labeled]
-  workflow_dispatch:
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  rebuild:
-    name: Rebuild Action
-    runs-on: ubuntu-latest
-    if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
-
-    env:
-      HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }}
-      BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
-
-    permissions:
-      contents: write # needed to push rebuilt commit
-      pull-requests: write # needed to comment on the PR
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          ref: ${{ env.HEAD_REF }}
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Remove label
-        if: github.event_name == 'pull_request'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh pr edit --repo github/codeql-action "$PR_NUMBER" \
-            --remove-label "Rebuild"
-
-      - name: Configure git
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Merge in changes from base branch
-        id: merge
-        run: |
-          git fetch origin "$BASE_BRANCH"
-
-          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
-          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
-          if git merge "origin/$BASE_BRANCH"; then
-            echo "Merge succeeded cleanly."
-          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
-            echo "Merge conflicts detected, continuing."
-            echo "merge-in-progress=true" >> $GITHUB_OUTPUT
-
-            # Check for merge conflicts outside of `lib`.
-            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
-            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
-              echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              echo "$CONFLICTS_OUTSIDE_LIB"
-              exit 1
-            fi
-
-            echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
-              "these by rebuilding the Action."
-          else
-            echo "git merge failed for a reason other than merge conflicts."
-            exit 1
-          fi
-
-      - name: Compile TypeScript
-        run: |
-          npm ci
-          npm run lint -- --fix
-          npm run build
-
-      - name: Sync back version updates to generated workflows
-        # Only sync back versions on Dependabot update PRs
-        if: startsWith(env.HEAD_REF, 'dependabot/')
-        working-directory: pr-checks
-        run: |
-          npm ci
-          npx tsx sync-back.ts --verbose
-
-      - name: Generate workflows
-        working-directory: pr-checks
-        run: ./sync.sh
-
-      - name: "Merge in progress: Finish merge and push"
-        if: steps.merge.outputs.merge-in-progress == 'true'
-        run: |
-          echo "Finishing merge and pushing changes."
-          git add --all
-          git commit --no-edit
-          git push
-
-      - name: "No merge in progress: Check for changes and push"
-        if: steps.merge.outputs.merge-in-progress != 'true'
-        id: push
-        run: |
-          if [ ! -z "$(git status --porcelain)" ]; then
-            echo "Changes detected, committing and pushing."
-            git add --all
-            # If the merge originally had conflicts, finish the merge.
-            # Otherwise, just commit the changes.
-            if git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
-              echo "In progress merge detected, finishing it up."
-              git commit --no-edit
-            else
-              echo "No in-progress merge detected, committing changes."
-              git commit -m "Rebuild"
-            fi
-            echo "Pushing changes"
-            git push
-            echo "changes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No changes detected, nothing to commit."
-          fi
-
-      - name: Notify about rebuild
-        if: >-
-          github.event_name == 'pull_request' &&
-            (
-              steps.merge.outputs.merge-in-progress == 'true' ||
-              steps.push.outputs.changes == 'true'
-            )
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          echo "Pushed a commit to rebuild the Action." \
-            "Please approve running the PR checks." |
-            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

.github/workflows/rollback-release.yml

@@ -1,187 +0,0 @@
-name: Rollback release
-on:
-  # You can trigger this workflow via workflow dispatch to start a rollback.
-  # This will create a draft release that mirrors the release for `rollback-tag`.
-  workflow_dispatch:
-    inputs:
-      rollback-tag:
-        type: string
-        description: "The tag of an old release to roll-back to."
-        required: true
-  # Only for dry-runs of changes to the workflow.
-  push:
-    # Don't run dry-run on release branches, since that's unnecessary.
-    branches-ignore:
-      - releases/v*
-    paths:
-      - .github/workflows/rollback-release.yml
-      - .github/actions/prepare-mergeback-branch/**
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Prepare"
-    if: github.repository == 'github/codeql-action'
-
-    permissions:
-      contents: read
-
-    uses: ./.github/workflows/prepare-release.yml
-
-  rollback:
-    name: "Create rollback release"
-    if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-
-    # Don't set the deployment environment for test runs
-    # The Actions token does not have permissions to push changes to workflow files.
-    # Since workflow files may change as part of a backport PR, we use the "Automation" environment for real runs to authenticate as a GitHub App and push these changes.
-    environment: ${{ github.event_name == 'workflow_dispatch' && 'Automation' || '' }}
-
-    needs:
-      - prepare
-
-    permissions:
-      contents: write # needed to push to the repo (tags and releases)
-      pull-requests: write # needed to create the mergeback PR
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-
-      - name: Configure runner for release
-        uses: ./.github/actions/release-initialise
-
-      - name: Create tag for testing
-        if: github.event_name != 'workflow_dispatch'
-        run: git tag v0.0.0
-
-      # We start by preparing the mergeback branch, mainly so that we have the updated changelog
-      # readily available for the partial changelog that's needed for the release.
-      - name: Prepare mergeback branch
-        id: mergeback-branch
-        env:
-          BASE_BRANCH: ${{ (github.event_name == 'workflow_dispatch' && 'main') || github.ref_name }}
-          VERSION: ${{ needs.prepare.outputs.version }}
-        run: |
-          set -x
-
-          # Checkout the base branch, since we may be testing on a different branch
-          git checkout "$BASE_BRANCH"
-
-          # Generate a new branch name for the mergeback PR
-          short_sha="${GITHUB_SHA:0:8}"
-          NEW_BRANCH="mergeback/${VERSION}-to-${BASE_BRANCH}-${short_sha}"
-          echo "new-branch=${NEW_BRANCH}" >> $GITHUB_OUTPUT
-
-          # Create the mergeback branch
-          git checkout -b "${NEW_BRANCH}"
-
-      - name: Prepare rollback changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
-          # but use `v0.0.0` for testing.
-          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}
-          VERSION: "${{ needs.prepare.outputs.version }}"
-        run: |
-          npx tsx pr-checks/rollback-changelog.ts \
-            --target-version "${ROLLBACK_TAG:1}" \
-            --rollback-version "${LATEST_TAG:1}" \
-            --new-version "$VERSION" > $NEW_CHANGELOG
-
-          echo "::group::New CHANGELOG"
-          cat $NEW_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Create tags
-        env:
-          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
-          # but use `v0.0.0` for testing.
-          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          # Use `needs.prepare.outputs.version` for actual runs and `v0.0.1` for testing.
-          RELEASE_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.version, 'v0.0.1') }}
-          # Use `needs.prepare.outputs.major_version` for actual runs and `v0` for testing.
-          MAJOR_VERSION_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.major_version, 'v0') }}
-        run: |
-          git checkout "refs/tags/${ROLLBACK_TAG}"
-          git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
-          git tag --annotate "${MAJOR_VERSION_TAG}" --message "${MAJOR_VERSION_TAG}" --force
-
-      - name: Push tags
-        # skip when testing
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
-          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
-        run: |
-          git push origin --atomic --force refs/tags/"${RELEASE_TAG}" refs/tags/"${MAJOR_VERSION_TAG}"
-
-      - name: Prepare partial Changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-        run: |
-          npx tsx pr-checks/prepare-changelog.ts \
-            --changelog="$NEW_CHANGELOG" \
-            --output="$PARTIAL_CHANGELOG"
-
-          echo "::group::Partial CHANGELOG"
-          cat $PARTIAL_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Generate token
-        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
-
-      - name: Create the rollback release
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-          VERSION: "${{ needs.prepare.outputs.version }}"
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          RELEASE_URL: "${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ needs.prepare.outputs.version }}"
-        run: |
-          set -exu
-
-          # Do not mark this release as latest. The most recent bundle release must be marked as latest.
-          # Set as a draft to give us an opportunity to review the rollback release.
-          gh release create \
-            "$VERSION" \
-            --latest=false \
-            --draft \
-            --title "$VERSION" \
-            --notes-file "$PARTIAL_CHANGELOG"
-
-          echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY
-
-      - name: Update changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"
-        run: |
-          git checkout "${NEW_BRANCH}"
-          mv ${NEW_CHANGELOG} CHANGELOG.md
-
-      - name: Create mergeback branch and PR
-        uses: ./.github/actions/prepare-mergeback-branch
-        with:
-          base: "main"
-          head: ""
-          branch: "${{ steps.mergeback-branch.outputs.new-branch }}"
-          version: "${{ needs.prepare.outputs.version }}"
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          # Setting this to `true` for non-workflow_dispatch events will
-          # still push the `branch`, but won't create a corresponding PR
-          dry-run: "${{ github.event_name != 'workflow_dispatch' }}"

.github/workflows/script/check-js.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-# Wipe the lib directory in case there are extra unnecessary files in there
-rm -rf lib
-# Generate the JavaScript files
-npm run-script build
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
-    git status
-
-    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/js.diff"
-    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    # Reset bundled files to allow other checks to test for changes
-    git checkout lib
-
-    # Fail this check
-    exit 1
-fi
-echo "Success: JavaScript files are up to date"

.github/workflows/script/verify-pr-checks.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-
-# Wipe the generated PR checks in case there are extra unnecessary files in there
-rm -rf .github/workflows/__*
-
-# Generate the PR checks
-pr-checks/sync.sh
-
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    git diff
-    git status
-    >&2 echo "Failed: PR checks are not up to date. Run 'cd pr-checks && ./sync.sh' to update"
-
-    echo "### Generated workflows diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/workflows.diff"
-    cat "$RUNNER_TEMP/workflows.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    exit 1
-fi
-echo "Success: PR checks are up to date"

.github/workflows/test-codeql-bundle-all.yml

@@ -1,62 +0,0 @@
-name: 'PR Check - CodeQL Bundle All'
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-jobs:
-  test-codeql-bundle-all:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - os: ubuntu-latest
-          version: nightly-latest
-    name: 'CodeQL Bundle All'
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-        use-all-platform-bundle: true
-    - name: Install .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '9.x'
-    - id: init
-      uses: ./../action/init
-      with:
-        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - name: Build code
-      run: ./build.sh
-    - uses: ./../action/analyze
-    env:
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/update-bundle.yml

@@ -1,123 +0,0 @@
-name: Update default CodeQL bundle
-
-on:
-  release:
-    # From https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
-    # Note: The prereleased type will not trigger for pre-releases published
-    # from draft releases, but the published type will trigger. If you want a
-    # workflow to run when stable and pre-releases publish, subscribe to
-    # published instead of released and prereleased.
-    #
-    # From https://github.com/orgs/community/discussions/26281
-    # As a work around, in published type workflow,  you could add if condition
-    # to filter pre-release attribute.
-    types: [published]
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  update-bundle:
-    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull requests
-    steps:
-      - name: Dump environment
-        run: env
-
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
-        run: echo "$GITHUB_CONTEXT"
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Update bundle
-        uses: ./.github/actions/update-bundle
-
-      - name: Set up CodeQL CLI from new bundle
-        id: setup-codeql
-        uses: ./setup-codeql
-        with:
-          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
-
-      - name: Update built-in languages
-        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
-        env:
-          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
-
-      - name: Bump Action minor version if new CodeQL minor version series
-        id: bump-action-version
-        run: |
-          prior_cli_version=$(jq -r '.priorCliVersion' src/defaults.json)
-          cli_version=$(jq -r '.cliVersion' src/defaults.json)
-
-          prior_minor=$(echo "$prior_cli_version" | cut -d. -f2)
-          current_minor=$(echo "$cli_version" | cut -d. -f2)
-
-          if [[ "$current_minor" != "$prior_minor" ]]; then
-            echo "New CodeQL minor version series ($prior_cli_version -> $cli_version), bumping Action minor version"
-            npm version minor --no-git-tag-version
-            echo "bumped=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Same minor version series ($prior_cli_version -> $cli_version), skipping Action version bump"
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Rebuild Action
-        run: npm run build
-
-      - name: Commit and push changes
-        env:
-          RELEASE_TAG: "${{ github.event.release.tag_name }}"
-        run: |
-          git checkout -b "update-bundle/$RELEASE_TAG"
-          git commit -am "Update default bundle to $RELEASE_TAG"
-          git push --set-upstream origin "update-bundle/$RELEASE_TAG"
-
-      - name: Open pull request
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ACTION_VERSION_BUMPED: ${{ steps.bump-action-version.outputs.bumped }}
-        run: |
-          cli_version=$(jq -r '.cliVersion' src/defaults.json)
-          action_version=$(jq -r '.version' package.json)
-
-          pr_body="This pull request updates the default CodeQL bundle, as used with \`tools: linked\` and on GHES, to $cli_version."
-          if [[ "$ACTION_VERSION_BUMPED" == "true" ]]; then
-            pr_body+=$'\n\n'"Since this is a new CodeQL minor version series, this PR also bumps the Action version to $action_version."
-          fi
-
-          pr_url=$(gh pr create \
-            --title "Update default bundle to $cli_version" \
-            --body "$pr_body" \
-            --assignee "$GITHUB_ACTOR" \
-          )
-          echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
-          echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"
-
-      - name: Create changelog note
-        run: |
-          npx tsx pr-checks/bundle-changelog.ts
-
-      - name: Push changelog note
-        run: |
-          git commit -am "Add changelog note"
-          git push

.github/workflows/update-release-branch.yml

@@ -1,121 +1,32 @@
 name: Update release branch
 on:
-  # You can trigger this workflow via workflow dispatch to start a release.
-  # This will open a PR to update the latest release branch.
+  schedule:
+    - cron: 0 9 * * 1
+  repository_dispatch:
+    # Example of how to trigger this:
+    # curl -H "Authorization: Bearer <token>" -X POST https://api.github.com/repos/github/codeql-action/dispatches -d '{"event_type":"update-release-branch"}'
+    # Replace <token> with a personal access token from this page: https://github.com/settings/tokens
+    types: [update-release-branch]
   workflow_dispatch:
 
-  # When a release is complete this workflow will open up backport PRs to older release branches.
-  # NB while it will trigger on any release branch update, the backport job will not proceed for
-  # anything other than than releases/v{latest}
-  push:
-    branches:
-      - releases/*
-
-defaults:
-  run:
-    shell: bash
-
 jobs:
-  prepare:
-    name: "Prepare"
-    permissions:
-      contents: read
-
-    uses: ./.github/workflows/prepare-release.yml
-
   update:
-    name: "Update release branch"
-    timeout-minutes: 45
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch'
-    needs: [prepare]
-    env:
-      REF_NAME: "${{ github.ref_name }}"
-      REPOSITORY: "${{ github.repository }}"
-      MAJOR_VERSION: "${{ needs.prepare.outputs.major_version }}"
-      LATEST_TAG: "${{ needs.prepare.outputs.latest_tag }}"
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull request
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v2
       with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-    - uses: ./.github/actions/release-initialise
+        # Need full history so we calculate diffs
+        fetch-depth: 0
 
-    # when the workflow has been manually triggered on main,
-    # we know that we definitely want the release branch to exist
-    - name: Ensure release branch exists
-      run: |
-        echo "MAJOR_VERSION ${MAJOR_VERSION}"
-        RELEASE_BRANCH=releases/${MAJOR_VERSION}
-        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-            echo "Branch $RELEASE_BRANCH already exists"
-            echo ""
-        else
-            echo "Creating $RELEASE_BRANCH branch"
-            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-            git push --set-upstream origin ${RELEASE_BRANCH}
-            git branch --show-current
-            echo ""
-        fi
-        echo "Returning to branch: ${REF_NAME}"
-        git checkout ${REF_NAME}
-
-    - name: Update current release branch
-      if: github.event_name == 'workflow_dispatch'
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${REF_NAME}
-        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch '${{ env.REF_NAME }}' \
-          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-          --is-primary-release \
-          --conductor ${GITHUB_ACTOR}
-
-  backport:
-    name: "Create backport"
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    environment: Automation
-    needs: [prepare]
-    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        target_branch: ${{ fromJson(needs.prepare.outputs.backport_target_branches) }}
-    env:
-      SOURCE_BRANCH: ${{ needs.prepare.outputs.backport_source_branch }}
-      TARGET_BRANCH: ${{ matrix.target_branch }}
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull request
-    steps:
-    - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-token
+    - name: Set up Python
+      uses: actions/setup-python@v2
       with:
-        app-id: ${{ vars.AUTOMATION_APP_ID }}
-        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+        python-version: 3.5
 
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-        token: ${{ steps.app-token.outputs.token }}
-    - uses: ./.github/actions/release-initialise
-
-    - name: Update older release branch
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Install dependencies
       run: |
-        echo SOURCE_BRANCH=${SOURCE_BRANCH}
-        echo TARGET_BRANCH=${TARGET_BRANCH}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch ${SOURCE_BRANCH} \
-          --target-branch ${TARGET_BRANCH} \
-          --conductor ${GITHUB_ACTOR}
+        python -m pip install --upgrade pip
+        pip install PyGithub==1.51 requests
+
+    - name: Update release branch
+      run: python .github/update-release-branch.py ${{ secrets.GITHUB_TOKEN }} ${{ github.repository }}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -1,90 +0,0 @@
-name: Update Supported Enterprise Server Versions
-
-on:
-  schedule:
-    - cron: "0 0 * * *"
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - .github/workflows/update-supported-enterprise-server-versions.yml
-      - pr-checks/update-ghes-versions.ts
-
-jobs:
-  update-supported-enterprise-server-versions:
-    name: Update Supported Enterprise Server Versions
-    timeout-minutes: 45
-    runs-on: ubuntu-slim
-    if: github.repository == 'github/codeql-action'
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull request
-
-    steps:
-      - name: Checkout CodeQL Action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Checkout Enterprise Releases
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: github/enterprise-releases
-          token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }}
-          path: ${{ github.workspace }}/enterprise-releases/
-          sparse-checkout: releases.json
-
-      - name: Update Supported Enterprise Server Versions
-        working-directory: pr-checks
-        run: |
-          npx tsx update-ghes-versions.ts
-          rm --recursive "$ENTERPRISE_RELEASES_PATH"
-        env:
-          ENTERPRISE_RELEASES_PATH: ${{ github.workspace }}/enterprise-releases/
-
-      - name: Rebuild
-        run: npm run build
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Commit changes
-        id: prepare-commit
-        run: |
-          if [[ -z $(git status --porcelain) ]]; then
-            echo "No changes to commit"
-            echo "committed=false" >> $GITHUB_OUTPUT
-          else
-            git checkout -b update-supported-enterprise-server-versions
-            git add .
-            git commit --message "Update supported GitHub Enterprise Server versions"
-
-            echo "committed=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Open PR
-        if: github.event_name != 'pull_request' && steps.prepare-commit.outputs.committed == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git push origin update-supported-enterprise-server-versions
-
-          body="This PR updates the list of supported GitHub Enterprise Server versions, either because a new "
-          body+="version is about to be feature frozen, or because an old release has been deprecated."
-          body+=$'\n\n'
-          body+="If an old release has been deprecated, please follow the instructions in CONTRIBUTING.md to "
-          body+="deprecate the corresponding version of CodeQL."
-
-          gh pr create --draft \
-            --title "Update supported GitHub Enterprise Server versions" \
-            --body "$body"

.gitignore

@@ -1,15 +1,2 @@
-# Dependency directories
-node_modules/
-# Build output for tests
-build/
-# Java build files
-.gradle/
-*.class
-# macOS
-.DS_Store
-# eslint sarif report
-eslint.sarif
-# for local incremental compilation
-tsconfig.tsbuildinfo
-# esbuild metadata file
-meta.json
+/runner/dist/
+/runner/node_modules/

.npmrc

@@ -1,2 +0,0 @@
-lockfile-version=3
-min-release-age=7

.pre-commit-config.yaml

@@ -1,20 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: lint-ts
-        name: Lint typescript code
-        files: \.ts$
-        language: system
-        entry: npm run lint -- --fix
-      - id: compile-ts
-        name: Compile typescript
-        files: \.[tj]s$
-        language: system
-        entry: npm run build
-        pass_filenames: false
-      - id: pr-checks-sync
-        name: Synchronize PR check workflows
-        files: ^.github/workflows/__.*\.yml$|^pr-checks
-        language: system
-        entry: pr-checks/sync.sh
-        pass_filenames: false

.vscode/settings.json

@@ -5,25 +5,6 @@
     "**/.DS_Store": true,
 
     // transpiled JavaScript
-    "build": true,
     "lib": true,
-
-    // exclude "tests" by default because it causes VSCode to start language-specific extensions
-    // that are not typically needed during development (or indeed may not work correctly)
-    "tests": true
-  },
-  "search.exclude": {
-    "**/node_modules": true,
-    "build": true,
-    "lib": true,
-  },
-  // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
-  // an intermediate stage where many files are modified. This setting suppresses these warnings.
-  "git.ignoreLimitWarning": true,
-  // Use the vendored TypeScript version to have a consistent development experience across
-  // machines.
-  "js/ts.tsdk.path": "node_modules/typescript/lib",
-  "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
+  }
 }

.vscode/tasks.json

@@ -1,15 +0,0 @@
-{
-	"version": "2.0.0",
-	"tasks": [
-		{
-			"type": "typescript",
-			"tsconfig": "tsconfig.json",
-			"option": "watch",
-			"problemMatcher": [
-				"$tsc-watch"
-			],
-			"group": "build",
-			"label": "tsc: watch - tsconfig.json"
-		}
-	]
-}

.vscode/tests.code-snippets

@@ -1,30 +0,0 @@
-{
-  // Place your codeql-action workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and
-  // description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope
-  // is left empty or omitted, the snippet gets applied to all languages. The prefix is what is
-  // used to trigger the snippet and the body will be expanded and inserted. Possible variables are:
-  // $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders.
-  // Placeholders with the same ids are connected.
-  // Example:
-  // "Print to console": {
-  // 	"scope": "javascript,typescript",
-  // 	"prefix": "log",
-  // 	"body": [
-  // 		"console.log('$1');",
-  // 		"$2"
-  // 	],
-  // 	"description": "Log output to console"
-  // }
-  "Test Macro": {
-    "scope": "javascript, typescript",
-    "prefix": "testMacro",
-    "body": [
-      "const ${1:nameMacro} = makeMacro({",
-      "  exec: async (t: ExecutionContext<unknown>) => {},",
-      "",
-      "  title: (providedTitle = \"\") => `${2:common title} - \\${providedTitle}`,",
-      "});",
-    ],
-    "description": "An Ava test macro",
-  },
-}

CODEOWNERS

@@ -1 +0,0 @@
-**/* @github/codeql-action-reviewers

CONTRIBUTING.md

@@ -3,7 +3,6 @@
 [fork]: https://github.com/github/codeql-action/fork
 [pr]: https://github.com/github/codeql-action/compare
 [code-of-conduct]: CODE_OF_CONDUCT.md
-[readme]: README.md#supported-versions-of-the-codeql-cli-and-github-enterprise-server
 
 Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
 
@@ -13,37 +12,53 @@ Please note that this project is released with a [Contributor Code of Conduct][c
 
 ## Development and Testing
 
-Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node installed. You can see which version of node is used by the action in `init/action.yml`.
 
