Make an all-in-one action

A more easy to use action that runs the 'init' step as
a 'pre' script and the 'analyze' step as the 'main' script.

.editorconfig

@@ -1,10 +0,0 @@
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.ts]
-indent_style = space
-indent_size = 2

.git-blame-ignore-revs

@@ -1,3 +0,0 @@
-# .git-blame-ignore-revs
-# Added trailing commas to adhere to new eslint rules
-b16296be30e150034524d6dd0b0418fc6b184267

.gitattributes

@@ -1,9 +1 @@
 lib/*.js linguist-generated=true
-.github/workflows/__* linguist-generated=true
-
-# Reduce incidence of needless merge conflicts on CHANGELOG.md
-# The man page at
-# https://mirrors.edge.kernel.org/pub/software/scm/git/docs/gitattributes.html
-# suggests that this might interleave lines arbitrarily, but empirically
-# it keeps added chunks contiguous
-CHANGELOG.md                merge=union

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +0,0 @@
-blank_issues_enabled: true
-contact_links:
-  - name: Contact GitHub Support
-    url: https://support.github.com/request
-    about: Contact Support 

.github/actions/check-codescanning-config/action.yml

@@ -1,72 +0,0 @@
-name: Check Code-Scanning Config
-description: |
-    Checks the code scanning configuration file generated by the
-    action to ensure it contains the expected contents
-inputs:
-  languages:
-    required: false
-    description: The languages field passed to the init action.
-
-  packs:
-    required: false
-    description: The packs field passed to the init action.
-
-  queries:
-    required: false
-    description: The queries field passed to the init action.
-
-  config-file-test:
-    required: false
-    description: |
-      The location of the config file to use. If empty,
-      then no config file is used.
-
-  expected-config-file-contents:
-    required: true
-    description: |
-      A JSON string containing the exact contents of the config file.
-
-  