 ### Common tasks
 
 * Transpile the TypeScript to JavaScript: `npm run build`.  Note that the JavaScript files are committed to git.
 * Run tests: `npm run test`.  You’ll need to ensure that the JavaScript files are up-to-date first by running the command above.
 * Run the linter: `npm run lint`.
-* Run tests for a specific path: `npm run ava -- ./src/filename.test.ts` or `npm run ava -- ./src/feature-flags/`
 
 This project also includes configuration to run tests from VSCode (with support for breakpoints) - open the test file you wish to run and choose "Debug AVA test file" from the Run menu in the Run panel.
 
-You may want to run `tsc --watch` from the command line or inside of vscode in order to ensure build artifacts are up to date as you are working.
-
-### Checking in compiled artifacts
-
-Because CodeQL Action users consume the code directly from this repository, and there can be no build step during a GitHub Actions run, this repository contains all compiled artifacts. There is a PR check that will fail if any of the compiled artifacts are not up to date. Compiled artifacts are stored in the `lib/` directory. For all day-to-day development purposes, this folder can be ignored.
-
 ### Running the action
 
 To see the effect of your changes and to test them, push your changes in a branch and then look at the [Actions output](https://github.com/github/codeql-action/actions) for that branch.  You can also exercise the code locally by running the automated tests.
 
+### Running the action locally
+
+It is possible to run this action locally via [act](https://github.com/nektos/act) via the following steps:
+
+1. Create a GitHub [Personal Access Token](https://github.com/settings/tokens) (PAT).
+1. Install [act](https://github.com/nektos/act) v0.2.10 or greater.
+1. Add a `.env` file in the root of the project you are running:
+
+  ```bash
+  CODEQL_LOCAL_RUN=true
+
+  # Optional, for better logging
+  GITHUB_JOB=<ANY_JOB_NAME>
+  ```
+
+1. Run `act -j codeql -s GITHUB_TOKEN=<PAT>`
+
+Running locally will generate the CodeQL database and run all the queries, but it will avoid uploading and reporting results to GitHub. Note that this must be done on a repository that _consumes_ this action, not this repository. The use case is to debug failures of this action on specific repositories.
+
 ### Integration tests
 
 As well as the unit tests (see _Common tasks_ above), there are integration tests, defined in `.github/workflows/integration-testing.yml`.  These are run by a CI check.  Depending on the change you’re making, you may want to add a test to this file or extend an existing one.
 
+### Building the CodeQL runner
+
+Navigate to the `runner` directory and run `npm install` to install dependencies needed only for compiling the CodeQL runner. Run `npm run build-runner` to output files to the `runner/dist` directory.
+
 ## Submitting a pull request
 
-1. [Fork][fork] and clone the repository.
-2. Create a new branch: `git checkout -b my-branch-name`.
-3. Make your change, add tests, and make sure the tests still pass. Ensure that you have run `npm run build` and committed any changes to the compiled artifacts.
-4. Push to your fork and [submit a pull request][pr].
+1. [Fork][fork] and clone the repository
+2. Create a new branch: `git checkout -b my-branch-name`
+3. Make your change, add tests, and make sure the tests still pass
+4. Push to your fork and [submit a pull request][pr]
 5. Pat yourself on the back and wait for your pull request to be reviewed and merged.
 
 If you're a GitHub staff member, you can merge your own PR once it's approved; for external contributors, GitHub staff will merge your PR once it's approved.
@@ -54,81 +69,6 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
 
-## Releasing (write access required)
-
-1. The first step of releasing a new version of the `codeql-action` is running the "Update release branch" workflow.
-    This workflow goes through the pull requests that have been merged to `main` since the last release, creates a changelog, then opens a pull request to merge the changes since the last release into the `releases/v3` release branch.
-
-    You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
-1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it **with a merge commit** (`gh pr merge --merge`).
-1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
-1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
-1. Approve the mergeback and backport pull request (if applicable) and automerge them **with a merge commit** (`gh pr merge --merge`).
-
-    > [!NOTE]
-    > The release, mergeback, and backport pull requests must always be merged with a merge commit — **never squash or rebase**. The mergeback tags the release using the merge commit of the "Merge main into releases/v3" pull request, so squashing or rebasing breaks tagging and the branch linkage the release automation relies on.
-
-Once the mergeback and backport pull request have been merged, the release is complete.
-
-## Keeping the PR checks up to date (admin access required)
-
-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [sync-checks.ts](pr-checks/sync-checks.ts) script:
-
-- At a minimum, you must provide a token with permissions to update branch protection rules. For example, `gh auth token | pr-checks/sync-checks.ts --token-stdin` uses the same token that `gh` uses. You can also set the `GH_TOKEN` or `GITHUB_TOKEN` environment variable. If no token is provided or the token has insufficient permissions, the script will fail.
-- By default, the script performs a dry run and outputs information about the changes it would make to the branch protection rules. To actually apply the changes, specify the `--apply` flag.
-- If you run the script without any other arguments, it will retrieve the set of workflows that ran for the latest commit on `main`.
-- You can specify a different git ref with the `--ref` input. You will likely want to use this if you have a PR that removes or adds PR checks. For example, `--ref "some/branch/name"` to use the HEAD of the `some/branch/name` branch.
-
-After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v4`, and any other currently supported major versions have been updated.
-
-Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.
-
-## Deprecating a CodeQL version (write access required)
-
-We typically deprecate a version of CodeQL when the GitHub Enterprise Server (GHES) version that it first shipped in is deprecated.
-
-1. Work out the next minimum version of CodeQL. This is the version that shipped in the version of GHES after the one that has just been deprecated.
-1. Notify users using the old version of CodeQL about the deprecation.
-    - Update `CODEQL_NEXT_MINIMUM_VERSION`, `GHES_VERSION_MOST_RECENTLY_DEPRECATED`, and `GHES_MOST_RECENT_DEPRECATION_DATE` in `src/codeql.ts` to reflect the new minimum version of CodeQL and the GHES version that has just been deprecated.
-    - Add a changelog note announcing the deprecation.
-    - Update the CLI version referenced in the [readme] by adding a new row to the compatibility table.
-    - Example PR: https://github.com/github/codeql-action/pull/1884
-1. Release the Action, or wait for the next scheduled release of the Action, then wait at least a week so users have time to see and act on the deprecation warning.
-1. Remove support for the old version of CodeQL.
-    - Bump `CODEQL_MINIMUM_VERSION` in `src/codeql.ts` to the new minimum version of CodeQL.
-    - Remove any code that is only needed to support the old version of CodeQL. This is often behind a version guard, so look for instances of version numbers between the old minimum version and the new minimum version in the codebase. A good place to start is the list of version numbers in `src/codeql.ts`.
-    - Update the default set of CodeQL test versions in `pr-checks/sync.ts`.
-        - Remove the old minimum version of CodeQL.
-        - Add the latest patch release for any new CodeQL minor version series that have shipped in GHES.
-        - Run the script to update the generated PR checks.
-    - Do the same for PR checks that aren't auto-generated.
-    - Add a changelog note announcing the new minimum version of CodeQL that is now required.
-    - Example PR: https://github.com/github/codeql-action/pull/1907
-
-## Adding a new CodeQL Action major version
-
-We sometimes maintain multiple versions of the CodeQL Action to enable customers on older but still supported versions of GitHub Enterprise Server (GHES) to continue to benefit from the latest CodeQL improvements. To accomplish this, the release process automation listens to updates to the release branch for the newest supported version.  When this branch is updated, the release process automatically opens backport PRs to update the release branches for older versions.
-
-To add a new major version of the Action:
-
-1. Change the `version` field of `package.json` by running `npm version x.y.z` where `x` is the new major version, and `y` and `z` match the latest minor and patch versions of the last release.
-1. Update appropriate documentation to explain the reasoning behind the releases: see [the diff](https://github.com/github/codeql-action/pull/2677/commits/913d60579d4b560addf53ec3c493d491dd3c1378) in our last major version deprecation for examples on which parts of the documentation should be updated.
-1. Consider the timeline behind deprecating the prior Action version: see [CodeQL Action deprecation documentation](#deprecating-a-codeql-action-major-version-write-access-required)
-1. If the new major version runs on a new version of Node, add a PR check to ensure the codebase continues to compile against the previous version of Node. See [Remove Node 16 compilation PR check](https://github.com/github/codeql-action/pull/2695) for an example.
-
-## Deprecating a CodeQL Action major version (write access required)
-
-We typically deprecate older versions of the Action once all supported GHES versions are compatible with the version of Node.js we are using on `main`.
-
-To deprecate an older version of the Action:
-
-1. Notify any users who are still pinned to the `vN` tag of the deprecated version of the Action, giving as much notice as is practical.
-   - Add a changelog note announcing the deprecation.
-   - Implement an Actions warning for customers using the deprecated version.
-1. Wait for the deprecation period to pass.
-1. Upgrade the Actions warning for customers using the deprecated version to a non-fatal error, and mention that this version of the Action is no longer supported.
-1. Make a PR to bump the `OLDEST_SUPPORTED_MAJOR_VERSION` in [config.ts](pr-checks/config.ts).  Once this PR is merged, the release process will no longer backport changes to the deprecated release version.
-
 ## Resources
 
 - [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)

README.md

@@ -1,95 +1,121 @@
 # CodeQL Action
 
-This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
-
-For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).
+This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
 
 ## License
 
 This project is released under the [MIT License](LICENSE).
 
-The underlying CodeQL CLI, used in this action, is licensed under the [GitHub CodeQL Terms and Conditions](https://securitylab.github.com/tools/codeql/license). As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.
+The underlying CodeQL CLI, used in this action, is licensed under the [GitHub CodeQL Terms and Conditions](https://securitylab.github.com/tools/codeql/license). As such, this action may be used on open source projects hosted on GitHub, and on  private repositories that are owned by an organisation with GitHub Advanced Security enabled.
 
 ## Usage
 
-We recommend using default setup to configure CodeQL analysis for your repository. For more information, see "[Configuring default setup for code scanning](https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning)."
+This is a short walkthrough, but for more information read [configuring code scanning](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning).
 
-You can also configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration. For more information, see "[Configuring advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning)" and "[Customizing your advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning)."
+To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:
 
-### Actions
+```yaml
 
-This repository contains several actions that enable you to analyze code in your repository using CodeQL and upload the analysis to GitHub Code Scanning. Actions in this repository also allow you to upload to GitHub analyses generated by any SARIF-producing SAST tool.
+name: "Code Scanning - Action"
 
-Actions for CodeQL analyses:
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 0 * * 0'
 
-- `init`: Sets up CodeQL for analysis. For information about input parameters, see the [init action definition](https://github.com/github/codeql-action/blob/main/init/action.yml).
-- `analyze`: Finalizes the CodeQL database, runs the analysis, and uploads the results to Code Scanning. For information about input parameters, see the [analyze action definition](https://github.com/github/codeql-action/blob/main/analyze/action.yml).
+jobs:
+  CodeQL-Build:
+    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
+    runs-on: ubuntu-latest
 
-Actions for uploading analyses generated by third-party tools:
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          # Must fetch at least the immediate parents so that if this is
+          # a pull request then we can checkout the head of the pull request.
+          # Only include this option if you are running this workflow on pull requests.
+          fetch-depth: 2
 
-- `upload-sarif`: Uploads a SARIF file to Code Scanning. If you are using the `analyze` action, there is no reason to use this action as well. For information about input parameters, see the [upload-sarif action definition](https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml).
+      # If this run was triggered by a pull request event then checkout
+      # the head of the pull request instead of the merge commit.
+      # Only include this step if you are running this workflow on pull requests.
+      - run: git checkout HEAD^2
+        if: ${{ github.event_name == 'pull_request' }}
 
-Actions with special purposes and unlikely to be used directly:
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        # Override language selection by uncommenting this and choosing your languages
+        # with:
+        #   languages: go, javascript, csharp, python, cpp, java
 
-- `autobuild`: Attempts to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead. For information about input parameters, see the [autobuild action definition](https://github.com/github/codeql-action/blob/main/autobuild/action.yml).
-- `resolve-environment`: [Experimental] Attempts to infer a build environment suitable for automatic builds. For information about input parameters, see the [resolve-environment action definition](https://github.com/github/codeql-action/blob/main/resolve-environment/action.yml).
-- `start-proxy`: [Experimental] Start the HTTP proxy server. Internal use only and will change without notice. For information about input parameters, see the [start-proxy action definition](https://github.com/github/codeql-action/blob/main/start-proxy/action.yml).
-- `setup-codeql`: [Experimental] Similar to `init`, except it only installs the CodeQL CLI and does not initialize a database.
+      # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below).
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v1
 
-### Workflow Permissions
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
 
-All advanced setup code scanning workflows must have the `security-events: write` permission. Workflows in private repositories must additionally have the `contents: read` permission. For more information, see "[Assigning permissions to jobs](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs)."
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following
+      #    three lines and modify them (or add more) to build your code if your
+      #    project uses a compiled language
 
-### Build Modes
+      #- run: |
+      #   make bootstrap
+      #   make release
 
-The CodeQL Action supports different build modes for analyzing the source code. The available build modes are:
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
+```
 
-- `none`: The database will be created without building the source code. Available for all interpreted languages and some compiled languages.
-- `autobuild`: The database will be created by attempting to automatically build the source code. Available for all compiled languages.
-- `manual`: The database will be created by building the source code using a manually specified build command. To use this build mode, specify manual build steps in your workflow between the `init` and `analyze` steps. Available for all compiled languages.
+If you prefer to integrate this within an existing CI workflow, it should end up looking something like this:
 
-#### Which build mode should I use?
+```yaml
+- name: Initialize CodeQL
+  uses: github/codeql-action/init@v1
+  with:
+    languages: go, javascript
 
-Interpreted languages must use `none` for the build mode.
+# Here is where you build your code
+- run: |
+  make bootstrap
+  make release
 
-For compiled languages:
+- name: Perform CodeQL Analysis
+  uses: github/codeql-action/analyze@v1
+```
 
-- `manual` build mode will typically produce the most precise results, but it is more difficult to set up and will cause the analysis to take slightly more time to run.
-- `autobuild` build mode is simpler to set up, but will only work for projects with generic build steps that can be guessed by the heuristics of the autobuild scripts. If `autobuild` fails, then you must switch to `manual` or `none`. If `autobuild` succeeds, then the results and run time will be the same as `manual` mode.
-- `none` build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to. `none` is not yet supported by Swift, Go, or Kotlin. It is in public preview for C/C++.
+### Configuration file
 
+Use the `config-file` parameter of the `init` action to enable the configuration file. The value of `config-file` is the path to the configuration file you want to use. This example loads the configuration file `./.github/codeql/codeql-config.yml`.
 
-## Supported versions of the CodeQL Action
+```yaml
+- uses: github/codeql-action/init@v1
+  with:
+    config-file: ./.github/codeql/codeql-config.yml
+```
 
-The following versions of the CodeQL Action are currently supported:
+The configuration file must be located within the local repository. For information on how to write a configuration file, see "[Using a custom configuration file](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#using-a-custom-configuration-file)."
 
-- v4 (latest)
-- v3
+If you only want to customise the queries used, you can specify them in your workflow instead of creating a config file, using the `queries` property of the `init` action:
 
-## Supported versions of the CodeQL Bundle on GitHub Enterprise Server
+```yaml
+- uses: github/codeql-action/init@v1
+  with:
+    queries: <local-or-remote-query>,<another-query>
+```
 
-We typically release new minor versions of the CodeQL Action and Bundle when a new minor version of GitHub Enterprise Server (GHES) is released. When a version of GHES is deprecated, the CodeQL Action and Bundle releases that shipped with it are deprecated as well.
+By default, this will override any queries specified in a config file. If you wish to use both sets of queries, prefix the list of queries in the workflow with `+`:
 
-| Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
-|-----------------------|-------------------------------|--------------------|-------|
-| `v4.36.2` | `2.25.6` | Enterprise Server 3.22 | |
-| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
-| `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
-| `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
-
-See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
-
-## Keeping the CodeQL Action up to date in advanced setups
-
-If you are using an [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning), we recommend referencing the CodeQL Action using a major version tag (e.g. `v4`) in your workflow file. This ensures your workflow automatically picks up the latest release within that major version, including bug fixes, new features, and updated CodeQL CLI versions.
-
-If you pin to a specific commit SHA or patch version tag, ensure you keep it updated (e.g. via [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)). Some CodeQL Action features are enabled by server-side flags that may be removed over time, which can cause old versions to lose functionality.
+```yaml
+- uses: github/codeql-action/init@v1
+  with:
+    queries: +<local-or-remote-query>,<another-query>
+```
 
 ## Troubleshooting
 
-Read about [troubleshooting code scanning](https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning).
-
-## Contributing
-
-This project welcomes contributions. See [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to build, install, and contribute.
+Read about [troubleshooting code scanning](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning).

action.yml

@@ -1,11 +0,0 @@
-name: 'CodeQL: Stub'
-description: "Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead."
-author: 'GitHub'
-runs:
-  using: 'composite'
-  steps:
-    - name: 'Stub'
-      run: |
-        echo 'This is a stub. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.'
-        exit 1
-      shell: bash

analyze/action.yml

@@ -1,99 +1,36 @@
-name: "CodeQL: Finish"
-description: "Finalize CodeQL database"
-author: "GitHub"
+name: 'CodeQL: Finish'
+description: 'Finalize CodeQL database'
+author: 'GitHub'
 inputs:
   check_name:
     description: The name of the check run to add text to.
     required: false
   output:
-    description: The path of the directory in which to save the SARIF results from the CodeQL CLI.
+    description: The path of the directory in which to save the SARIF results
     required: false
-    default: "../results"
+    default: '../results'
   upload:
-    description: >-
-      Upload the SARIF file to Code Scanning.
-      Defaults to 'always' which uploads the SARIF file to Code Scanning for successful and failed runs.
-      'failure-only' only uploads debugging information to Code Scanning if the workflow run fails, for users post-processing the SARIF file before uploading it to Code Scanning.
-      'never' avoids uploading the SARIF file to Code Scanning, even if the code scanning run fails. This is not recommended for external users since it complicates debugging.
-    required: false
-    # If changing this, make sure to update workflow.ts accordingly.
-    default: "always"
-  cleanup-level:
-    description: >-
-      DEPRECATED. This option is ignored since, for performance reasons, the CodeQL Action automatically
-      manages cleanup of intermediate results.
+    description: Upload the SARIF file
     required: false
+    default: "true"
   ram:
-    description: >-
-      The amount of memory in MB that can be used by CodeQL for database finalization and query execution.
-      By default, this action will use the same amount of memory as previously set in the "init" action.
-      If the "init" action also does not have an explicit "ram" input, this action will use most of the
-      memory available in the system (which for GitHub-hosted runners is 6GB for Linux, 5.5GB for Windows,
-      and 13GB for macOS).
+    description: Override the amount of memory in MB to be used by CodeQL. By default, almost all the memory of the machine is used.
     required: false
   add-snippets:
-    description: Does not have any effect.
-    required: false
-    deprecationMessage: >-
-      The input "add-snippets" has been removed and no longer has any effect.
-  skip-queries:
-    description: If this option is set, the CodeQL database will be built but no queries will be run on it. Thus, no results will be produced.
+    description: Specify whether or not to add code snippets to the output sarif file.
     required: false
     default: "false"
   threads:
-    description: >-
-      The number of threads that can be used by CodeQL for database finalization and query execution.
-      By default, this action will use the same number of threads as previously set in the "init" action.
-      If the "init" action also does not have an explicit "threads" input, this action will use all the
-      hardware threads available in the system (which for GitHub-hosted runners is 2 for Linux and Windows
-      and 3 for macOS).
+    description: The number of threads to be used by CodeQL.
     required: false
   checkout_path:
-    description: "The path at which the analyzed repository was checked out. Used to relativize any absolute paths in the uploaded SARIF file."
+    description: "The path at which the analyzed repository was checked out. Used to relativeize any absolute paths in the uploaded SARIF file."
     required: false
-    # If changing this, make sure to update workflow.ts accordingly.
     default: ${{ github.workspace }}
-  ref:
-    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks. Expected format: refs/heads/<branch name>, refs/tags/<tag>, refs/pull/<number>/merge, or refs/pull/<number>/head."
-    required: false
-  sha:
-    description: "The sha of the HEAD of the ref where results will be uploaded. If not provided, the Action will use the GITHUB_SHA environment variable. If provided, the ref input must be provided as well. This input is ignored for pull requests from forks."
-    required: false
-  category:
-    description: String used by Code Scanning for matching the analyses
-    required: false
-  upload-database:
-    description: Whether to upload the resulting CodeQL database
-    required: false
-    default: "true"
-  post-processed-sarif-path:
-    description: >-
-      Before uploading the SARIF files produced by the CodeQL CLI, the CodeQL Action may perform some post-processing
-      on them. Ordinarily, these post-processed SARIF files are not saved to disk. However, if a path is provided as an
-      argument for this input, they are written to the specified directory.
-    required: false
-  wait-for-processing:
-    description: If true, the Action will wait for the uploaded SARIF to be processed before completing.
-    required: true
-    default: "true"
   token:
-    description: "GitHub token to use for authenticating with this instance of GitHub. The token must be the built-in GitHub Actions token, and the workflow must have the `security-events: write` permission. Most of the time it is advisable to avoid specifying this input so that the workflow falls back to using the default value."
-    required: false
     default: ${{ github.token }}
   matrix:
     default: ${{ toJson(matrix) }}
-  expect-error:
-    description: "[Internal] It is an error to use this input outside of integration testing of the codeql-action."
-    required: false
-    default: "false"
-outputs:
-  db-locations:
-    description: A map from language to absolute path for each database created by CodeQL.
-  sarif-output:
-    description: Absolute, local path to the directory containing the generated SARIF file.
-  sarif-id:
-    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
-  main: "../lib/analyze-entry.js"
-  post: "../lib/analyze-post-entry.js"
+  using: 'node12'
+  main: '../lib/analyze-action.js'

autobuild/action.yml

@@ -1,19 +1,11 @@
 name: 'CodeQL: Autobuild'
-description: 'Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead.'
+description: 'Attempt to automatically build code'
 author: 'GitHub'
 inputs:
   token:
-    description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission."
-    required: false
     default: ${{ github.token }}
   matrix:
     default: ${{ toJson(matrix) }}
-  working-directory:
-    description: >-
-      Run the autobuilder using this path (relative to $GITHUB_WORKSPACE) as
-      working directory. If this input is not set, the autobuilder runs with
-      $GITHUB_WORKSPACE as its working directory.
-    required: false
 runs:
-  using: node24
-  main: '../lib/autobuild-entry.js'
+  using: 'node12'
+  main: '../lib/autobuild-action.js'

ava.config.mjs

@@ -1,9 +0,0 @@
-export default {
-  typescript: {
-    rewritePaths: {
-      "src/": "build/",
-    },
-    compile: false,
-  },
-  require: ["./ava.setup.mjs"],
-};

ava.setup.mjs

@@ -1,3 +0,0 @@
-import pkg from "./package.json" with { type: "json" };
-
-globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;

build.mjs

@@ -1,222 +0,0 @@
-import { copyFile, readFile, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import * as esbuild from "esbuild";
-import { globSync } from "glob";
-
-import pkg from "./package.json" with { type: "json" };
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const SRC_DIR = join(__dirname, "src");
-const OUT_DIR = join(__dirname, "lib");
-
-/**
- * Clean the output directory before building.
- *
- * @type {esbuild.Plugin}
- */
-const cleanPlugin = {
-  name: "clean",
-  setup(build) {
-    build.onStart(async () => {
-      await rm(OUT_DIR, { recursive: true, force: true });
-    });
-  },
-};
-
-/**
- * Copy defaults.json to the output directory since other projects depend on it.
- *
- * @type {esbuild.Plugin}
- */
-const copyDefaultsPlugin = {
-  name: "copy-defaults",
-  setup(build) {
-    build.onEnd(async () => {
-      await rm(join(OUT_DIR, "defaults.json"), {
-        force: true,
-      });
-      await copyFile(
-        join(SRC_DIR, "defaults.json"),
-        join(OUT_DIR, "defaults.json"),
-      );
-    });
-  },
-};
-
-/**
- * Log when the build ends.
- *
- * @type {esbuild.Plugin}
- */
-const onEndPlugin = {
-  name: "on-end",
-  setup(build) {
-    build.onEnd((result) => {
-      // eslint-disable-next-line no-console
-      console.log(`Build ended with ${result.errors.length} errors`);
-    });
-  },
-};
-
-/** The name of the virtual `entry-points` module. */
-const SHARED_ENTRYPOINT = "entry-points";
-
-/** The property name under which `upload-lib`'s namespace is exposed in `entry-points`. */
-const UPLOAD_LIB_EXPORT = "uploadLib";
-
-/** The relative source path of the `upload-lib` module that we re-export from `entry-points`. */
-const UPLOAD_LIB_SRC = "./src/upload-lib";
-
-/**
- * This plugin finds all source files that contain Action entry points. It then generates the
- * virtual `entry-points` module which imports all identified files, and re-exports their
- * `runWrapper` functions with suitable aliases.
- *
- * The virtual module additionally re-exports `upload-lib` under the `uploadLib` namespace so that
- * external consumers can access it via the small `lib/upload-lib.js` stub emitted below.
- * 
- * A tiny stub file is emitted for each Action entrypoint, and one for `upload-lib`. Each stub
- * imports the shared bundle and calls/re-exports from the respective entry point.
- *
- * @type {esbuild.Plugin}
- */
-const entryPointsPlugin = {
-  name: "entry-points",
-  setup(build) {
-    const namespace = "actions";
-    const actions = [];
-
-    const toPascal = (s) =>
-      s.replace(/(^|-)([a-z0-9])/gi, (_, __, c) => c.toUpperCase());
-
-    // Find the source files containing Action entry points.
-    build.onStart(() => {
-      const actionFiles = globSync("src/*-action{,-post}.ts");
-      for (const actionFile of actionFiles) {
-        const match = basename(actionFile).match(/(.*)-action(-post)?/);
-
-        if (match.length < 2) {
-          throw new Error(`'${actionFile}' didn't match expected pattern.`);
-        }
-
-        const actionName = match[1];
-        const isPost = match[2] !== undefined;
-
-        actions.push({
-          path: actionFile,
-          name: actionName,
-          isPost,
-          pascalCaseName: `${toPascal(actionName)}${isPost ? "Post" : ""}Action`,
-        });
-      }
-    });
-
-    // Resolve the virtual `entry-points` file and set the corresponding namespace.
-    // Ideally, we'd `RegExp.escape` the entrypoint here, but that API isn't supported in Node 20.
-    // Since we're dealing with a hardcoded string, this isn't too much of a problem.
-    build.onResolve({ filter: new RegExp(`^${SHARED_ENTRYPOINT}$`) }, () => {
-      return { path: SHARED_ENTRYPOINT, namespace };
-    });
-
-    // Generate the virtual `entry-points` file based on the Actions we discovered.
-    // Restrict using the namespace. The path filter does not need to discriminate any further.
-    build.onLoad({ filter: /.*/, namespace }, async () => {
-      const wrapperTemplatePath = "entry-wrapper.js.tpl";
-      const wrapperTemplate = await readFile(
-        join(SRC_DIR, wrapperTemplatePath),
-        "utf-8",
-      );
-
-      const actionsSorted = actions.sort((a, b) =>
-        a.name.localeCompare(b.name),
-      );
-      const imports = actionsSorted
-        .map(
-          (action) =>
-            `import * as ${action.pascalCaseName} from "./src/${basename(action.path)}";`,
-        )
-        .join("\n");
-      const wrappers = actionsSorted
-        .map((action) =>
-          wrapperTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        )
-        .join("\n\n");
-
-      // Also re-export the `upload-lib` namespace so that external consumers can reach it
-      // via the `lib/upload-lib.js` stub without us having to bundle a second copy.
-      const uploadLibReExport = `export * as ${UPLOAD_LIB_EXPORT} from "${UPLOAD_LIB_SRC}";`;
-
-      return {
-        contents: `"use strict";\n${imports}\n\n${uploadLibReExport}\n\n${wrappers}\n`,
-        resolveDir: ".",
-        loader: "ts",
-      };
-    });
-
-    // Emit entry point stubs for each Action using the entry template.
-    build.onEnd(async () => {
-      const makeHeader = (templatePath, sourceFile) =>
-        `// Automatically generated from '${templatePath}' for 'src/${basename(sourceFile)}'.\n\n`;
-
-      // Read the entry point template.
-      const actionTemplatePath = "action-entry.js.tpl";
-      const actionTemplate = await readFile(
-        join(SRC_DIR, actionTemplatePath),
-        "utf-8",
-      );
-
-      // Write entry point stubs for each Action.
-      for (const action of actions) {
-        await writeFile(
-          join(
-            OUT_DIR,
-            `${action.name}${action.isPost ? "-post" : ""}-entry.js`,
-          ),
-          makeHeader(actionTemplatePath, action.path) +
-            actionTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        );
-      }
-
-      // Write a small stub for `upload-lib` that re-exports it from the shared bundle.
-      // External callers (e.g. internal testing environments) `require("./lib/upload-lib")`
-      // and expect the same shape as before, so we expose the namespace as `module.exports`.
-      const uploadLibStubTemplatePath = "upload-lib-stub.js.tpl";
-      const uploadLibStubTemplate = await readFile(
-        join(SRC_DIR, uploadLibStubTemplatePath),
-        "utf-8",
-      );
-      await writeFile(
-        join(OUT_DIR, "upload-lib.js"),
-        makeHeader(uploadLibStubTemplatePath, `${UPLOAD_LIB_SRC}.ts`) +
-          uploadLibStubTemplate.replaceAll(
-            "__UPLOAD_LIB_EXPORT__",
-            UPLOAD_LIB_EXPORT,
-          ),
-      );
-    });
-  },
-};
-
-const context = await esbuild.context({
-  entryPoints: [{ in: SHARED_ENTRYPOINT, out: SHARED_ENTRYPOINT }],
-  bundle: true,
-  format: "cjs",
-  outdir: OUT_DIR,
-  platform: "node",
-  external: ["./entry-points"],
-  plugins: [cleanPlugin, copyDefaultsPlugin, entryPointsPlugin, onEndPlugin],
-  target: ["node20"],
-  define: {
-    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
-  },
-  metafile: true,
-});
-
-const result = await context.rebuild();
-await writeFile(join(__dirname, "meta.json"), JSON.stringify(result.metafile));
-
-await context.dispose();

eslint.config.mjs

@@ -1,212 +0,0 @@
-import { fixupPluginRules } from "@eslint/compat";
-import js from "@eslint/js";
-import github from "eslint-plugin-github";
-import { importX, createNodeResolver } from "eslint-plugin-import-x";
-import { createTypeScriptImportResolver } from "eslint-import-resolver-typescript";
-import noAsyncForeach from "eslint-plugin-no-async-foreach";
-import jsdoc from "eslint-plugin-jsdoc";
-import tseslint from "typescript-eslint";
-import globals from "globals";
-import path from "path";
-import { fileURLToPath } from "url";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const githubFlatConfigs = github.getFlatConfigs();
-
-export default [
-  {
-    ignores: [
-      "**/webpack.config.js",
-      "build/**/*",
-      "lib/**/*",
-      "src/testdata/**/*",
-      "tests/**/*",
-      "build.mjs",
-      "ava.config.mjs",
-      "ava.setup.mjs",
-      "eslint.config.mjs",
-      ".github/**/*",
-    ],
-  },
-  // eslint recommended config
-  js.configs.recommended,
-  // Type-checked rules from typescript-eslint
-  ...tseslint.configs.recommendedTypeChecked,
-  ...tseslint.configs.strict,
-  // eslint-plugin-github recommended config
-  githubFlatConfigs.recommended,
-  // eslint-plugin-github typescript config
-  ...githubFlatConfigs.typescript,
-  // import-x TypeScript settings
-  // This is needed for import-x rules to properly parse TypeScript files.
-  {
-    settings: importX.flatConfigs.typescript.settings,
-  },
-  {
-    plugins: {
-      "import-x": importX,
-      "no-async-foreach": fixupPluginRules(noAsyncForeach),
-      jsdoc: jsdoc,
-    },
-
-    languageOptions: {
-      ecmaVersion: "latest",
-      sourceType: "module",
-
-      globals: {
-        ...globals.node,
-      },
-
-      parserOptions: {
-        project: "./tsconfig.json",
-      },
-    },
-
-    settings: {
-      "import/resolver": {
-        node: {
-          moduleDirectory: ["node_modules", "src"],
-        },
-
-        typescript: {},
-      },
-      "import/ignore": [
-        "sinon",
-        "uuid",
-        "@octokit/plugin-retry",
-        "del",
-        "get-folder-size",
-      ],
-      "import-x/resolver-next": [
-        createTypeScriptImportResolver(),
-        createNodeResolver({
-          extensions: [".ts", ".js", ".json"],
-        }),
-      ],
-    },
-
-    rules: {
-      "github/filenames-match-regex": ["error", "^[a-z0-9-]+(\\.test)?$"],
-      "i18n-text/no-en": "off",
-
-      "import/extensions": [
-        "error",
-        {
-          json: {},
-        },
-      ],
-
-      "import/no-amd": "error",
-      "import/no-commonjs": "error",
-      // import/no-cycle does not seem to work with ESLint 9.
-      // Use import-x/no-cycle from eslint-plugin-import-x instead.
-      "import/no-cycle": "off",
-      "import-x/no-cycle": "error",
-      "import/no-dynamic-require": "error",
-
-      "import/no-extraneous-dependencies": [
-        "error",
-        {
-          devDependencies: true,
-        },
-      ],
-
-      "import/no-namespace": "off",
-      "import/no-unresolved": "error",
-      "import/no-webpack-loader-syntax": "error",
-
-      "import/order": [
-        "error",
-        {
-          alphabetize: {
-            order: "asc",
-          },
-
-          "newlines-between": "always",
-        },
-      ],
-
-      "max-len": [
-        "error",
-        {
-          code: 120,
-          ignoreUrls: true,
-          ignoreStrings: true,
-          ignoreTemplateLiterals: true,
-        },
-      ],
-
-      "no-async-foreach/no-async-foreach": "error",
-      "no-sequences": "error",
-      "no-shadow": "off",
-      // This is overly restrictive with unsetting `EnvVar`s
-      "@typescript-eslint/no-dynamic-delete": "off",
-      "@typescript-eslint/no-shadow": "error",
-      "@typescript-eslint/prefer-optional-chain": "error",
-      "one-var": ["error", "never"],
-
-      // Check param names to ensure that we don't have outdated JSDocs.
-      "jsdoc/check-param-names": [
-        "error",
-        {
-          // We don't currently require full JSDoc coverage, so this rule
-          // should not error on missing @param annotations.
-          disableMissingParamChecks: true,
-        },
-      ],
-    },
-  },
-  {
-    files: ["**/*.ts", "**/*.js"],
-
-    rules: {
-      "@typescript-eslint/no-explicit-any": "off",
-      "@typescript-eslint/no-unsafe-assignment": "off",
-      "@typescript-eslint/no-unsafe-enum-comparison": "off",
-      "@typescript-eslint/no-unsafe-member-access": "off",
-      "@typescript-eslint/no-var-requires": "off",
-      "@typescript-eslint/prefer-regexp-exec": "off",
-      "@typescript-eslint/require-await": "off",
-      "@typescript-eslint/restrict-template-expressions": "off",
-      "@typescript-eslint/no-unused-vars": [
-        "error",
-        {
-          args: "all",
-          argsIgnorePattern: "^_",
-        },
-      ],
-      "func-style": "off",
-    },
-  },
-  {
-    files: ["pr-checks/**/*.ts"],
-
-    languageOptions: {
-      parserOptions: {
-        // Use the correct `tsconfig.json` for `pr-checks`.
-        project: "./pr-checks/tsconfig.json",
-      },
-    },
-
-    rules: {
-      // The scripts in `pr-checks` are expected to output to the console.
-      "no-console": "off",
-
-      "import/no-extraneous-dependencies": [
-        "error",
-        { packageDir: [__dirname, path.resolve(__dirname, "pr-checks")] },
-      ],
-
-      "@typescript-eslint/no-floating-promises": [
-        "error",
-        {
-          allowForKnownSafeCalls: [
-            // Avoid needing explicit `void` in front of `describe` calls in test files.
-            { from: "package", name: ["describe"], package: "node:test" },
-          ],
-        },
-      ],
-    },
-  },
-];

init/action.yml

@@ -1,182 +1,24 @@
 name: 'CodeQL: Init'
-description: 'Set up CodeQL'
+description: 'Setup the CodeQL tracer'
 author: 'GitHub'
 inputs:
   tools:
-    description: >-
-      By default, the Action will use the recommended version of the CodeQL
-      Bundle to analyze your project. You can override this choice using this
-      input. One of:
-
-      - A local path to a CodeQL Bundle tarball, or
-      - The URL of a CodeQL Bundle tarball GitHub release asset, or
-      - A special value `linked` which uses the version of the CodeQL tools
-        that the Action has been bundled with.
-      - A special value `nightly` which uses the latest nightly version of the
-        CodeQL tools. Note that this is unstable and not recommended for
-        production use.
-
-      If not specified, the Action will check in several places until it finds
-      the CodeQL tools.
+    description: URL of CodeQL tools
     required: false
+    # If not specified the Action will check in several places until it finds the CodeQL tools.
   languages:
-    description: >-
-      A comma-separated list of CodeQL languages to analyze.
-
-      Due to the performance benefit of parallelizing builds, we recommend specifying languages to
-      analyze using a matrix and providing `\$\{{ matrix.language }}` as this input.
-
-      For more information, see
-      https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#changing-the-languages-that-are-analyzed.
+    description: The languages to be analysed
     required: false
-  build-mode:
-    description: >-
-      The build mode that will be used to analyze the language. This input is only available when
-      analyzing a single CodeQL language per job, for example using a matrix.
-
-      Available build modes will differ based on the language being analyzed. One of:
-
-      - `none`:      The database will be created without building the source code.
-                     Available for all interpreted languages and some compiled languages.
-      - `autobuild`: The database will be created by attempting to automatically build the source
-                     code. Available for all compiled languages.
-      - `manual`:   The database will be created by building the source code using a manually
-                     specified build command. To use this build mode, specify manual build steps in
-                     your workflow between the `init` and `analyze` steps. Available for all
-                     compiled languages.
-    required: false
-  analysis-kinds:
-    description: >-
-      [Internal] A comma-separated list of analysis kinds to enable. This input is intended for
-      internal-use only at this time and the behaviour is subject to changes. Some features may
-      not be available depending on which analysis kinds are enabled.
-
-      Available options are:
-
-      - `code-scanning`: The default, security-focused analysis.
-      - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
-                        with `code-scanning`.
-    default: 'code-scanning'
-    required: true
   token:
-    description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
     default: ${{ github.token }}
-    required: false
-  registries:
-    description: |
-      Use this input only when you need to download CodeQL packages from another instance of GitHub. If you only need to download packages from this GitHub instance, use the token input instead.
-
-      A YAML string that defines the list of GitHub container registries to use for downloading packs. The string is in the following form (the | is required on the first line):
-
-      registries: |
-          - url: https://containers.GHEHOSTNAME1/v2/
-            packages:
-              - my-company/*
-              - my-company2/*
-            token: \$\{{ secrets.GHEHOSTNAME1_TOKEN }}
-
-          - url: https://ghcr.io/v2/
-            packages: */*
-            token: \$\{{ secrets.GHCR_TOKEN }}
-
-      The `url` property contains the URL to the container registry you want to connect to.
-
-      The `packages` property contains a single glob string or a list of glob strings, specifying which packages should be retrieved from this particular container registry. Order is important. Earlier entries will match before later entries.
-
-      The `token` property contains a connection token for this registry.    required: false
   matrix:
     default: ${{ toJson(matrix) }}
-    required: false
   config-file:
     description: Path of the config file to use
     required: false
-  db-location:
-    description: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
-    required: false
-  config:
-    description: Configuration passed as a YAML string in the same format as the config-file input. This takes precedence over the config-file input.
-    required: false
   queries:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
-  quality-queries:
-    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
-    required: false
-  packs:
-    description: >-
-      Comma-separated list of packs to run. Reference a pack in the format `scope/name[@version]`. If `version` is not
-      specified, then the latest version of the pack is used. By default, this overrides the same setting in a
-      configuration file; prefix with "+" to use both sets of packs.
-
-      This input is only available in single-language analyses. To use packs in multi-language
-      analyses, you must specify packs in the codeql-config.yml file.
-    required: false
-  external-repository-token:
-    description: A token for fetching external config files and queries if they reside in a private repository in the same GitHub instance that is running this action.
-    required: false
-  setup-python-dependencies:
-    description: DEPRECATED. This option is ignored since CodeQL Action no longer installs Python dependencies as of versions 3.25.0 and 2.25.0.
-    required: false
-  source-root:
-    description: Path of the root source code directory, relative to $GITHUB_WORKSPACE.
-    required: false
-  ram:
-    description: >-
-      The amount of memory in MB that can be used by CodeQL extractors.
-      By default, CodeQL extractors will use most of the memory available in the system
-      (which for GitHub-hosted runners is 6GB for Linux, 5.5GB for Windows, and 13GB for macOS).
-      This input also sets the amount of memory that can later be used by the "analyze" action.
-    required: false
-  threads:
-    description: >-
-      The number of threads that can be used by CodeQL extractors.
-      By default, CodeQL extractors will use all the hardware threads available in the system
-      (which for GitHub-hosted runners is 2 for Linux and Windows and 3 for macOS).
-      This input also sets the number of threads that can later be used by the "analyze" action.
-    required: false
-  debug:
-    description: >-
-      Enable debugging mode.
-      This will result in more output being produced which may be useful when debugging certain issues.
-      Debugging mode is enabled automatically when step debug logging is turned on.
-    required: false
-    default: 'false'
-  debug-artifact-name:
-    description: >-
-      The name of the artifact to store debugging information in.
-      This is only used when debug mode is enabled.
-    required: false
-  debug-database-name:
-    description: >-
-      The name of the database uploaded to the debugging artifact.
-      This is only used when debug mode is enabled.
-    required: false
-  trap-caching:
-    description: >-
-      Explicitly enable or disable TRAP caching rather than respecting the feature flag for it.
-    required: false
-  dependency-caching:
-    description: >-
-      Explicitly enable or disable caching of project build dependencies.
-    required: false
-  check-run-id:
-    description: >-
-      [Internal] The ID of the check run, as provided by the Actions runtime environment. Do not set this value manually.
-    default: ${{ job.check_run_id }}
-    required: false
-  job-status:
-    description: >-
-      [Internal] The status of the job, as provided by the Actions runtime environment. This is how the
-      post step learns whether the job as a whole succeeded, failed, or was cancelled. Do not set this
-      value manually.
-    default: ${{ job.status }}
-    required: false
-outputs:
-  codeql-path:
-    description: The path of the CodeQL binary used for analysis
-  codeql-version:
-    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
-  main: '../lib/init-entry.js'
-  post: '../lib/init-post-entry.js'
+  using: 'node12'
+  main: '../lib/init-action.js'

justfile

@@ -1,30 +0,0 @@
-# Perform all working copy cleanup operations
-all: lint sync
-
-# Lint source typescript
-lint:
-    npm run lint-fix
-
-# Sync generated files (javascript and PR checks)
-sync: build update-pr-checks
-
-# Perform all necessary steps to update the PR checks
-update-pr-checks:
-    pr-checks/sync.sh
-
-# Transpile typescript code into javascript
-build:
-    npm run build
-
-# Build then run all the tests
-test: build
-    npm run test
-
-# Run the tests for a single file
-test_file filename: build
-    npm run ava {{filename}}
-
-[doc("Refresh the .js build artefacts in the lib directory")]
-[confirm]
-refresh-lib:
-    rm -rf lib && npm run build

lib/actions-util.js

@@ -0,0 +1,266 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const api = __importStar(require("./api-client"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util_1 = require("./util");
+/**
+ * Wrapper around core.getInput for inputs that always have a value.
+ * Also see getOptionalInput.
+ *
+ * This allows us to get stronger type checking of required/optional inputs
+ * and make behaviour more consistent between actions and the runner.
+ */
+function getRequiredInput(name) {
+    return core.getInput(name, { required: true });
+}
+exports.getRequiredInput = getRequiredInput;
+/**
+ * Wrapper around core.getInput that converts empty inputs to undefined.
+ * Also see getRequiredInput.
+ *
+ * This allows us to get stronger type checking of required/optional inputs
+ * and make behaviour more consistent between actions and the runner.
+ */
+function getOptionalInput(name) {
+    const value = core.getInput(name);
+    return value.length > 0 ? value : undefined;
+}
+exports.getOptionalInput = getOptionalInput;
+/**
+ * Get an environment parameter, but throw an error if it is not set.
+ */
+function getRequiredEnvParam(paramName) {
+    const value = process.env[paramName];
+    if (value === undefined || value.length === 0) {
+        throw new Error(`${paramName} environment variable must be set`);
+    }
+    core.debug(`${paramName}=${value}`);
+    return value;
+}
+exports.getRequiredEnvParam = getRequiredEnvParam;
+/**
+ * Ensures all required environment variables are set in the context of a local run.
+ */
+function prepareLocalRunEnvironment() {
+    if (!util_1.isLocalRun()) {
+        return;
+    }
+    core.debug("Action is running locally.");
+    if (!process.env.GITHUB_JOB) {
+        core.exportVariable("GITHUB_JOB", "UNKNOWN-JOB");
+    }
+}
+exports.prepareLocalRunEnvironment = prepareLocalRunEnvironment;
+/**
+ * Gets the SHA of the commit that is currently checked out.
+ */
+async function getCommitOid() {
+    // Try to use git to get the current commit SHA. If that fails then
+    // log but otherwise silently fall back to using the SHA from the environment.
+    // The only time these two values will differ is during analysis of a PR when
+    // the workflow has changed the current commit to the head commit instead of
+    // the merge commit, which must mean that git is available.
+    // Even if this does go wrong, it's not a huge problem for the alerts to
+    // reported on the merge commit.
+    try {
+        let commitOid = "";
+        await new toolrunnner.ToolRunner("git", ["rev-parse", "HEAD"], {
+            silent: true,
+            listeners: {
+                stdout: (data) => {
+                    commitOid += data.toString();
+                },
+                stderr: (data) => {
+                    process.stderr.write(data);
+                },
+            },
+        }).exec();
+        return commitOid.trim();
+    }
+    catch (e) {
+        core.info(`Failed to call git to get current commit. Continuing with data from environment: ${e}`);
+        return getRequiredEnvParam("GITHUB_SHA");
+    }
+}
+exports.getCommitOid = getCommitOid;
+/**
+ * Get the path of the currently executing workflow.
+ */
+async function getWorkflowPath() {
+    const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
+    const owner = repo_nwo[0];
+    const repo = repo_nwo[1];
+    const run_id = Number(getRequiredEnvParam("GITHUB_RUN_ID"));
+    const apiClient = api.getActionsApiClient();
+    const runsResponse = await apiClient.request("GET /repos/:owner/:repo/actions/runs/:run_id", {
+        owner,
+        repo,
+        run_id,
+    });
+    const workflowUrl = runsResponse.data.workflow_url;
+    const workflowResponse = await apiClient.request(`GET ${workflowUrl}`);
+    return workflowResponse.data.path;
+}
+/**
+ * Get the workflow run ID.
+ */
+function getWorkflowRunID() {
+    const workflowRunID = parseInt(getRequiredEnvParam("GITHUB_RUN_ID"), 10);
+    if (Number.isNaN(workflowRunID)) {
+        throw new Error("GITHUB_RUN_ID must define a non NaN workflow run ID");
+    }
+    return workflowRunID;
+}
+exports.getWorkflowRunID = getWorkflowRunID;
+/**
+ * Get the analysis key paramter for the current job.
+ *
+ * This will combine the workflow path and current job name.
+ * Computing this the first time requires making requests to
+ * the github API, but after that the result will be cached.
+ */
+async function getAnalysisKey() {
+    const analysisKeyEnvVar = "CODEQL_ACTION_ANALYSIS_KEY";
+    let analysisKey = process.env[analysisKeyEnvVar];
+    if (analysisKey !== undefined) {
+        return analysisKey;
+    }
+    const workflowPath = await getWorkflowPath();
+    const jobName = getRequiredEnvParam("GITHUB_JOB");
+    analysisKey = `${workflowPath}:${jobName}`;
+    core.exportVariable(analysisKeyEnvVar, analysisKey);
+    return analysisKey;
+}
+exports.getAnalysisKey = getAnalysisKey;
+/**
+ * Get the ref currently being analyzed.
+ */
+function getRef() {
+    // Will be in the form "refs/heads/master" on a push event
+    // or in the form "refs/pull/N/merge" on a pull_request event
+    const ref = getRequiredEnvParam("GITHUB_REF");
+    // For pull request refs we want to convert from the 'merge' ref
+    // to the 'head' ref, as that is what we want to analyse.
+    // There should have been some code earlier in the workflow to do
+    // the checkout, but we have no way of verifying that here.
+    const pull_ref_regex = /refs\/pull\/(\d+)\/merge/;
+    if (pull_ref_regex.test(ref)) {
+        return ref.replace(pull_ref_regex, "refs/pull/$1/head");
+    }
+    else {
+        return ref;
+    }
+}
+exports.getRef = getRef;
+/**
+ * Compose a StatusReport.
+ *
+ * @param actionName The name of the action, e.g. 'init', 'finish', 'upload-sarif'
+ * @param status The status. Must be 'success', 'failure', or 'starting'
+ * @param startedAt The time this action started executing.
+ * @param cause  Cause of failure (only supply if status is 'failure')
+ * @param exception Exception (only supply if status is 'failure')
+ */
+async function createStatusReportBase(actionName, status, actionStartedAt, cause, exception) {
+    const commitOid = process.env["GITHUB_SHA"] || "";
+    const ref = getRef();
+    const workflowRunIDStr = process.env["GITHUB_RUN_ID"];
+    let workflowRunID = -1;
+    if (workflowRunIDStr) {
+        workflowRunID = parseInt(workflowRunIDStr, 10);
+    }
+    const workflowName = process.env["GITHUB_WORKFLOW"] || "";
+    const jobName = process.env["GITHUB_JOB"] || "";
+    const analysis_key = await getAnalysisKey();
+    let workflowStartedAt = process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT];
+    if (workflowStartedAt === undefined) {
+        workflowStartedAt = actionStartedAt.toISOString();
+        core.exportVariable(sharedEnv.CODEQL_WORKFLOW_STARTED_AT, workflowStartedAt);
+    }
+    const statusReport = {
+        workflow_run_id: workflowRunID,
+        workflow_name: workflowName,
+        job_name: jobName,
+        analysis_key,
+        commit_oid: commitOid,
+        ref,
+        action_name: actionName,
+        action_oid: "unknown",
+        started_at: workflowStartedAt,
+        action_started_at: actionStartedAt.toISOString(),
+        status,
+    };
+    // Add optional parameters
+    if (cause) {
+        statusReport.cause = cause;
+    }
+    if (exception) {
+        statusReport.exception = exception;
+    }
+    if (status === "success" || status === "failure" || status === "aborted") {
+        statusReport.completed_at = new Date().toISOString();
+    }
+    const matrix = getRequiredInput("matrix");
+    if (matrix) {
+        statusReport.matrix_vars = matrix;
+    }
+    return statusReport;
+}
+exports.createStatusReportBase = createStatusReportBase;
+/**
+ * Send a status report to the code_scanning/analysis/status endpoint.
+ *
+ * Optionally checks the response from the API endpoint and sets the action
+ * as failed if the status report failed. This is only expected to be used
+ * when sending a 'starting' report.
+ *
+ * Returns whether sending the status report was successful of not.
+ */
+async function sendStatusReport(statusReport, ignoreFailures) {
+    if (getRequiredEnvParam("GITHUB_SERVER_URL") !== util_1.GITHUB_DOTCOM_URL) {
+        core.debug("Not sending status report to GitHub Enterprise");
+        return true;
+    }
+    if (util_1.isLocalRun()) {
+        core.debug("Not sending status report because this is a local run");
+        return true;
+    }
+    const statusReportJSON = JSON.stringify(statusReport);
+    core.debug(`Sending status report: ${statusReportJSON}`);
+    const nwo = getRequiredEnvParam("GITHUB_REPOSITORY");
+    const [owner, repo] = nwo.split("/");
+    const client = api.getActionsApiClient();
+    const statusResponse = await client.request("PUT /repos/:owner/:repo/code-scanning/analysis/status", {
+        owner,
+        repo,
+        data: statusReportJSON,
+    });
+    if (!ignoreFailures) {
+        // If the status report request fails with a 403 or a 404, then this is a deliberate
+        // message from the endpoint that the SARIF upload can be expected to fail too,
+        // so the action should fail to avoid wasting actions minutes.
+        //
+        // Other failure responses (or lack thereof) could be transitory and should not
+        // cause the action to fail.
+        if (statusResponse.status === 403) {
+            core.setFailed("The repo on which this action is running is not opted-in to CodeQL code scanning.");
+            return false;
+        }
+        if (statusResponse.status === 404) {
+            core.setFailed("Not authorized to used the CodeQL code scanning feature on this repo.");
+            return false;
+        }
+    }
+    return true;
+}
+exports.sendStatusReport = sendStatusReport;
+//# sourceMappingURL=actions-util.js.map

lib/actions-util.test.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const actions_util_1 = require("./actions-util");
+const testing_utils_1 = require("./testing-utils");
+testing_utils_1.setupTests(ava_1.default);
+ava_1.default("getRef() throws on the empty string", (t) => {
+    process.env["GITHUB_REF"] = "";
+    t.throws(actions_util_1.getRef);
+});
+ava_1.default("prepareEnvironment() when a local run", (t) => {
+    const origLocalRun = process.env.CODEQL_LOCAL_RUN;
+    process.env.CODEQL_LOCAL_RUN = "false";
+    process.env.GITHUB_JOB = "YYY";
+    actions_util_1.prepareLocalRunEnvironment();
+    // unchanged
+    t.deepEqual(process.env.GITHUB_JOB, "YYY");
+    process.env.CODEQL_LOCAL_RUN = "true";
+    actions_util_1.prepareLocalRunEnvironment();
+    // unchanged
+    t.deepEqual(process.env.GITHUB_JOB, "YYY");
+    process.env.GITHUB_JOB = "";
+    actions_util_1.prepareLocalRunEnvironment();
+    // updated
+    t.deepEqual(process.env.GITHUB_JOB, "UNKNOWN-JOB");
+    process.env.CODEQL_LOCAL_RUN = origLocalRun;
+});
+//# sourceMappingURL=actions-util.test.js.map

lib/actions-util.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-util.test.js","sourceRoot":"","sources":["../src/actions-util.test.ts"],"names":[],"mappings":";;;;;AAAA,8CAAuB;AAEvB,iDAAoE;AACpE,mDAA6C;AAE7C,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,EAAE;IAChD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,qBAAM,CAAC,CAAC;AACnB,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAElD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC;IAE/B,yCAA0B,EAAE,CAAC;IAE7B,YAAY;IACZ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE3C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAEtC,yCAA0B,EAAE,CAAC;IAE7B,YAAY;IACZ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE3C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IAE5B,yCAA0B,EAAE,CAAC;IAE7B,UAAU;IACV,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,YAAY,CAAC;AAC9C,CAAC,CAAC,CAAC"}

lib/analysis-paths.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function isInterpretedLanguage(language) {
+    return language === "javascript" || language === "python";
+}
+// Matches a string containing only characters that are legal to include in paths on windows.
+exports.legalWindowsPathCharactersRegex = /^[^<>:"\|?]*$/;
+// Builds an environment variable suitable for LGTM_INDEX_INCLUDE or LGTM_INDEX_EXCLUDE
+function buildIncludeExcludeEnvVar(paths) {
+    // Ignore anything containing a *
+    paths = paths.filter((p) => p.indexOf("*") === -1);
+    // Some characters are illegal in path names in windows
+    if (process.platform === "win32") {
+        paths = paths.filter((p) => p.match(exports.legalWindowsPathCharactersRegex));
+    }
+    return paths.join("\n");
+}
+function printPathFiltersWarning(config, logger) {
+    // Index include/exclude/filters only work in javascript and python.
+    // If any other languages are detected/configured then show a warning.
+    if ((config.paths.length !== 0 || config.pathsIgnore.length !== 0) &&
+        !config.languages.every(isInterpretedLanguage)) {
+        logger.warning('The "paths"/"paths-ignore" fields of the config only have effect for Javascript and Python');
+    }
+}
+exports.printPathFiltersWarning = printPathFiltersWarning;
+function includeAndExcludeAnalysisPaths(config) {
+    // The 'LGTM_INDEX_INCLUDE' and 'LGTM_INDEX_EXCLUDE' environment variables
+    // control which files/directories are traversed when scanning.
+    // This allows including files that otherwise would not be scanned, or
+    // excluding and not traversing entire file subtrees.
+    // It does not understand globs or double-globs because that would require it to
+    // traverse the entire file tree to determine which files are matched.
+    // Any paths containing "*" are not included in these.
+    if (config.paths.length !== 0) {
+        process.env["LGTM_INDEX_INCLUDE"] = buildIncludeExcludeEnvVar(config.paths);
+    }
+    if (config.pathsIgnore.length !== 0) {
+        process.env["LGTM_INDEX_EXCLUDE"] = buildIncludeExcludeEnvVar(config.pathsIgnore);
+    }
+    // The 'LGTM_INDEX_FILTERS' environment variable controls which files are
+    // extracted or ignored. It does not control which directories are traversed.
+    // This does understand the glob and double-glob syntax.
+    const filters = [];
+    filters.push(...config.paths.map((p) => `include:${p}`));
+    filters.push(...config.pathsIgnore.map((p) => `exclude:${p}`));
+    if (filters.length !== 0) {
+        process.env["LGTM_INDEX_FILTERS"] = filters.join("\n");
+    }
+}
+exports.includeAndExcludeAnalysisPaths = includeAndExcludeAnalysisPaths;
+//# sourceMappingURL=analysis-paths.js.map

lib/analysis-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-paths.js","sourceRoot":"","sources":["../src/analysis-paths.ts"],"names":[],"mappings":";;AAGA,SAAS,qBAAqB,CAAC,QAAQ;IACrC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,CAAC;AAC5D,CAAC;AAED,6FAA6F;AAChF,QAAA,+BAA+B,GAAG,eAAe,CAAC;AAE/D,uFAAuF;AACvF,SAAS,yBAAyB,CAAC,KAAe;IAChD,iCAAiC;IACjC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnD,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uCAA+B,CAAC,CAAC,CAAC;KACvE;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,MAAc;IAEd,oEAAoE;IACpE,sEAAsE;IACtE,IACE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;QAC9D,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAC9C;QACA,MAAM,CAAC,OAAO,CACZ,4FAA4F,CAC7F,CAAC;KACH;AACH,CAAC;AAdD,0DAcC;AAED,SAAgB,8BAA8B,CAAC,MAA0B;IACvE,0EAA0E;IAC1E,+DAA+D;IAC/D,sEAAsE;IACtE,qDAAqD;IACrD,gFAAgF;IAChF,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC7E;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;QACnC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,yBAAyB,CAC3D,MAAM,CAAC,WAAW,CACnB,CAAC;KACH;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACxD;AACH,CAAC;AA1BD,wEA0BC"}

lib/analysis-paths.test.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+testing_utils_1.setupTests(ava_1.default);
+ava_1.default("emptyPaths", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const config = {
+            languages: [],
+            queries: {},
+            pathsIgnore: [],
+            paths: [],
+            originalUserInput: {},
+            tempDir: tmpDir,
+            toolCacheDir: tmpDir,
+            codeQLCmd: "",
+        };
+        analysisPaths.includeAndExcludeAnalysisPaths(config);
+        t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);
+        t.is(process.env["LGTM_INDEX_EXCLUDE"], undefined);
+        t.is(process.env["LGTM_INDEX_FILTERS"], undefined);
+    });
+});
+ava_1.default("nonEmptyPaths", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const config = {
+            languages: [],
+            queries: {},
+            paths: ["path1", "path2", "**/path3"],
+            pathsIgnore: ["path4", "path5", "path6/**"],
+            originalUserInput: {},
+            tempDir: tmpDir,
+            toolCacheDir: tmpDir,
+            codeQLCmd: "",
+        };
+        analysisPaths.includeAndExcludeAnalysisPaths(config);
+        t.is(process.env["LGTM_INDEX_INCLUDE"], "path1\npath2");
+        t.is(process.env["LGTM_INDEX_EXCLUDE"], "path4\npath5");
+        t.is(process.env["LGTM_INDEX_FILTERS"], "include:path1\ninclude:path2\ninclude:**/path3\nexclude:path4\nexclude:path5\nexclude:path6/**");
+    });
+});
+//# sourceMappingURL=analysis-paths.test.js.map

lib/analysis-paths.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AAEvB,gEAAkD;AAClD,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3C,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACjC,gGAAgG,CACjG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const actionsUtil = __importStar(require("./actions-util"));
+const analyze_1 = require("./analyze");
+const config_utils_1 = require("./config-utils");
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const util = __importStar(require("./util"));
+async function sendStatusReport(startedAt, stats, error) {
+    var _a, _b, _c;
+    const status = ((_a = stats) === null || _a === void 0 ? void 0 : _a.analyze_failure_language) !== undefined || error !== undefined
+        ? "failure"
+        : "success";
+    const statusReportBase = await actionsUtil.createStatusReportBase("finish", status, startedAt, (_b = error) === null || _b === void 0 ? void 0 : _b.message, (_c = error) === null || _c === void 0 ? void 0 : _c.stack);
+    const statusReport = {
+        ...statusReportBase,
+        ...(stats || {}),
+    };
+    await actionsUtil.sendStatusReport(statusReport);
+}
+async function run() {
+    const startedAt = new Date();
+    let stats = undefined;
+    try {
+        actionsUtil.prepareLocalRunEnvironment();
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("finish", "starting", startedAt), true))) {
+            return;
+        }
+        const logger = logging_1.getActionsLogger();
+        const config = await config_utils_1.getConfig(actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), logger);
+        if (config === undefined) {
+            throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
+        }
+        stats = await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), actionsUtil.getRequiredInput("token"), actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"), actionsUtil.getRequiredInput("upload") === "true", "actions", actionsUtil.getRequiredInput("output"), util.getMemoryFlag(actionsUtil.getOptionalInput("ram")), util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), util.getThreadsFlag(actionsUtil.getOptionalInput("threads"), logger), config, logger);
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        console.log(error);
+        await sendStatusReport(startedAt, stats, error);
+        return;
+    }
+    await sendStatusReport(startedAt, stats);
+}
+run().catch((e) => {
+    core.setFailed(`analyze action failed: ${e}`);
+    console.log(e);
+});
+//# sourceMappingURL=analyze-action.js.map

lib/analyze-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-action.js","sourceRoot":"","sources":["../src/analyze-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAA6D;AAC7D,iDAA2C;AAC3C,uCAA6C;AAC7C,6CAAkD;AAClD,6CAA+B;AAM/B,KAAK,UAAU,gBAAgB,CAC7B,SAAe,EACf,KAAuC,EACvC,KAAa;;IAEb,MAAM,MAAM,GACV,OAAA,KAAK,0CAAE,wBAAwB,MAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,QAAQ,EACR,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAqC,SAAS,CAAC;IACxD,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,QAAQ,EACR,UAAU,EACV,SAAS,CACV,EACD,IAAI,CACL,CAAC,EACF;YACA,OAAO;SACR;QACD,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,wBAAS,CAC5B,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,KAAK,GAAG,MAAM,oBAAU,CACtB,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,WAAW,CAAC,MAAM,EAAE,EACpB,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,MAAM,EACjD,SAAS,EACT,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACvD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,EACrE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EACpE,MAAM,EACN,MAAM,CACP,CAAC;KACH;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO;KACR;IAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}

lib/analyze-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzeAction)();

lib/analyze-post-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzePostAction)();

lib/analyze.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const codeql_1 = require("./codeql");
+const languages_1 = require("./languages");
+const sharedEnv = __importStar(require("./shared-environment"));
+const upload_lib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+async function createdDBForScannedLanguages(config, logger) {
+    // Insert the LGTM_INDEX_X env vars at this point so they are set when
+    // we extract any scanned languages.
+    analysisPaths.includeAndExcludeAnalysisPaths(config);
+    const codeql = codeql_1.getCodeQL(config.codeQLCmd);
+    for (const language of config.languages) {
+        if (languages_1.isScannedLanguage(language)) {
+            logger.startGroup(`Extracting ${language}`);
+            await codeql.extractScannedLanguage(util.getCodeQLDatabasePath(config.tempDir, language), language);
+            logger.endGroup();
+        }
+    }
+}
+async function finalizeDatabaseCreation(config, logger) {
+    await createdDBForScannedLanguages(config, logger);
+    const codeql = codeql_1.getCodeQL(config.codeQLCmd);
+    for (const language of config.languages) {
+        logger.startGroup(`Finalizing ${language}`);
+        await codeql.finalizeDatabase(util.getCodeQLDatabasePath(config.tempDir, language));
+        logger.endGroup();
+    }
+}
+// Runs queries and creates sarif files in the given folder
+async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag, config, logger) {
+    const statusReport = {};
+    for (const language of config.languages) {
+        logger.startGroup(`Analyzing ${language}`);
+        const queries = config.queries[language];
+        if (queries.builtin.length === 0 && queries.custom.length === 0) {
+            throw new Error(`Unable to analyse ${language} as no queries were selected for this language`);
+        }
+        try {
+            for (const type of ["builtin", "custom"]) {
+                if (queries[type].length > 0) {
+                    const startTime = new Date().getTime();
+                    const databasePath = util.getCodeQLDatabasePath(config.tempDir, language);
+                    // Pass the queries to codeql using a file instead of using the command
+                    // line to avoid command line length restrictions, particularly on windows.
+                    const querySuitePath = `${databasePath}-queries-${type}.qls`;
+                    const querySuiteContents = queries[type]
+                        .map((q) => `- query: ${q}`)
+                        .join("\n");
+                    fs.writeFileSync(querySuitePath, querySuiteContents);
+                    logger.debug(`Query suite file for ${language}...\n${querySuiteContents}`);
+                    const sarifFile = path.join(sarifFolder, `${language}-${type}.sarif`);
+                    const codeql = codeql_1.getCodeQL(config.codeQLCmd);
+                    await codeql.databaseAnalyze(databasePath, sarifFile, querySuitePath, memoryFlag, addSnippetsFlag, threadsFlag);
+                    logger.debug(`SARIF results for database ${language} created at "${sarifFile}"`);
+                    logger.endGroup();
+                    // Record the performance
+                    const endTime = new Date().getTime();
+                    statusReport[`analyze_${type}_queries_${language}_duration_ms`] =
+                        endTime - startTime;
+                }
+            }
+        }
+        catch (e) {
+            logger.error(`Error running analysis for ${language}: ${e}`);
+            logger.info(e);
+            statusReport.analyze_failure_language = language;
+            return statusReport;
+        }
+    }
+    return statusReport;
+}
+exports.runQueries = runQueries;
+async function runAnalyze(repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, doUpload, mode, outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger) {
+    // Delete the tracer config env var to avoid tracing ourselves
+    delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+    fs.mkdirSync(outputDir, { recursive: true });
+    logger.info("Finalizing database creation");
+    await finalizeDatabaseCreation(config, logger);
+    logger.info("Analyzing database");
+    const queriesStats = await runQueries(outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger);
+    if (!doUpload) {
+        logger.info("Not uploading results");
+        return { ...queriesStats };
+    }
+    const uploadStats = await upload_lib.upload(outputDir, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, mode, logger);
+    return { ...queriesStats, ...uploadStats };
+}
+exports.runAnalyze = runAnalyze;
+//# sourceMappingURL=analyze.js.map

lib/analyze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,gEAAkD;AAClD,qCAAqC;AAErC,2CAAgD;AAGhD,gEAAkD;AAClD,yDAA2C;AAC3C,6CAA+B;AAmC/B,KAAK,UAAU,4BAA4B,CACzC,MAA0B,EAC1B,MAAc;IAEd,sEAAsE;IACtE,oCAAoC;IACpC,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI,6BAAiB,CAAC,QAAQ,CAAC,EAAE;YAC/B,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,sBAAsB,CACjC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,CACT,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,CAAC;SACnB;KACF;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAA0B,EAC1B,MAAc;IAEd,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,gBAAgB,CAC3B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CACrD,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC;KACnB;AACH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;YAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,gDAAgD,CAC9E,CAAC;SACH;QAED,IAAI;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAC7C,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;oBACF,uEAAuE;oBACvE,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,GAAG,YAAY,YAAY,IAAI,MAAM,CAAC;oBAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;yBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,CACV,wBAAwB,QAAQ,QAAQ,kBAAkB,EAAE,CAC7D,CAAC;oBAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,CAAC,CAAC;oBAEtE,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,MAAM,CAAC,eAAe,CAC1B,YAAY,EACZ,SAAS,EACT,cAAc,EACd,UAAU,EACV,eAAe,EACf,WAAW,CACZ,CAAC;oBAEF,MAAM,CAAC,KAAK,CACV,8BAA8B,QAAQ,gBAAgB,SAAS,GAAG,CACnE,CAAC;oBACF,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAElB,yBAAyB;oBACzB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBACrC,YAAY,CAAC,WAAW,IAAI,YAAY,QAAQ,cAAc,CAAC;wBAC7D,OAAO,GAAG,SAAS,CAAC;iBACvB;aACF;SACF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,YAAY,CAAC,wBAAwB,GAAG,QAAQ,CAAC;YACjD,OAAO,YAAY,CAAC;SACrB;KACF;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAxED,gCAwEC;AAEM,KAAK,UAAU,UAAU,CAC9B,aAA4B,EAC5B,SAAiB,EACjB,GAAW,EACX,WAA+B,EAC/B,YAAgC,EAChC,aAAiC,EACjC,YAAoB,EACpB,WAA+B,EAC/B,UAAkB,EAClB,SAAiB,EACjB,QAAiB,EACjB,IAAe,EACf,SAAiB,EACjB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,8DAA8D;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/C,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;KAC5B;IAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,SAAS,EACT,aAAa,EACb,SAAS,EACT,GAAG,EACH,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,UAAU,EACV,SAAS,EACT,IAAI,EACJ,MAAM,CACP,CAAC;IAEF,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,CAAC;AAC7C,CAAC;AA5DD,gCA4DC"}

lib/analyze.test.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const fs = __importStar(require("fs"));
+const analyze_1 = require("./analyze");
+const codeql_1 = require("./codeql");
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+testing_utils_1.setupTests(ava_1.default);
+// Checks that the duration fields are populated for the correct language
+// and correct case of builtin or custom.
+ava_1.default("status report fields", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        codeql_1.setCodeQL({
+            databaseAnalyze: async () => undefined,
+        });
+        const memoryFlag = "";
+        const addSnippetsFlag = "";
+        const threadsFlag = "";
+        for (const language of Object.values(languages_1.Language)) {
+            const config = {
+                languages: [language],
+                queries: {},
+                pathsIgnore: [],
+                paths: [],
+                originalUserInput: {},
+                tempDir: tmpDir,
+                toolCacheDir: tmpDir,
+                codeQLCmd: "",
+            };
+            fs.mkdirSync(util.getCodeQLDatabasePath(config.tempDir, language), {
+                recursive: true,
+            });
+            config.queries[language] = {
+                builtin: ["foo.ql"],
+                custom: [],
+            };
+            const builtinStatusReport = await analyze_1.runQueries(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logging_1.getRunnerLogger(true));
+            t.deepEqual(Object.keys(builtinStatusReport).length, 1);
+            t.true(`analyze_builtin_queries_${language}_duration_ms` in builtinStatusReport);
+            config.queries[language] = {
+                builtin: [],
+                custom: ["foo.ql"],
+            };
+            const customStatusReport = await analyze_1.runQueries(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logging_1.getRunnerLogger(true));
+            t.deepEqual(Object.keys(customStatusReport).length, 1);
+            t.true(`analyze_custom_queries_${language}_duration_ms` in customStatusReport);
+        }
+    });
+});
+//# sourceMappingURL=analyze.test.js.map

lib/analyze.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.test.js","sourceRoot":"","sources":["../src/analyze.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AACvB,uCAAyB;AAEzB,uCAAuC;AACvC,qCAAqC;AAErC,2CAAuC;AACvC,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,yEAAyE;AACzE,yCAAyC;AACzC,aAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,kBAAS,CAAC;YACR,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACvC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,MAAM,eAAe,GAAG,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAQ,CAAC,EAAE;YAC9C,MAAM,MAAM,GAAW;gBACrB,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,EAAE;gBACT,iBAAiB,EAAE,EAAE;gBACrB,OAAO,EAAE,MAAM;gBACf,YAAY,EAAE,MAAM;gBACpB,SAAS,EAAE,EAAE;aACd,CAAC;YACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACjE,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,EAAE;aACX,CAAC;YACF,MAAM,mBAAmB,GAAG,MAAM,oBAAU,CAC1C,MAAM,EACN,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC,CAAC,IAAI,CACJ,2BAA2B,QAAQ,cAAc,IAAI,mBAAmB,CACzE,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,CAAC,QAAQ,CAAC;aACnB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,oBAAU,CACzC,MAAM,EACN,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CACJ,0BAA0B,QAAQ,cAAc,IAAI,kBAAkB,CACvE,CAAC;SACH;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/api-client.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const github = __importStar(require("@actions/github"));
+const console_log_level_1 = __importDefault(require("console-log-level"));
+const path = __importStar(require("path"));
+const actions_util_1 = require("./actions-util");
+const util_1 = require("./util");
+exports.getApiClient = function (githubAuth, githubUrl, allowLocalRun = false) {
+    if (util_1.isLocalRun() && !allowLocalRun) {
+        throw new Error("Invalid API call in local run");
+    }
+    return new github.GitHub({
+        auth: githubAuth,
+        baseUrl: getApiUrl(githubUrl),
+        userAgent: "CodeQL Action",
+        log: console_log_level_1.default({ level: "debug" }),
+    });
+};
+function getApiUrl(githubUrl) {
+    const url = new URL(githubUrl);
+    // If we detect this is trying to be to github.com
+    // then return with a fixed canonical URL.
+    if (url.hostname === "github.com" || url.hostname === "api.github.com") {
+        return "https://api.github.com";
+    }
+    // Add the /api/v3 API prefix
+    url.pathname = path.join(url.pathname, "api", "v3");
+    return url.toString();
+}
+// Temporary function to aid in the transition to running on and off of github actions.
+// Once all code has been coverted this function should be removed or made canonical
+// and called only from the action entrypoints.
+function getActionsApiClient(allowLocalRun = false) {
+    return exports.getApiClient(actions_util_1.getRequiredInput("token"), actions_util_1.getRequiredEnvParam("GITHUB_SERVER_URL"), allowLocalRun);
+}
+exports.getActionsApiClient = getActionsApiClient;
+//# sourceMappingURL=api-client.js.map

lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wDAA0C;AAC1C,0EAAgD;AAChD,2CAA6B;AAE7B,iDAAuE;AACvE,iCAAoC;AAEvB,QAAA,YAAY,GAAG,UAC1B,UAAkB,EAClB,SAAiB,EACjB,aAAa,GAAG,KAAK;IAErB,IAAI,iBAAU,EAAE,IAAI,CAAC,aAAa,EAAE;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;KAClD;IACD,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;QAC7B,SAAS,EAAE,eAAe;QAC1B,GAAG,EAAE,2BAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,kDAAkD;IAClD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,uFAAuF;AACvF,oFAAoF;AACpF,+CAA+C;AAC/C,SAAgB,mBAAmB,CAAC,aAAa,GAAG,KAAK;IACvD,OAAO,oBAAY,CACjB,+BAAgB,CAAC,OAAO,CAAC,EACzB,kCAAmB,CAAC,mBAAmB,CAAC,EACxC,aAAa,CACd,CAAC;AACJ,CAAC;AAND,kDAMC"}

lib/autobuild-action.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const actionsUtil = __importStar(require("./actions-util"));
+const autobuild_1 = require("./autobuild");
+const config_utils = __importStar(require("./config-utils"));
+const logging_1 = require("./logging");
+async function sendCompletedStatusReport(startedAt, allLanguages, failingLanguage, cause) {
+    var _a, _b;
+    const status = failingLanguage !== undefined || cause !== undefined
+        ? "failure"
+        : "success";
+    const statusReportBase = await actionsUtil.createStatusReportBase("autobuild", status, startedAt, (_a = cause) === null || _a === void 0 ? void 0 : _a.message, (_b = cause) === null || _b === void 0 ? void 0 : _b.stack);
+    const statusReport = {
+        ...statusReportBase,
+        autobuild_languages: allLanguages.join(","),
+        autobuild_failure: failingLanguage,
+    };
+    await actionsUtil.sendStatusReport(statusReport);
+}
+async function run() {
+    const logger = logging_1.getActionsLogger();
+    const startedAt = new Date();
+    let language = undefined;
+    try {
+        actionsUtil.prepareLocalRunEnvironment();
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("autobuild", "starting", startedAt), true))) {
+            return;
+        }
+        const config = await config_utils.getConfig(actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), logger);
+        if (config === undefined) {
+            throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
+        }
+        language = autobuild_1.determineAutobuildLanguage(config, logger);
+        if (language !== undefined) {
+            await autobuild_1.runAutobuild(language, config, logger);
+        }
+    }
+    catch (error) {
+        core.setFailed(`We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps.  ${error.message}`);
+        console.log(error);
+        await sendCompletedStatusReport(startedAt, language ? [language] : [], language, error);
+        return;
+    }
+    await sendCompletedStatusReport(startedAt, language ? [language] : []);
+}
+run().catch((e) => {
+    core.setFailed(`autobuild action failed.  ${e}`);
+    console.log(e);
+});
+//# sourceMappingURL=autobuild-action.js.map

lib/autobuild-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,2CAAuE;AACvE,6DAA+C;AAE/C,uCAA6C;AAS7C,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;;IAEb,MAAM,MAAM,GACV,eAAe,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,WAAW,EACX,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAyB,SAAS,CAAC;IAC/C,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,WAAW,EACX,UAAU,EACV,SAAS,CACV,EACD,IAAI,CACL,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CACzC,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,QAAQ,GAAG,sCAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE;YAC1B,MAAM,wBAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SAC9C;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CACZ,mIAAmI,KAAK,CAAC,OAAO,EAAE,CACnJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,yBAAyB,CAC7B,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAC1B,QAAQ,EACR,KAAK,CACN,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}

lib/autobuild-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/autobuild-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAutobuildAction)();

lib/autobuild.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const codeql_1 = require("./codeql");
+const languages_1 = require("./languages");
+function determineAutobuildLanguage(config, logger) {
+    // Attempt to find a language to autobuild
+    // We want pick the dominant language in the repo from the ones we're able to build
+    // The languages are sorted in order specified by user or by lines of code if we got
+    // them from the GitHub API, so try to build the first language on the list.
+    const autobuildLanguages = config.languages.filter(languages_1.isTracedLanguage);
+    const language = autobuildLanguages[0];
+    if (!language) {
+        logger.info("None of the languages in this project require extra build steps");
+        return undefined;
+    }
+    logger.debug(`Detected dominant traced language: ${language}`);
+    if (autobuildLanguages.length > 1) {
+        logger.warning(`We will only automatically build ${language} code. If you wish to scan ${autobuildLanguages
+            .slice(1)
+            .join(" and ")}, you must replace this call with custom build steps.`);
+    }
+    return language;
+}
+exports.determineAutobuildLanguage = determineAutobuildLanguage;
+async function runAutobuild(language, config, logger) {
+    logger.startGroup(`Attempting to automatically build ${language} code`);
+    const codeQL = codeql_1.getCodeQL(config.codeQLCmd);
+    await codeQL.runAutobuild(language);
+    logger.endGroup();
+}
+exports.runAutobuild = runAutobuild;
+//# sourceMappingURL=autobuild.js.map

lib/autobuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;AAAA,qCAAqC;AAErC,2CAAyD;AAGzD,SAAgB,0BAA0B,CACxC,MAA2B,EAC3B,MAAc;IAEd,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,4BAAgB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;KAClB;IAED,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;IAE/D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;QACjC,MAAM,CAAC,OAAO,CACZ,oCAAoC,QAAQ,8BAA8B,kBAAkB;aACzF,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CAAC,OAAO,CAAC,uDAAuD,CACxE,CAAC;KACH;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AA7BD,gEA6BC;AAEM,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAA2B,EAC3B,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AATD,oCASC"}

lib/codeql.js

@@ -0,0 +1,481 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const http = __importStar(require("@actions/http-client"));
+const toolcache = __importStar(require("@actions/tool-cache"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const semver = __importStar(require("semver"));
+const stream = __importStar(require("stream"));
+const globalutil = __importStar(require("util"));
+const v4_1 = __importDefault(require("uuid/v4"));
+const actions_util_1 = require("./actions-util");
+const api = __importStar(require("./api-client"));
+const defaults = __importStar(require("./defaults.json")); // Referenced from codeql-action-sync-tool!
+const error_matcher_1 = require("./error-matcher");
+const toolrunner_error_catcher_1 = require("./toolrunner-error-catcher");
+const util = __importStar(require("./util"));
+/**
+ * Stores the CodeQL object, and is populated by `setupCodeQL` or `getCodeQL`.
+ * Can be overridden in tests using `setCodeQL`.
+ */
+let cachedCodeQL = undefined;
+const CODEQL_BUNDLE_VERSION = defaults.bundleVersion;
+const CODEQL_BUNDLE_NAME = "codeql-bundle.tar.gz";
+const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
+function getCodeQLActionRepository(mode) {
+    if (mode !== "actions") {
+        return CODEQL_DEFAULT_ACTION_REPOSITORY;
+    }
+    // Actions do not know their own repository name,
+    // so we currently use this hack to find the name based on where our files are.
+    // This can be removed once the change to the runner in https://github.com/actions/runner/pull/585 is deployed.
+    const runnerTemp = actions_util_1.getRequiredEnvParam("RUNNER_TEMP");
+    const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
+    const relativeScriptPath = path.relative(actionsDirectory, __filename);
+    // This handles the case where the Action does not come from an Action repository,
+    // e.g. our integration tests which use the Action code from the current checkout.
+    if (relativeScriptPath.startsWith("..") ||
+        path.isAbsolute(relativeScriptPath)) {
+        return CODEQL_DEFAULT_ACTION_REPOSITORY;
+    }
+    const relativeScriptPathParts = relativeScriptPath.split(path.sep);
+    return `${relativeScriptPathParts[0]}/${relativeScriptPathParts[1]}`;
+}
+async function getCodeQLBundleDownloadURL(bundleNames, githubAuth, githubUrl, mode, logger) {
+    const codeQLActionRepository = getCodeQLActionRepository(mode);
+    const potentialDownloadSources = [
+        // This GitHub instance, and this Action.
+        [githubUrl, codeQLActionRepository],
+        // This GitHub instance, and the canonical Action.
+        [githubUrl, CODEQL_DEFAULT_ACTION_REPOSITORY],
+        // GitHub.com, and the canonical Action.
+        [util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY],
+    ];
+    // We now filter out any duplicates.
+    // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
+    const uniqueDownloadSources = potentialDownloadSources.filter((url, index, self) => index === self.indexOf(url));
+    for (const downloadSource of uniqueDownloadSources) {
+        const [apiURL, repository] = downloadSource;
+        // If we've reached the final case, short-circuit the API check since we know the bundles exist and are public.
+        if (apiURL === util.GITHUB_DOTCOM_URL &&
+            repository === CODEQL_DEFAULT_ACTION_REPOSITORY) {
+            return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${CODEQL_BUNDLE_VERSION}/${bundleNames[0]}`;
+        }
+        const [repositoryOwner, repositoryName] = repository.split("/");
+        try {
+            const release = await api
+                .getApiClient(githubAuth, githubUrl)
+                .repos.getReleaseByTag({
+                owner: repositoryOwner,
+                repo: repositoryName,
+                tag: CODEQL_BUNDLE_VERSION,
+            });
+            // See if any of the bundles appears in the assets list
+            const assetMap = new Map(release.data.assets.map((x) => [x.name, x]));
+            for (const bundleName of bundleNames) {
+                logger.debug(`Looking for ${bundleName}`);
+                const asset = assetMap.get(bundleName);
+                if (asset) {
+                    logger.info(`Found CodeQL bundle in ${downloadSource[1]} on ${downloadSource[0]} with URL ${asset.url}.`);
+                    return asset.url;
+                }
+            }
+        }
+        catch (e) {
+            logger.info(`Looked for CodeQL bundle in ${downloadSource[1]} on ${downloadSource[0]} but got error ${e}.`);
+        }
+    }
+    return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${CODEQL_BUNDLE_VERSION}/${CODEQL_BUNDLE_NAME}`;
+}
+exports.getCodeQLBundleDownloadURL = getCodeQLBundleDownloadURL;
+// We have to download CodeQL manually because the toolcache doesn't support Accept headers.
+// This can be removed once https://github.com/actions/toolkit/pull/530 is merged and released.
+async function toolcacheDownloadTool(url, headers, tempDir, logger) {
+    const client = new http.HttpClient("CodeQL Action");
+    const dest = path.join(tempDir, v4_1.default());
+    const response = await client.get(url, headers);
+    if (response.message.statusCode !== 200) {
+        logger.info(`Failed to download from "${url}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
+        throw new Error(`Unexpected HTTP response: ${response.message.statusCode}`);
+    }
+    const pipeline = globalutil.promisify(stream.pipeline);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    await pipeline(response.message, fs.createWriteStream(dest));
+    return dest;
+}
+async function setupCodeQL(codeqlURL, languages, githubAuth, githubUrl, tempDir, toolsDir, mode, logger) {
+    // Setting these two env vars makes the toolcache code safe to use outside,
+    // of actions but this is obviously not a great thing we're doing and it would
+    // be better to write our own implementation to use outside of actions.
+    process.env["RUNNER_TEMP"] = tempDir;
+    process.env["RUNNER_TOOL_CACHE"] = toolsDir;
+    // The URL identifies the release version. E.g., codeql-20200901 .
+    // The plVersion identifies the platform-language combination of the package
+    // within the release. E.g., `linux64-cpp` in `codeql-linux64-cpp.tar.gz`.
+    // We expect the codeqlUrl (when given) to always point to the main bundle
+    // `codeql-bundle.tar.gz`
+    //
+    // The logic is as follows:
+    //  - Always use the Toolcache if available.
+    //    - If we would like a platform-language package, but have the
+    //      full bundle in the cache, use that.
+    //  - If codeqlURL is specified, use that.
+    //  - If a single language is being analyzed, try to download the platform-language package.
+    //    - If it is not available in the release assets, fallback to the full bundle
+    //  - If multiple languages are being anlyzed, use the full bundle
+    let plVersion = undefined;
+    let platform;
+    if (process.platform === "win32") {
+        platform = "win64";
+    }
+    else if (process.platform === "linux") {
+        platform = "linux64";
+    }
+    else if (process.platform === "darwin") {
+        platform = "osx64";
+    }
+    else {
+        throw new Error(`Unsupported platform: ${process.platform}`);
+    }
+    if (languages.length === 1) {
+        plVersion = `${platform}-${languages[0]}`;
+    }
+    try {
+        const codeqlURLVersion = getCodeQLURLVersion(codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`, logger);
+        let codeqlFolder;
+        logger.debug(`PL Version ${plVersion}`);
+        if (plVersion) {
+            codeqlFolder = toolcache.find("CodeQL", `${codeqlURLVersion}-${plVersion}`);
+            if (codeqlFolder) {
+                logger.debug(`CodeQL found in cache ${codeqlFolder}`);
+            }
+        }
+        if (!codeqlFolder) {
+            codeqlFolder = toolcache.find("CodeQL", codeqlURLVersion);
+            if (codeqlFolder) {
+                logger.debug(`CodeQL found in cache ${codeqlFolder}`);
+            }
+        }
+        if (!codeqlFolder) {
+            const codeqlToolcacheVersion = plVersion
+                ? `${codeqlURLVersion}-${plVersion}`
+                : codeqlURLVersion;
+            logger.debug(`CodeQL not found in cache`);
+            if (!codeqlURL) {
+                // Provide a few options, from smaller to bigger
+                const bundles = [];
+                if (plVersion) {
+                    bundles.push(CODEQL_BUNDLE_NAME.replace("-bundle", `-bundle-${plVersion}`));
+                }
+                bundles.push(CODEQL_BUNDLE_NAME.replace("-bundle", `-bundle-${platform}`));
+                bundles.push(CODEQL_BUNDLE_NAME);
+                codeqlURL = await getCodeQLBundleDownloadURL(bundles, githubAuth, githubUrl, mode, logger);
+            }
+            logger.debug(`Using CodeQL URL: ${codeqlURL}`);
+            const headers = { accept: "application/octet-stream" };
+            // We only want to provide an authorization header if we are downloading
+            // from the same GitHub instance the Action is running on.
+            // This avoids leaking Enterprise tokens to dotcom.
+            if (codeqlURL.startsWith(`${githubUrl}/`)) {
+                logger.debug("Downloading CodeQL bundle with token.");
+                headers.authorization = `token ${githubAuth}`;
+            }
+            else {
+                logger.debug("Downloading CodeQL bundle without token.");
+            }
+            logger.info(`Downloading CodeQL tools from ${codeqlURL}. This may take a while.`);
+            const codeqlPath = await toolcacheDownloadTool(codeqlURL, headers, tempDir, logger);
+            logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
+            const codeqlExtracted = await toolcache.extractTar(codeqlPath);
+            logger.debug(`Caching ${codeqlToolcacheVersion}`);
+            codeqlFolder = await toolcache.cacheDir(codeqlExtracted, "CodeQL", codeqlToolcacheVersion);
+        }
+        let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");
+        if (process.platform === "win32") {
+            codeqlCmd += ".exe";
+        }
+        else if (process.platform !== "linux" && process.platform !== "darwin") {
+            throw new Error(`Unsupported platform: ${process.platform}`);
+        }
+        cachedCodeQL = getCodeQLForCmd(codeqlCmd);
+        return cachedCodeQL;
+    }
+    catch (e) {
+        logger.error(e);
+        throw new Error("Unable to download and extract CodeQL CLI");
+    }
+}
+exports.setupCodeQL = setupCodeQL;
+function getCodeQLURLVersion(url, logger) {
+    const match = url.match(/\/codeql-bundle-(.*)\//);
+    if (match === null || match.length < 2) {
+        throw new Error(`Malformed tools url: ${url}. Version could not be inferred`);
+    }
+    let version = match[1];
+    if (!semver.valid(version)) {
+        logger.debug(`Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`);
+        version = `0.0.0-${version}`;
+    }
+    const s = semver.clean(version);
+    if (!s) {
+        throw new Error(`Malformed tools url ${url}. Version should be in SemVer format but have ${version} instead`);
+    }
+    return s;
+}
+exports.getCodeQLURLVersion = getCodeQLURLVersion;
+/**
+ * Use the CodeQL executable located at the given path.
+ */
+function getCodeQL(cmd) {
+    if (cachedCodeQL === undefined) {
+        cachedCodeQL = getCodeQLForCmd(cmd);
+    }
+    return cachedCodeQL;
+}
+exports.getCodeQL = getCodeQL;
+function resolveFunction(partialCodeql, methodName, defaultImplementation) {
+    if (typeof partialCodeql[methodName] !== "function") {
+        if (defaultImplementation !== undefined) {
+            return defaultImplementation;
+        }
+        const dummyMethod = () => {
+            throw new Error(`CodeQL ${methodName} method not correctly defined`);
+        };
+        return dummyMethod;
+    }
+    return partialCodeql[methodName];
+}
+/**
+ * Set the functionality for CodeQL methods. Only for use in tests.
+ *
+ * Accepts a partial object and any undefined methods will be implemented
+ * to immediately throw an exception indicating which method is missing.
+ */
+function setCodeQL(partialCodeql) {
+    cachedCodeQL = {
+        getPath: resolveFunction(partialCodeql, "getPath", () => "/tmp/dummy-path"),
+        printVersion: resolveFunction(partialCodeql, "printVersion"),
+        getTracerEnv: resolveFunction(partialCodeql, "getTracerEnv"),
+        databaseInit: resolveFunction(partialCodeql, "databaseInit"),
+        runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
+        extractScannedLanguage: resolveFunction(partialCodeql, "extractScannedLanguage"),
+        finalizeDatabase: resolveFunction(partialCodeql, "finalizeDatabase"),
+        resolveQueries: resolveFunction(partialCodeql, "resolveQueries"),
+        databaseAnalyze: resolveFunction(partialCodeql, "databaseAnalyze"),
+    };
+    return cachedCodeQL;
+}
+exports.setCodeQL = setCodeQL;
+/**
+ * Get the cached CodeQL object. Should only be used from tests.
+ *
+ * TODO: Work out a good way for tests to get this from the test context
+ * instead of having to have this method.
+ */
+function getCachedCodeQL() {
+    if (cachedCodeQL === undefined) {
+        // Should never happen as setCodeQL is called by testing-utils.setupTests
+        throw new Error("cachedCodeQL undefined");
+    }
+    return cachedCodeQL;
+}
+exports.getCachedCodeQL = getCachedCodeQL;
+function getCodeQLForCmd(cmd) {
+    return {
+        getPath() {
+            return cmd;
+        },
+        async printVersion() {
+            await new toolrunnner.ToolRunner(cmd, [
+                "version",
+                "--format=json",
+            ]).exec();
+        },
+        async getTracerEnv(databasePath) {
+            // Write tracer-env.js to a temp location.
+            const tracerEnvJs = path.resolve(databasePath, "working", "tracer-env.js");
+            fs.mkdirSync(path.dirname(tracerEnvJs), { recursive: true });
+            fs.writeFileSync(tracerEnvJs, `
+        const fs = require('fs');
+        const env = {};
+        for (let entry of Object.entries(process.env)) {
+          const key = entry[0];
+          const value = entry[1];
+          if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
+            env[key] = value;
+          }
+        }
+        process.stdout.write(process.argv[2]);
+        fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');`);
+            const envFile = path.resolve(databasePath, "working", "env.tmp");
+            await new toolrunnner.ToolRunner(cmd, [
+                "database",
+                "trace-command",
+                databasePath,
+                ...getExtraOptionsFromEnv(["database", "trace-command"]),
+                process.execPath,
+                tracerEnvJs,
+                envFile,
+            ]).exec();
+            return JSON.parse(fs.readFileSync(envFile, "utf-8"));
+        },
+        async databaseInit(databasePath, language, sourceRoot) {
+            await new toolrunnner.ToolRunner(cmd, [
+                "database",
+                "init",
+                databasePath,
+                `--language=${language}`,
+                `--source-root=${sourceRoot}`,
+                ...getExtraOptionsFromEnv(["database", "init"]),
+            ]).exec();
+        },
+        async runAutobuild(language) {
+            const cmdName = process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh";
+            const autobuildCmd = path.join(path.dirname(cmd), language, "tools", cmdName);
+            // Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'
+            // This is because of an issue with Azure pipelines timing out connections after 4 minutes
+            // and Maven not properly handling closed connections
+            // Otherwise long build processes will timeout when pulling down Java packages
+            // https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
+            const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
+            process.env["JAVA_TOOL_OPTIONS"] = [
+                ...javaToolOptions.split(/\s+/),
+                "-Dhttp.keepAlive=false",
+                "-Dmaven.wagon.http.pool=false",
+            ].join(" ");
+            await new toolrunnner.ToolRunner(autobuildCmd).exec();
+        },
+        async extractScannedLanguage(databasePath, language) {
+            // Get extractor location
+            let extractorPath = "";
+            await new toolrunnner.ToolRunner(cmd, [
+                "resolve",
+                "extractor",
+                "--format=json",
+                `--language=${language}`,
+                ...getExtraOptionsFromEnv(["resolve", "extractor"]),
+            ], {
+                silent: true,
+                listeners: {
+                    stdout: (data) => {
+                        extractorPath += data.toString();
+                    },
+                    stderr: (data) => {
+                        process.stderr.write(data);
+                    },
+                },
+            }).exec();
+            // Set trace command
+            const ext = process.platform === "win32" ? ".cmd" : ".sh";
+            const traceCommand = path.resolve(JSON.parse(extractorPath), "tools", `autobuild${ext}`);
+            // Run trace command
+            await toolrunner_error_catcher_1.toolrunnerErrorCatcher(cmd, [
+                "database",
+                "trace-command",
+                ...getExtraOptionsFromEnv(["database", "trace-command"]),
+                databasePath,
+                "--",
+                traceCommand,
+            ], error_matcher_1.errorMatchers);
+        },
+        async finalizeDatabase(databasePath) {
+            await toolrunner_error_catcher_1.toolrunnerErrorCatcher(cmd, [
+                "database",
+                "finalize",
+                ...getExtraOptionsFromEnv(["database", "finalize"]),
+                databasePath,
+            ], error_matcher_1.errorMatchers);
+        },
+        async resolveQueries(queries, extraSearchPath) {
+            const codeqlArgs = [
+                "resolve",
+                "queries",
+                ...queries,
+                "--format=bylanguage",
+                ...getExtraOptionsFromEnv(["resolve", "queries"]),
+            ];
+            if (extraSearchPath !== undefined) {
+                codeqlArgs.push("--search-path", extraSearchPath);
+            }
+            let output = "";
+            await new toolrunnner.ToolRunner(cmd, codeqlArgs, {
+                listeners: {
+                    stdout: (data) => {
+                        output += data.toString();
+                    },
+                },
+            }).exec();
+            return JSON.parse(output);
+        },
+        async databaseAnalyze(databasePath, sarifFile, querySuite, memoryFlag, addSnippetsFlag, threadsFlag) {
+            await new toolrunnner.ToolRunner(cmd, [
+                "database",
+                "analyze",
+                memoryFlag,
+                threadsFlag,
+                databasePath,
+                "--format=sarif-latest",
+                `--output=${sarifFile}`,
+                addSnippetsFlag,
+                ...getExtraOptionsFromEnv(["database", "analyze"]),
+                querySuite,
+            ]).exec();
+        },
+    };
+}
+/**
+ * Gets the options for `path` of `options` as an array of extra option strings.
+ */
+function getExtraOptionsFromEnv(path) {
+    const options = util.getExtraOptionsEnvParam();
+    return getExtraOptions(options, path, []);
+}
+/**
+ * Gets the options for `path` of `options` as an array of extra option strings.
+ *
+ * - the special terminal step name '*' in `options` matches all path steps
+ * - throws an exception if this conversion is impossible.
+ */
+function getExtraOptions(options, path, pathInfo) {
+    var _a, _b, _c;
+    /**
+     * Gets `options` as an array of extra option strings.
+     *
+     * - throws an exception mentioning `pathInfo` if this conversion is impossible.
+     */
+    function asExtraOptions(options, pathInfo) {
+        if (options === undefined) {
+            return [];
+        }
+        if (!Array.isArray(options)) {
+            const msg = `The extra options for '${pathInfo.join(".")}' ('${JSON.stringify(options)}') are not in an array.`;
+            throw new Error(msg);
+        }
+        return options.map((o) => {
+            const t = typeof o;
+            if (t !== "string" && t !== "number" && t !== "boolean") {
+                const msg = `The extra option for '${pathInfo.join(".")}' ('${JSON.stringify(o)}') is not a primitive value.`;
+                throw new Error(msg);
+            }
+            return `${o}`;
+        });
+    }
+    const all = asExtraOptions((_a = options) === null || _a === void 0 ? void 0 : _a["*"], pathInfo.concat("*"));
+    const specific = path.length === 0
+        ? asExtraOptions(options, pathInfo)
+        : getExtraOptions((_b = options) === null || _b === void 0 ? void 0 : _b[path[0]], (_c = path) === null || _c === void 0 ? void 0 : _c.slice(1), pathInfo.concat(path[0]));
+    return all.concat(specific);
+}
+exports.getExtraOptions = getExtraOptions;
+//# sourceMappingURL=codeql.js.map

lib/codeql.test.js

@@ -0,0 +1,196 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const github = __importStar(require("@actions/github"));
+const toolcache = __importStar(require("@actions/tool-cache"));
+const ava_1 = __importDefault(require("ava"));
+const nock_1 = __importDefault(require("nock"));
+const path = __importStar(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const api = __importStar(require("./api-client"));
+const codeql = __importStar(require("./codeql"));
+const defaults = __importStar(require("./defaults.json")); // Referenced from codeql-action-sync-tool!
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+testing_utils_1.setupTests(ava_1.default);
+ava_1.default("download and populate codeql bundle cache", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const versions = ["20200601", "20200610"];
+        const languages = [
+            [languages_1.Language.cpp],
+            [languages_1.Language.cpp, languages_1.Language.python],
+        ];
+        const platform = process.platform === "win32"
+            ? "win64"
+            : process.platform === "linux"
+                ? "linux64"
+                : process.platform === "darwin"
+                    ? "osx64"
+                    : undefined;
+        for (let i = 0; i < versions.length; i++) {
+            for (let j = 0; j < languages.length; j++) {
+                const version = versions[i];
+                const plVersion = languages[j].length === 1
+                    ? `${platform}-${languages[j][0]}`
+                    : undefined;
+                nock_1.default("https://example.com")
+                    .get(`/download/codeql-bundle-${version}/codeql-bundle.tar.gz`)
+                    .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
+                await codeql.setupCodeQL(`https://example.com/download/codeql-bundle-${version}/codeql-bundle.tar.gz`, languages[j], "token", "https://github.example.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+                const toolcacheVersion = plVersion
+                    ? `0.0.0-${version}-${plVersion}`
+                    : `0.0.0-${version}`;
+                t.assert(toolcache.find("CodeQL", toolcacheVersion), `Looking for ${toolcacheVersion}`);
+            }
+        }
+        const cachedVersions = toolcache.findAllVersions("CodeQL");
+        // We should now have 4 cached versions: e.g.,
+        // 20200601, 20200601-linux64-cpp, 20200610, 20200610-linux64-cpp
+        t.is(cachedVersions.length, 4);
+    });
+});
+ava_1.default("download small codeql bundle if analyzing only one language", async (t) => {
+    // Note: We do not specify a codeqlURL in this test, thus testing that
+    //       the logic for constructing the URL takes into account the
+    //       language being analyzed
+    await util.withTmpDir(async (tmpDir) => {
+        const languages = [
+            [languages_1.Language.cpp],
+            [languages_1.Language.cpp, languages_1.Language.python],
+        ];
+        const platform = process.platform === "win32"
+            ? "win64"
+            : process.platform === "linux"
+                ? "linux64"
+                : process.platform === "darwin"
+                    ? "osx64"
+                    : undefined;
+        for (let i = 0; i < languages.length; i++) {
+            const plVersion = languages[i].length === 1
+                ? `${platform}-${languages[i][0]}`
+                : undefined;
+            const pkg = plVersion
+                ? `codeql-bundle-${plVersion}.tar.gz`
+                : "codeql-bundle.tar.gz";
+            // Mock the API client
+            const client = new github.GitHub("123");
+            const response = {
+                data: {
+                    assets: [
+                        {
+                            name: `codeql-bundle-${platform}-cpp.tar.gz`,
+                            url: `https://github.example.com/url/codeql-bundle-${platform}-cpp.tar.gz`,
+                        },
+                        {
+                            name: "codeql-bundle.tar.gz",
+                            url: "https://github.example.com/url/codeql-bundle.tar.gz",
+                        },
+                    ],
+                },
+            };
+            sinon_1.default.stub(client.repos, "getReleaseByTag").resolves(response);
+            sinon_1.default.stub(api, "getApiClient").value(() => client);
+            nock_1.default("https://github.example.com")
+                .get(`/url/${pkg}`)
+                .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
+            await codeql.setupCodeQL(undefined, languages[i], "token", "https://github.example.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+            const parsedVersion = codeql.getCodeQLURLVersion(`/${defaults.bundleVersion}/`, logging_1.getRunnerLogger(true));
+            const toolcacheVersion = plVersion
+                ? `${parsedVersion}-${plVersion}`
+                : parsedVersion;
+            t.assert(toolcache.find("CodeQL", toolcacheVersion), `Looking for ${toolcacheVersion} - ${plVersion}`);
+        }
+        const cachedVersions = toolcache.findAllVersions("CodeQL");
+        t.is(cachedVersions.length, 2);
+    });
+});
+ava_1.default("use full codeql bundle cache if smaller bundle is not available", async (t) => {
+    // If we look for a platform-language version but find the full bundle in the cache,
+    // we use the full bundle
+    await util.withTmpDir(async (tmpDir) => {
+        const version = "20200601";
+        nock_1.default("https://example.com")
+            .get(`/download/codeql-bundle-${version}/codeql-bundle.tar.gz`)
+            .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
+        await codeql.setupCodeQL(`https://example.com/download/codeql-bundle-${version}/codeql-bundle.tar.gz`, [], "token", "https://github.example.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
+        t.is(toolcache.findAllVersions("CodeQL").length, 1);
+        // Now try to request the cpp version, and see that we do not change the cache
+        await codeql.setupCodeQL(`https://example.com/download/codeql-bundle-${version}/codeql-bundle.tar.gz`, [languages_1.Language.cpp], "token", "https://github.example.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
+        t.is(toolcache.findAllVersions("CodeQL").length, 1);
+    });
+});
+ava_1.default("use larger bundles if smaller ones are not released", async (t) => {
+    // Mock the API client
+    const client = new github.GitHub("123");
+    const response = {
+        data: {
+            assets: [{ name: "full-bundle", url: "url/file.gz" }],
+        },
+    };
+    const getReleaseByTagMock = sinon_1.default
+        .stub(client.repos, "getReleaseByTag")
+        .resolves(response);
+    sinon_1.default.stub(api, "getApiClient").value(() => client);
+    // Setting this env is required by a dependency of getCodeQLBundleDownloadURL
+    process.env["RUNNER_TEMP"] = "abc";
+    const codeqlURL = await codeql.getCodeQLBundleDownloadURL(["small-bundle", "full-bundle"], "", "", "actions", logging_1.getRunnerLogger(true));
+    t.deepEqual(codeqlURL, "url/file.gz");
+    t.assert(getReleaseByTagMock.called);
+});
+ava_1.default("parse codeql bundle url version", (t) => {
+    const tests = {
+        "20200601": "0.0.0-20200601",
+        "20200601.0": "0.0.0-20200601.0",
+        "20200601.0.0": "20200601.0.0",
+        "1.2.3": "1.2.3",
+        "1.2.3-alpha": "1.2.3-alpha",
+        "1.2.3-beta.1": "1.2.3-beta.1",
+        "20200601-linux64-python": "0.0.0-20200601-linux64-python",
+    };
+    for (const [version, expectedVersion] of Object.entries(tests)) {
+        const url = `https://github.com/.../codeql-bundle-${version}/...`;
+        try {
+            const parsedVersion = codeql.getCodeQLURLVersion(url, logging_1.getRunnerLogger(true));
+            t.deepEqual(parsedVersion, expectedVersion);
+        }
+        catch (e) {
+            t.fail(e.message);
+        }
+    }
+});
+ava_1.default("getExtraOptions works for explicit paths", (t) => {
+    t.deepEqual(codeql.getExtraOptions({}, ["foo"], []), []);
+    t.deepEqual(codeql.getExtraOptions({ foo: [42] }, ["foo"], []), ["42"]);
+    t.deepEqual(codeql.getExtraOptions({ foo: { bar: [42] } }, ["foo", "bar"], []), ["42"]);
+});
+ava_1.default("getExtraOptions works for wildcards", (t) => {
+    t.deepEqual(codeql.getExtraOptions({ "*": [42] }, ["foo"], []), ["42"]);
+});
+ava_1.default("getExtraOptions works for wildcards and explicit paths", (t) => {
+    const o1 = { "*": [42], foo: [87] };
+    t.deepEqual(codeql.getExtraOptions(o1, ["foo"], []), ["42", "87"]);
+    const o2 = { "*": [42], foo: [87] };
+    t.deepEqual(codeql.getExtraOptions(o2, ["foo", "bar"], []), ["42"]);
+    const o3 = { "*": [42], foo: { "*": [87], bar: [99] } };
+    const p = ["foo", "bar"];
+    t.deepEqual(codeql.getExtraOptions(o3, p, []), ["42", "87", "99"]);
+});
+ava_1.default("getExtraOptions throws for bad content", (t) => {
+    t.throws(() => codeql.getExtraOptions({ "*": 42 }, ["foo"], []));
+    t.throws(() => codeql.getExtraOptions({ foo: 87 }, ["foo"], []));
+    t.throws(() => codeql.getExtraOptions({ "*": [42], foo: { "*": 87, bar: [99] } }, ["foo", "bar"], []));
+});
+//# sourceMappingURL=codeql.test.js.map

lib/config-utils.js

@@ -0,0 +1,529 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const path = __importStar(require("path"));
+const api = __importStar(require("./api-client"));
+const externalQueries = __importStar(require("./external-queries"));
+// Property names from the user-supplied config file.
+const NAME_PROPERTY = "name";
+const DISABLE_DEFAULT_QUERIES_PROPERTY = "disable-default-queries";
+const QUERIES_PROPERTY = "queries";
+const QUERIES_USES_PROPERTY = "uses";
+const PATHS_IGNORE_PROPERTY = "paths-ignore";
+const PATHS_PROPERTY = "paths";
+/**
+ * A list of queries from https://github.com/github/codeql that
+ * we don't want to run. Disabling them here is a quicker alternative to
+ * disabling them in the code scanning query suites. Queries should also
+ * be disabled in the suites, and removed from this list here once the
+ * bundle is updated to make those suite changes live.
+ *
+ * Format is a map from language to an array of path suffixes of .ql files.
+ */
+const DISABLED_BUILTIN_QUERIES = {
+    csharp: [
+        "ql/src/Security Features/CWE-937/VulnerablePackage.ql",
+        "ql/src/Security Features/CWE-451/MissingXFrameOptions.ql",
+    ],
+};
+function queryIsDisabled(language, query) {
+    return (DISABLED_BUILTIN_QUERIES[language] || []).some((disabledQuery) => query.endsWith(disabledQuery));
+}
+/**
+ * Asserts that the noDeclaredLanguage and multipleDeclaredLanguages fields are
+ * both empty and errors if they are not.
+ */
+function validateQueries(resolvedQueries) {
+    const noDeclaredLanguage = resolvedQueries.noDeclaredLanguage;
+    const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
+    if (noDeclaredLanguageQueries.length !== 0) {
+        throw new Error(`${"The following queries do not declare a language. " +
+            "Their qlpack.yml files are either missing or is invalid.\n"}${noDeclaredLanguageQueries.join("\n")}`);
+    }
+    const multipleDeclaredLanguages = resolvedQueries.multipleDeclaredLanguages;
+    const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
+    if (multipleDeclaredLanguagesQueries.length !== 0) {
+        throw new Error(`${"The following queries declare multiple languages. " +
+            "Their qlpack.yml files are either missing or is invalid.\n"}${multipleDeclaredLanguagesQueries.join("\n")}`);
+    }
+}
+/**
+ * Run 'codeql resolve queries' and add the results to resultMap
+ *
+ * If a checkout path is given then the queries are assumed to be custom queries
+ * and an error will be thrown if there is anything invalid about the queries.
+ * If a checkout path is not given then the queries are assumed to be builtin
+ * queries, and error checking will be suppressed.
+ */
+async function runResolveQueries(codeQL, resultMap, toResolve, extraSearchPath) {
+    const resolvedQueries = await codeQL.resolveQueries(toResolve, extraSearchPath);
+    if (extraSearchPath !== undefined) {
+        validateQueries(resolvedQueries);
+    }
+    for (const [language, queryPaths] of Object.entries(resolvedQueries.byLanguage)) {
+        if (resultMap[language] === undefined) {
+            resultMap[language] = {
+                builtin: [],
+                custom: [],
+            };
+        }
+        const queries = Object.keys(queryPaths).filter((q) => !queryIsDisabled(language, q));
+        if (extraSearchPath !== undefined) {
+            resultMap[language].custom.push(...queries);
+        }
+        else {
+            resultMap[language].builtin.push(...queries);
+        }
+    }
+}
+/**
+ * Get the set of queries included by default.
+ */
+async function addDefaultQueries(codeQL, languages, resultMap) {
+    const suites = languages.map((l) => `${l}-code-scanning.qls`);
+    await runResolveQueries(codeQL, resultMap, suites, undefined);
+}
+// The set of acceptable values for built-in suites from the codeql bundle
+const builtinSuites = ["security-extended", "security-and-quality"];
+/**
+ * Determine the set of queries associated with suiteName's suites and add them to resultMap.
+ * Throws an error if suiteName is not a valid builtin suite.
+ */
+async function addBuiltinSuiteQueries(languages, codeQL, resultMap, suiteName, configFile) {
+    const suite = builtinSuites.find((suite) => suite === suiteName);
+    if (!suite) {
+        throw new Error(getQueryUsesInvalid(configFile, suiteName));
+    }
+    const suites = languages.map((l) => `${l}-${suiteName}.qls`);
+    await runResolveQueries(codeQL, resultMap, suites, undefined);
+}
+/**
+ * Retrieve the set of queries at localQueryPath and add them to resultMap.
+ */
+async function addLocalQueries(codeQL, resultMap, localQueryPath, checkoutPath, configFile) {
+    // Resolve the local path against the workspace so that when this is
+    // passed to codeql it resolves to exactly the path we expect it to resolve to.
+    let absoluteQueryPath = path.join(checkoutPath, localQueryPath);
+    // Check the file exists
+    if (!fs.existsSync(absoluteQueryPath)) {
+        throw new Error(getLocalPathDoesNotExist(configFile, localQueryPath));
+    }
+    // Call this after checking file exists, because it'll fail if file doesn't exist
+    absoluteQueryPath = fs.realpathSync(absoluteQueryPath);
+    // Check the local path doesn't jump outside the repo using '..' or symlinks
+    if (!(absoluteQueryPath + path.sep).startsWith(fs.realpathSync(checkoutPath) + path.sep)) {
+        throw new Error(getLocalPathOutsideOfRepository(configFile, localQueryPath));
+    }
+    await runResolveQueries(codeQL, resultMap, [absoluteQueryPath], checkoutPath);
+}
+/**
+ * Retrieve the set of queries at the referenced remote repo and add them to resultMap.
+ */
+async function addRemoteQueries(codeQL, resultMap, queryUses, tempDir, githubUrl, logger, configFile) {
+    let tok = queryUses.split("@");
+    if (tok.length !== 2) {
+        throw new Error(getQueryUsesInvalid(configFile, queryUses));
+    }
+    const ref = tok[1];
+    tok = tok[0].split("/");
+    // The first token is the owner
+    // The second token is the repo
+    // The rest is a path, if there is more than one token combine them to form the full path
+    if (tok.length < 2) {
+        throw new Error(getQueryUsesInvalid(configFile, queryUses));
+    }
+    // Check none of the parts of the repository name are empty
+    if (tok[0].trim() === "" || tok[1].trim() === "") {
+        throw new Error(getQueryUsesInvalid(configFile, queryUses));
+    }
+    const nwo = `${tok[0]}/${tok[1]}`;
+    // Checkout the external repository
+    const checkoutPath = await externalQueries.checkoutExternalRepository(nwo, ref, githubUrl, tempDir, logger);
+    const queryPath = tok.length > 2
+        ? path.join(checkoutPath, tok.slice(2).join("/"))
+        : checkoutPath;
+    await runResolveQueries(codeQL, resultMap, [queryPath], checkoutPath);
+}
+/**
+ * Parse a query 'uses' field to a discrete set of query files and update resultMap.
+ *
+ * The logic for parsing the string is based on what actions does for
+ * parsing the 'uses' actions in the workflow file. So it can handle
+ * local paths starting with './', or references to remote repos, or
+ * a finite set of hardcoded terms for builtin suites.
+ */
+async function parseQueryUses(languages, codeQL, resultMap, queryUses, tempDir, checkoutPath, githubUrl, logger, configFile) {
+    queryUses = queryUses.trim();
+    if (queryUses === "") {
+        throw new Error(getQueryUsesInvalid(configFile));
+    }
+    // Check for the local path case before we start trying to parse the repository name
+    if (queryUses.startsWith("./")) {
+        await addLocalQueries(codeQL, resultMap, queryUses.slice(2), checkoutPath, configFile);
+        return;
+    }
+    // Check for one of the builtin suites
+    if (queryUses.indexOf("/") === -1 && queryUses.indexOf("@") === -1) {
+        await addBuiltinSuiteQueries(languages, codeQL, resultMap, queryUses, configFile);
+        return;
+    }
+    // Otherwise, must be a reference to another repo
+    await addRemoteQueries(codeQL, resultMap, queryUses, tempDir, githubUrl, logger, configFile);
+}
+// Regex validating stars in paths or paths-ignore entries.
+// The intention is to only allow ** to appear when immediately
+// preceded and followed by a slash.
+const pathStarsRegex = /.*(?:\*\*[^/].*|\*\*$|[^/]\*\*.*)/;
+// Characters that are supported by filters in workflows, but not by us.
+// See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
+const filterPatternCharactersRegex = /.*[\?\+\[\]!].*/;
+// Checks that a paths of paths-ignore entry is valid, possibly modifying it
+// to make it valid, or if not possible then throws an error.
+function validateAndSanitisePath(originalPath, propertyName, configFile, logger) {
+    // Take a copy so we don't modify the original path, so we can still construct error messages
+    let path = originalPath;
+    // All paths are relative to the src root, so strip off leading slashes.
+    while (path.charAt(0) === "/") {
+        path = path.substring(1);
+    }
+    // Trailing ** are redundant, so strip them off
+    if (path.endsWith("/**")) {
+        path = path.substring(0, path.length - 2);
+    }
+    // An empty path is not allowed as it's meaningless
+    if (path === "") {
+        throw new Error(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" is not an invalid path. ` +
+            `It is not necessary to include it, and it is not allowed to exclude it.`));
+    }
+    // Check for illegal uses of **
+    if (path.match(pathStarsRegex)) {
+        throw new Error(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" contains an invalid "**" wildcard. ` +
+            `They must be immediately preceeded and followed by a slash as in "/**/", or come at the start or end.`));
+    }
+    // Check for other regex characters that we don't support.
+    // Output a warning so the user knows, but otherwise continue normally.
+    if (path.match(filterPatternCharactersRegex)) {
+        logger.warning(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" contains an unsupported character. ` +
+            `The filter pattern characters ?, +, [, ], ! are not supported and will be matched literally.`));
+    }
+    // Ban any uses of backslash for now.
+    // This may not play nicely with project layouts.
+    // This restriction can be lifted later if we determine they are ok.
+    if (path.indexOf("\\") !== -1) {
+        throw new Error(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" contains an "\\" character. These are not allowed in filters. ` +
+            `If running on windows we recommend using "/" instead for path filters.`));
+    }
+    return path;
+}
+exports.validateAndSanitisePath = validateAndSanitisePath;
+// An undefined configFile in some of these functions indicates that
+// the property was in a workflow file, not a config file
+function getNameInvalid(configFile) {
+    return getConfigFilePropertyError(configFile, NAME_PROPERTY, "must be a non-empty string");
+}
+exports.getNameInvalid = getNameInvalid;
+function getDisableDefaultQueriesInvalid(configFile) {
+    return getConfigFilePropertyError(configFile, DISABLE_DEFAULT_QUERIES_PROPERTY, "must be a boolean");
+}
+exports.getDisableDefaultQueriesInvalid = getDisableDefaultQueriesInvalid;
+function getQueriesInvalid(configFile) {
+    return getConfigFilePropertyError(configFile, QUERIES_PROPERTY, "must be an array");
+}
+exports.getQueriesInvalid = getQueriesInvalid;
+function getQueryUsesInvalid(configFile, queryUses) {
+    return getConfigFilePropertyError(configFile, `${QUERIES_PROPERTY}.${QUERIES_USES_PROPERTY}`, `must be a built-in suite (${builtinSuites.join(" or ")}), a relative path, or be of the form "owner/repo[/path]@ref"${queryUses !== undefined ? `\n Found: ${queryUses}` : ""}`);
+}
+exports.getQueryUsesInvalid = getQueryUsesInvalid;
+function getPathsIgnoreInvalid(configFile) {
+    return getConfigFilePropertyError(configFile, PATHS_IGNORE_PROPERTY, "must be an array of non-empty strings");
+}
+exports.getPathsIgnoreInvalid = getPathsIgnoreInvalid;
+function getPathsInvalid(configFile) {
+    return getConfigFilePropertyError(configFile, PATHS_PROPERTY, "must be an array of non-empty strings");
+}
+exports.getPathsInvalid = getPathsInvalid;
+function getLocalPathOutsideOfRepository(configFile, localPath) {
+    return getConfigFilePropertyError(configFile, `${QUERIES_PROPERTY}.${QUERIES_USES_PROPERTY}`, `is invalid as the local path "${localPath}" is outside of the repository`);
+}
+exports.getLocalPathOutsideOfRepository = getLocalPathOutsideOfRepository;
+function getLocalPathDoesNotExist(configFile, localPath) {
+    return getConfigFilePropertyError(configFile, `${QUERIES_PROPERTY}.${QUERIES_USES_PROPERTY}`, `is invalid as the local path "${localPath}" does not exist in the repository`);
+}
+exports.getLocalPathDoesNotExist = getLocalPathDoesNotExist;
+function getConfigFileOutsideWorkspaceErrorMessage(configFile) {
+    return `The configuration file "${configFile}" is outside of the workspace`;
+}
+exports.getConfigFileOutsideWorkspaceErrorMessage = getConfigFileOutsideWorkspaceErrorMessage;
+function getConfigFileDoesNotExistErrorMessage(configFile) {
+    return `The configuration file "${configFile}" does not exist`;
+}
+exports.getConfigFileDoesNotExistErrorMessage = getConfigFileDoesNotExistErrorMessage;
+function getConfigFileRepoFormatInvalidMessage(configFile) {
+    let error = `The configuration file "${configFile}" is not a supported remote file reference.`;
+    error += " Expected format <owner>/<repository>/<file-path>@<ref>";
+    return error;
+}
+exports.getConfigFileRepoFormatInvalidMessage = getConfigFileRepoFormatInvalidMessage;
+function getConfigFileFormatInvalidMessage(configFile) {
+    return `The configuration file "${configFile}" could not be read`;
+}
+exports.getConfigFileFormatInvalidMessage = getConfigFileFormatInvalidMessage;
+function getConfigFileDirectoryGivenMessage(configFile) {
+    return `The configuration file "${configFile}" looks like a directory, not a file`;
+}
+exports.getConfigFileDirectoryGivenMessage = getConfigFileDirectoryGivenMessage;
+function getConfigFilePropertyError(configFile, property, error) {
+    if (configFile === undefined) {
+        return `The workflow property "${property}" is invalid: ${error}`;
+    }
+    else {
+        return `The configuration file "${configFile}" is invalid: property "${property}" ${error}`;
+    }
+}
+async function addQueriesFromWorkflow(codeQL, queriesInput, languages, resultMap, tempDir, checkoutPath, githubUrl, logger) {
+    queriesInput = queriesInput.trim();
+    // "+" means "don't override config file" - see shouldAddConfigFileQueries
+    queriesInput = queriesInput.replace(/^\+/, "");
+    for (const query of queriesInput.split(",")) {
+        await parseQueryUses(languages, codeQL, resultMap, query, tempDir, checkoutPath, githubUrl, logger);
+    }
+}
+// Returns true if either no queries were provided in the workflow.
+// or if the queries in the workflow were provided in "additive" mode,
+// indicating that they shouldn't override the config queries but
+// should instead be added in addition
+function shouldAddConfigFileQueries(queriesInput) {
+    if (queriesInput) {
+        return queriesInput.trimStart().substr(0, 1) === "+";
+    }
+    return true;
+}
+/**
+ * Get the default config for when the user has not supplied one.
+ */
+async function getDefaultConfig(languages, queriesInput, tempDir, toolCacheDir, codeQL, checkoutPath, githubUrl, logger) {
+    const queries = {};
+    await addDefaultQueries(codeQL, languages, queries);
+    if (queriesInput) {
+        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, githubUrl, logger);
+    }
+    return {
+        languages,
+        queries,
+        pathsIgnore: [],
+        paths: [],
+        originalUserInput: {},
+        tempDir,
+        toolCacheDir,
+        codeQLCmd: codeQL.getPath(),
+    };
+}
+exports.getDefaultConfig = getDefaultConfig;
+/**
+ * Load the config from the given file.
+ */
+async function loadConfig(languages, queriesInput, configFile, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger) {
+    let parsedYAML;
+    if (isLocal(configFile)) {
+        // Treat the config file as relative to the workspace
+        configFile = path.resolve(checkoutPath, configFile);
+        parsedYAML = getLocalConfig(configFile, checkoutPath);
+    }
+    else {
+        parsedYAML = await getRemoteConfig(configFile, githubAuth, githubUrl);
+    }
+    // Validate that the 'name' property is syntactically correct,
+    // even though we don't use the value yet.
+    if (NAME_PROPERTY in parsedYAML) {
+        if (typeof parsedYAML[NAME_PROPERTY] !== "string") {
+            throw new Error(getNameInvalid(configFile));
+        }
+        if (parsedYAML[NAME_PROPERTY].length === 0) {
+            throw new Error(getNameInvalid(configFile));
+        }
+    }
+    const queries = {};
+    const pathsIgnore = [];
+    const paths = [];
+    let disableDefaultQueries = false;
+    if (DISABLE_DEFAULT_QUERIES_PROPERTY in parsedYAML) {
+        if (typeof parsedYAML[DISABLE_DEFAULT_QUERIES_PROPERTY] !== "boolean") {
+            throw new Error(getDisableDefaultQueriesInvalid(configFile));
+        }
+        disableDefaultQueries = parsedYAML[DISABLE_DEFAULT_QUERIES_PROPERTY];
+    }
+    if (!disableDefaultQueries) {
+        await addDefaultQueries(codeQL, languages, queries);
+    }
+    // If queries were provided using `with` in the action configuration,
+    // they should take precedence over the queries in the config file
+    // unless they're prefixed with "+", in which case they supplement those
+    // in the config file.
+    if (queriesInput) {
+        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, githubUrl, logger);
+    }
+    if (shouldAddConfigFileQueries(queriesInput) &&
+        QUERIES_PROPERTY in parsedYAML) {
+        if (!(parsedYAML[QUERIES_PROPERTY] instanceof Array)) {
+            throw new Error(getQueriesInvalid(configFile));
+        }
+        for (const query of parsedYAML[QUERIES_PROPERTY]) {
+            if (!(QUERIES_USES_PROPERTY in query) ||
+                typeof query[QUERIES_USES_PROPERTY] !== "string") {
+                throw new Error(getQueryUsesInvalid(configFile));
+            }
+            await parseQueryUses(languages, codeQL, queries, query[QUERIES_USES_PROPERTY], tempDir, checkoutPath, githubUrl, logger, configFile);
+        }
+    }
+    if (PATHS_IGNORE_PROPERTY in parsedYAML) {
+        if (!(parsedYAML[PATHS_IGNORE_PROPERTY] instanceof Array)) {
+            throw new Error(getPathsIgnoreInvalid(configFile));
+        }
+        parsedYAML[PATHS_IGNORE_PROPERTY].forEach((path) => {
+            if (typeof path !== "string" || path === "") {
+                throw new Error(getPathsIgnoreInvalid(configFile));
+            }
+            pathsIgnore.push(validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile, logger));
+        });
+    }
+    if (PATHS_PROPERTY in parsedYAML) {
+        if (!(parsedYAML[PATHS_PROPERTY] instanceof Array)) {
+            throw new Error(getPathsInvalid(configFile));
+        }
+        parsedYAML[PATHS_PROPERTY].forEach((path) => {
+            if (typeof path !== "string" || path === "") {
+                throw new Error(getPathsInvalid(configFile));
+            }
+            paths.push(validateAndSanitisePath(path, PATHS_PROPERTY, configFile, logger));
+        });
+    }
+    // The list of queries should not be empty for any language. If it is then
+    // it is a user configuration error.
+    for (const language of languages) {
+        if (queries[language] === undefined ||
+            (queries[language].builtin.length === 0 &&
+                queries[language].custom.length === 0)) {
+            throw new Error(`Did not detect any queries to run for ${language}. ` +
+                "Please make sure that the default queries are enabled, or you are specifying queries to run.");
+        }
+    }
+    return {
+        languages,
+        queries,
+        pathsIgnore,
+        paths,
+        originalUserInput: parsedYAML,
+        tempDir,
+        toolCacheDir,
+        codeQLCmd: codeQL.getPath(),
+    };
+}
+/**
+ * Load and return the config.
+ *
+ * This will parse the config from the user input if present, or generate
+ * a default config. The parsed config is then stored to a known location.
+ */
+async function initConfig(languages, queriesInput, configFile, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger) {
+    let config;
+    // If no config file was provided create an empty one
+    if (!configFile) {
+        logger.debug("No configuration file was provided");
+        config = await getDefaultConfig(languages, queriesInput, tempDir, toolCacheDir, codeQL, checkoutPath, githubUrl, logger);
+    }
+    else {
+        config = await loadConfig(languages, queriesInput, configFile, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger);
+    }
+    // Save the config so we can easily access it again in the future
+    await saveConfig(config, logger);
+    return config;
+}
+exports.initConfig = initConfig;
+function isLocal(configPath) {
+    // If the path starts with ./, look locally
+    if (configPath.indexOf("./") === 0) {
+        return true;
+    }
+    return configPath.indexOf("@") === -1;
+}
+function getLocalConfig(configFile, checkoutPath) {
+    // Error if the config file is now outside of the workspace
+    if (!(configFile + path.sep).startsWith(checkoutPath + path.sep)) {
+        throw new Error(getConfigFileOutsideWorkspaceErrorMessage(configFile));
+    }
+    // Error if the file does not exist
+    if (!fs.existsSync(configFile)) {
+        throw new Error(getConfigFileDoesNotExistErrorMessage(configFile));
+    }
+    return yaml.safeLoad(fs.readFileSync(configFile, "utf8"));
+}
+async function getRemoteConfig(configFile, githubAuth, githubUrl) {
+    // retrieve the various parts of the config location, and ensure they're present
+    const format = new RegExp("(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)");
+    const pieces = format.exec(configFile);
+    // 5 = 4 groups + the whole expression
+    if (pieces === null || pieces.groups === undefined || pieces.length < 5) {
+        throw new Error(getConfigFileRepoFormatInvalidMessage(configFile));
+    }
+    const response = await api
+        .getApiClient(githubAuth, githubUrl, true)
+        .repos.getContents({
+        owner: pieces.groups.owner,
+        repo: pieces.groups.repo,
+        path: pieces.groups.path,
+        ref: pieces.groups.ref,
+    });
+    let fileContents;
+    if ("content" in response.data && response.data.content !== undefined) {
+        fileContents = response.data.content;
+    }
+    else if (Array.isArray(response.data)) {
+        throw new Error(getConfigFileDirectoryGivenMessage(configFile));
+    }
+    else {
+        throw new Error(getConfigFileFormatInvalidMessage(configFile));
+    }
+    return yaml.safeLoad(Buffer.from(fileContents, "base64").toString("binary"));
+}
+/**
+ * Get the file path where the parsed config will be stored.
+ */
+function getPathToParsedConfigFile(tempDir) {
+    return path.join(tempDir, "config");
+}
+exports.getPathToParsedConfigFile = getPathToParsedConfigFile;
+/**
+ * Store the given config to the path returned from getPathToParsedConfigFile.
+ */
+async function saveConfig(config, logger) {
+    const configString = JSON.stringify(config);
+    const configFile = getPathToParsedConfigFile(config.tempDir);
+    fs.mkdirSync(path.dirname(configFile), { recursive: true });
+    fs.writeFileSync(configFile, configString, "utf8");
+    logger.debug("Saved config:");
+    logger.debug(configString);
+}
+/**
+ * Get the config that has been saved to the given temp dir.
+ * If the config could not be found then returns undefined.
+ */
+async function getConfig(tempDir, logger) {
+    const configFile = getPathToParsedConfigFile(tempDir);
+    if (!fs.existsSync(configFile)) {
+        return undefined;
+    }
+    const configString = fs.readFileSync(configFile, "utf8");
+    logger.debug("Loaded config:");
+    logger.debug(configString);
+    return JSON.parse(configString);
+}
+exports.getConfig = getConfig;
+//# sourceMappingURL=config-utils.js.map

lib/config-utils.test.js

@@ -0,0 +1,619 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const github = __importStar(require("@actions/github"));
+const ava_1 = __importDefault(require("ava"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const api = __importStar(require("./api-client"));
+const codeql_1 = require("./codeql");
+const configUtils = __importStar(require("./config-utils"));
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+testing_utils_1.setupTests(ava_1.default);
+// Returns the filepath of the newly-created file
+function createConfigFile(inputFileContents, tmpDir) {
+    const configFilePath = path.join(tmpDir, "input");
+    fs.writeFileSync(configFilePath, inputFileContents, "utf8");
+    return configFilePath;
+}
+function mockGetContents(content) {
+    // Passing an auth token is required, so we just use a dummy value
+    const client = new github.GitHub("123");
+    const response = {
+        data: content,
+    };
+    const spyGetContents = sinon_1.default
+        .stub(client.repos, "getContents")
+        .resolves(response);
+    sinon_1.default.stub(api, "getApiClient").value(() => client);
+    return spyGetContents;
+}
+function mockListLanguages(languages) {
+    // Passing an auth token is required, so we just use a dummy value
+    const client = new github.GitHub("123");
+    const response = {
+        data: {},
+    };
+    for (const language of languages) {
+        response.data[language] = 123;
+    }
+    sinon_1.default.stub(client.repos, "listLanguages").resolves(response);
+    sinon_1.default.stub(api, "getApiClient").value(() => client);
+}
+ava_1.default("load empty config", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const logger = logging_1.getRunnerLogger(true);
+        const languages = [languages_1.Language.javascript, languages_1.Language.python];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries() {
+                return {
+                    byLanguage: {},
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        const config = await configUtils.initConfig(languages, undefined, undefined, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logger);
+        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, tmpDir, tmpDir, codeQL, tmpDir, "https://github.example.com", logger));
+    });
+});
+ava_1.default("loading config saves config", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const logger = logging_1.getRunnerLogger(true);
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries() {
+                return {
+                    byLanguage: {},
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        // Sanity check the saved config file does not already exist
+        t.false(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
+        // Sanity check that getConfig returns undefined before we have called initConfig
+        t.deepEqual(await configUtils.getConfig(tmpDir, logger), undefined);
+        const config1 = await configUtils.initConfig([languages_1.Language.javascript, languages_1.Language.python], undefined, undefined, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logger);
+        // The saved config file should now exist
+        t.true(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
+        // And that same newly-initialised config should now be returned by getConfig
+        const config2 = await configUtils.getConfig(tmpDir, logger);
+        t.deepEqual(config1, config2);
+    });
+});
+ava_1.default("load input outside of workspace", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        try {
+            await configUtils.initConfig([], undefined, "../input", tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            throw new Error("initConfig did not throw error");
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileOutsideWorkspaceErrorMessage(path.join(tmpDir, "../input"))));
+        }
+    });
+});
+ava_1.default("load non-local input with invalid repo syntax", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        // no filename given, just a repo
+        const configFile = "octo-org/codeql-config@main";
+        try {
+            await configUtils.initConfig([], undefined, configFile, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            throw new Error("initConfig did not throw error");
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileRepoFormatInvalidMessage("octo-org/codeql-config@main")));
+        }
+    });
+});
+ava_1.default("load non-existent input", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const languages = [languages_1.Language.javascript];
+        const configFile = "input";
+        t.false(fs.existsSync(path.join(tmpDir, configFile)));
+        try {
+            await configUtils.initConfig(languages, undefined, configFile, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            throw new Error("initConfig did not throw error");
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileDoesNotExistErrorMessage(path.join(tmpDir, "input"))));
+        }
+    });
+});
+ava_1.default("load non-empty input", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries() {
+                return {
+                    byLanguage: {
+                        javascript: {
+                            "/foo/a.ql": {},
+                            "/bar/b.ql": {},
+                        },
+                    },
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        // Just create a generic config object with non-default values for all fields
+        const inputFileContents = `
+      name: my config
+      disable-default-queries: true
+      queries:
+        - uses: ./foo
+      paths-ignore:
+        - a
+        - b
+      paths:
+        - c/d`;
+        fs.mkdirSync(path.join(tmpDir, "foo"));
+        // And the config we expect it to parse to
+        const expectedConfig = {
+            languages: [languages_1.Language.javascript],
+            queries: {
+                javascript: {
+                    builtin: [],
+                    custom: ["/foo/a.ql", "/bar/b.ql"],
+                },
+            },
+            pathsIgnore: ["a", "b"],
+            paths: ["c/d"],
+            originalUserInput: {
+                name: "my config",
+                "disable-default-queries": true,
+                queries: [{ uses: "./foo" }],
+                "paths-ignore": ["a", "b"],
+                paths: ["c/d"],
+            },
+            tempDir: tmpDir,
+            toolCacheDir: tmpDir,
+            codeQLCmd: codeQL.getPath(),
+        };
+        const languages = [languages_1.Language.javascript];
+        const configFilePath = createConfigFile(inputFileContents, tmpDir);
+        const actualConfig = await configUtils.initConfig(languages, undefined, configFilePath, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Should exactly equal the object we constructed earlier
+        t.deepEqual(actualConfig, expectedConfig);
+    });
+});
+ava_1.default("Default queries are used", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        // Check that the default behaviour is to add the default queries.
+        // In this case if a config file is specified but does not include
+        // the disable-default-queries field.
+        // We determine this by whether CodeQL.resolveQueries is called
+        // with the correct arguments.
+        const resolveQueriesArgs = [];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return {
+                    byLanguage: {
+                        javascript: {
+                            "foo.ql": {},
+                        },
+                    },
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        // The important point of this config is that it doesn't specify
+        // the disable-default-queries field.
+        // Any other details are hopefully irrelevant for this tetst.
+        const inputFileContents = `
+      paths:
+        - foo`;
+        fs.mkdirSync(path.join(tmpDir, "foo"));
+        const languages = [languages_1.Language.javascript];
+        const configFilePath = createConfigFile(inputFileContents, tmpDir);
+        await configUtils.initConfig(languages, undefined, configFilePath, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Check resolve queries was called correctly
+        t.deepEqual(resolveQueriesArgs.length, 1);
+        t.deepEqual(resolveQueriesArgs[0].queries, [
+            "javascript-code-scanning.qls",
+        ]);
+        t.deepEqual(resolveQueriesArgs[0].extraSearchPath, undefined);
+    });
+});
+/**
+ * Returns the provided queries, just in the right format for a resolved query
+ * This way we can test by seeing which returned items are in the final
+ * configuration.
+ */
+function queriesToResolvedQueryForm(queries) {
+    const dummyResolvedQueries = {};
+    queries.forEach((q) => {
+        dummyResolvedQueries[q] = {};
+    });
+    return {
+        byLanguage: {
+            javascript: dummyResolvedQueries,
+        },
+        noDeclaredLanguage: {},
+        multipleDeclaredLanguages: {},
+    };
+}
+ava_1.default("Queries can be specified in config file", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const inputFileContents = `
+      name: my config
+      queries:
+        - uses: ./foo`;
+        const configFilePath = createConfigFile(inputFileContents, tmpDir);
+        fs.mkdirSync(path.join(tmpDir, "foo"));
+        const resolveQueriesArgs = [];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return queriesToResolvedQueryForm(queries);
+            },
+        });
+        const languages = [languages_1.Language.javascript];
+        const config = await configUtils.initConfig(languages, undefined, configFilePath, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Check resolveQueries was called correctly
+        // It'll be called once for the default queries
+        // and once for `./foo` from the config file.
+        t.deepEqual(resolveQueriesArgs.length, 2);
+        t.deepEqual(resolveQueriesArgs[1].queries.length, 1);
+        t.regex(resolveQueriesArgs[1].queries[0], /.*\/foo$/);
+        // Now check that the end result contains the default queries and the query from config
+        t.deepEqual(config.queries["javascript"].builtin.length, 1);
+        t.deepEqual(config.queries["javascript"].custom.length, 1);
+        t.regex(config.queries["javascript"].builtin[0], /javascript-code-scanning.qls$/);
+        t.regex(config.queries["javascript"].custom[0], /.*\/foo$/);
+    });
+});
+ava_1.default("Queries from config file can be overridden in workflow file", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const inputFileContents = `
+      name: my config
+      queries:
+        - uses: ./foo`;
+        const configFilePath = createConfigFile(inputFileContents, tmpDir);
+        // This config item should take precedence over the config file but shouldn't affect the default queries.
+        const queries = "./override";
+        fs.mkdirSync(path.join(tmpDir, "foo"));
+        fs.mkdirSync(path.join(tmpDir, "override"));
+        const resolveQueriesArgs = [];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return queriesToResolvedQueryForm(queries);
+            },
+        });
+        const languages = [languages_1.Language.javascript];
+        const config = await configUtils.initConfig(languages, queries, configFilePath, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Check resolveQueries was called correctly
+        // It'll be called once for the default queries and once for `./override`,
+        // but won't be called for './foo' from the config file.
+        t.deepEqual(resolveQueriesArgs.length, 2);
+        t.deepEqual(resolveQueriesArgs[1].queries.length, 1);
+        t.regex(resolveQueriesArgs[1].queries[0], /.*\/override$/);
+        // Now check that the end result contains only the default queries and the override query
+        t.deepEqual(config.queries["javascript"].builtin.length, 1);
+        t.deepEqual(config.queries["javascript"].custom.length, 1);
+        t.regex(config.queries["javascript"].builtin[0], /javascript-code-scanning.qls$/);
+        t.regex(config.queries["javascript"].custom[0], /.*\/override$/);
+    });
+});
+ava_1.default("Queries in workflow file can be used in tandem with the 'disable default queries' option", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env["RUNNER_TEMP"] = tmpDir;
+        process.env["GITHUB_WORKSPACE"] = tmpDir;
+        const inputFileContents = `
+      name: my config
+      disable-default-queries: true`;
+        const configFilePath = createConfigFile(inputFileContents, tmpDir);
+        const queries = "./workflow-query";
+        fs.mkdirSync(path.join(tmpDir, "workflow-query"));
+        const resolveQueriesArgs = [];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return queriesToResolvedQueryForm(queries);
+            },
+        });
+        const languages = [languages_1.Language.javascript];
+        const config = await configUtils.initConfig(languages, queries, configFilePath, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Check resolveQueries was called correctly
+        // It'll be called once for `./workflow-query`,
+        // but won't be called for the default one since that was disabled
+        t.deepEqual(resolveQueriesArgs.length, 1);
+        t.deepEqual(resolveQueriesArgs[0].queries.length, 1);
+        t.regex(resolveQueriesArgs[0].queries[0], /.*\/workflow-query$/);
+        // Now check that the end result contains only the workflow query, and not the default one
+        t.deepEqual(config.queries["javascript"].builtin.length, 0);
+        t.deepEqual(config.queries["javascript"].custom.length, 1);
+        t.regex(config.queries["javascript"].custom[0], /.*\/workflow-query$/);
+    });
+});
+ava_1.default("Multiple queries can be specified in workflow file, no config file required", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        fs.mkdirSync(path.join(tmpDir, "override1"));
+        fs.mkdirSync(path.join(tmpDir, "override2"));
+        const queries = "./override1,./override2";
+        const resolveQueriesArgs = [];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return queriesToResolvedQueryForm(queries);
+            },
+        });
+        const languages = [languages_1.Language.javascript];
+        const config = await configUtils.initConfig(languages, queries, undefined, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Check resolveQueries was called correctly:
+        // It'll be called once for the default queries,
+        // and then once for each of the two queries from the workflow
+        t.deepEqual(resolveQueriesArgs.length, 3);
+        t.deepEqual(resolveQueriesArgs[1].queries.length, 1);
+        t.deepEqual(resolveQueriesArgs[2].queries.length, 1);
+        t.regex(resolveQueriesArgs[1].queries[0], /.*\/override1$/);
+        t.regex(resolveQueriesArgs[2].queries[0], /.*\/override2$/);
+        // Now check that the end result contains both the queries from the workflow, as well as the defaults
+        t.deepEqual(config.queries["javascript"].builtin.length, 1);
+        t.deepEqual(config.queries["javascript"].custom.length, 2);
+        t.regex(config.queries["javascript"].builtin[0], /javascript-code-scanning.qls$/);
+        t.regex(config.queries["javascript"].custom[0], /.*\/override1$/);
+        t.regex(config.queries["javascript"].custom[1], /.*\/override2$/);
+    });
+});
+ava_1.default("Queries in workflow file can be added to the set of queries without overriding config file", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env["RUNNER_TEMP"] = tmpDir;
+        process.env["GITHUB_WORKSPACE"] = tmpDir;
+        const inputFileContents = `
+      name: my config
+      queries:
+        - uses: ./foo`;
+        const configFilePath = createConfigFile(inputFileContents, tmpDir);
+        // These queries shouldn't override anything, because the value is prefixed with "+"
+        const queries = "+./additional1,./additional2";
+        fs.mkdirSync(path.join(tmpDir, "foo"));
+        fs.mkdirSync(path.join(tmpDir, "additional1"));
+        fs.mkdirSync(path.join(tmpDir, "additional2"));
+        const resolveQueriesArgs = [];
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return queriesToResolvedQueryForm(queries);
+            },
+        });
+        const languages = [languages_1.Language.javascript];
+        const config = await configUtils.initConfig(languages, queries, configFilePath, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        // Check resolveQueries was called correctly
+        // It'll be called once for the default queries,
+        // once for each of additional1 and additional2,
+        // and once for './foo' from the config file
+        t.deepEqual(resolveQueriesArgs.length, 4);
+        t.deepEqual(resolveQueriesArgs[1].queries.length, 1);
+        t.regex(resolveQueriesArgs[1].queries[0], /.*\/additional1$/);
+        t.deepEqual(resolveQueriesArgs[2].queries.length, 1);
+        t.regex(resolveQueriesArgs[2].queries[0], /.*\/additional2$/);
+        t.deepEqual(resolveQueriesArgs[3].queries.length, 1);
+        t.regex(resolveQueriesArgs[3].queries[0], /.*\/foo$/);
+        // Now check that the end result contains all the queries
+        t.deepEqual(config.queries["javascript"].builtin.length, 1);
+        t.deepEqual(config.queries["javascript"].custom.length, 3);
+        t.regex(config.queries["javascript"].builtin[0], /javascript-code-scanning.qls$/);
+        t.regex(config.queries["javascript"].custom[0], /.*\/additional1$/);
+        t.regex(config.queries["javascript"].custom[1], /.*\/additional2$/);
+        t.regex(config.queries["javascript"].custom[2], /.*\/foo$/);
+    });
+});
+ava_1.default("Invalid queries in workflow file handled correctly", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const queries = "foo/bar@v1@v3";
+        const languages = [languages_1.Language.javascript];
+        // This function just needs to be type-correct; it doesn't need to do anything,
+        // since we're deliberately passing in invalid data
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries(_queries, _extraSearchPath) {
+                return {
+                    byLanguage: {
+                        javascript: {},
+                    },
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        try {
+            await configUtils.initConfig(languages, queries, undefined, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            t.fail("initConfig did not throw error");
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getQueryUsesInvalid(undefined, "foo/bar@v1@v3")));
+        }
+    });
+});
+ava_1.default("API client used when reading remote config", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const codeQL = codeql_1.setCodeQL({
+            async resolveQueries() {
+                return {
+                    byLanguage: {
+                        javascript: {
+                            "foo.ql": {},
+                        },
+                    },
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        const inputFileContents = `
+      name: my config
+      disable-default-queries: true
+      queries:
+        - uses: ./
+        - uses: ./foo
+        - uses: foo/bar@dev
+      paths-ignore:
+        - a
+        - b
+      paths:
+        - c/d`;
+        const dummyResponse = {
+            content: Buffer.from(inputFileContents).toString("base64"),
+        };
+        const spyGetContents = mockGetContents(dummyResponse);
+        // Create checkout directory for remote queries repository
+        fs.mkdirSync(path.join(tmpDir, "foo/bar/dev"), { recursive: true });
+        const configFile = "octo-org/codeql-config/config.yaml@main";
+        const languages = [languages_1.Language.javascript];
+        await configUtils.initConfig(languages, undefined, configFile, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        t.assert(spyGetContents.called);
+    });
+});
+ava_1.default("Remote config handles the case where a directory is provided", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const dummyResponse = []; // directories are returned as arrays
+        mockGetContents(dummyResponse);
+        const repoReference = "octo-org/codeql-config/config.yaml@main";
+        try {
+            await configUtils.initConfig([], undefined, repoReference, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            throw new Error("initConfig did not throw error");
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileDirectoryGivenMessage(repoReference)));
+        }
+    });
+});
+ava_1.default("Invalid format of remote config handled correctly", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const dummyResponse = {
+        // note no "content" property here
+        };
+        mockGetContents(dummyResponse);
+        const repoReference = "octo-org/codeql-config/config.yaml@main";
+        try {
+            await configUtils.initConfig([], undefined, repoReference, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            throw new Error("initConfig did not throw error");
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileFormatInvalidMessage(repoReference)));
+        }
+    });
+});
+ava_1.default("No detected languages", async (t) => {
+    mockListLanguages([]);
+    try {
+        await languages_1.getLanguages(undefined, { owner: "github", repo: "example " }, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        throw new Error("initConfig did not throw error");
+    }
+    catch (err) {
+        t.deepEqual(err, new Error(languages_1.getNoLanguagesError()));
+    }
+});
+ava_1.default("Unknown languages", async (t) => {
+    const languages = "ruby,english";
+    try {
+        await languages_1.getLanguages(languages, { owner: "github", repo: "example " }, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        throw new Error("initConfig did not throw error");
+    }
+    catch (err) {
+        t.deepEqual(err, new Error(languages_1.getUnknownLanguagesError(["ruby", "english"])));
+    }
+});
+function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGenerator) {
+    ava_1.default(`load invalid input - ${testName}`, async (t) => {
+        return await util.withTmpDir(async (tmpDir) => {
+            const codeQL = codeql_1.setCodeQL({
+                async resolveQueries() {
+                    return {
+                        byLanguage: {},
+                        noDeclaredLanguage: {},
+                        multipleDeclaredLanguages: {},
+                    };
+                },
+            });
+            const languages = [languages_1.Language.javascript];
+            const configFile = "input";
+            const inputFile = path.join(tmpDir, configFile);
+            fs.writeFileSync(inputFile, inputFileContents, "utf8");
+            try {
+                await configUtils.initConfig(languages, undefined, configFile, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+                throw new Error("initConfig did not throw error");
+            }
+            catch (err) {
+                t.deepEqual(err, new Error(expectedErrorMessageGenerator(inputFile)));
+            }
+        });
+    });
+}
+doInvalidInputTest("name invalid type", `
+  name:
+    - foo: bar`, configUtils.getNameInvalid);
+doInvalidInputTest("disable-default-queries invalid type", `disable-default-queries: 42`, configUtils.getDisableDefaultQueriesInvalid);
+doInvalidInputTest("queries invalid type", `queries: foo`, configUtils.getQueriesInvalid);
+doInvalidInputTest("paths-ignore invalid type", `paths-ignore: bar`, configUtils.getPathsIgnoreInvalid);
+doInvalidInputTest("paths invalid type", `paths: 17`, configUtils.getPathsInvalid);
+doInvalidInputTest("queries uses invalid type", `
+  queries:
+  - uses:
+      - hello: world`, configUtils.getQueryUsesInvalid);
+function doInvalidQueryUsesTest(input, expectedErrorMessageGenerator) {
+    // Invalid contents of a "queries.uses" field.
+    // Should fail with the expected error message
+    const inputFileContents = `
+    name: my config
+    queries:
+      - name: foo
+        uses: ${input}`;
+    doInvalidInputTest(`queries uses "${input}"`, inputFileContents, expectedErrorMessageGenerator);
+}
+// Various "uses" fields, and the errors they should produce
+doInvalidQueryUsesTest("''", (c) => configUtils.getQueryUsesInvalid(c, undefined));
+doInvalidQueryUsesTest("foo/bar", (c) => configUtils.getQueryUsesInvalid(c, "foo/bar"));
+doInvalidQueryUsesTest("foo/bar@v1@v2", (c) => configUtils.getQueryUsesInvalid(c, "foo/bar@v1@v2"));
+doInvalidQueryUsesTest("foo@master", (c) => configUtils.getQueryUsesInvalid(c, "foo@master"));
+doInvalidQueryUsesTest("https://github.com/foo/bar@master", (c) => configUtils.getQueryUsesInvalid(c, "https://github.com/foo/bar@master"));
+doInvalidQueryUsesTest("./foo", (c) => configUtils.getLocalPathDoesNotExist(c, "foo"));
+doInvalidQueryUsesTest("./..", (c) => configUtils.getLocalPathOutsideOfRepository(c, ".."));
+const validPaths = [
+    "foo",
+    "foo/",
+    "foo/**",
+    "foo/**/",
+    "foo/**/**",
+    "foo/**/bar/**/baz",
+    "**/",
+    "**/foo",
+    "/foo",
+];
+const invalidPaths = ["a/***/b", "a/**b", "a/b**", "**"];
+ava_1.default("path validations", (t) => {
+    // Dummy values to pass to validateAndSanitisePath
+    const propertyName = "paths";
+    const configFile = "./.github/codeql/config.yml";
+    for (const path of validPaths) {
+        t.truthy(configUtils.validateAndSanitisePath(path, propertyName, configFile, logging_1.getRunnerLogger(true)));
+    }
+    for (const path of invalidPaths) {
+        t.throws(() => configUtils.validateAndSanitisePath(path, propertyName, configFile, logging_1.getRunnerLogger(true)));
+    }
+});
+ava_1.default("path sanitisation", (t) => {
+    // Dummy values to pass to validateAndSanitisePath
+    const propertyName = "paths";
+    const configFile = "./.github/codeql/config.yml";
+    // Valid paths are not modified
+    t.deepEqual(configUtils.validateAndSanitisePath("foo/bar", propertyName, configFile, logging_1.getRunnerLogger(true)), "foo/bar");
+    // Trailing stars are stripped
+    t.deepEqual(configUtils.validateAndSanitisePath("foo/**", propertyName, configFile, logging_1.getRunnerLogger(true)), "foo/");
+});
+//# sourceMappingURL=config-utils.test.js.map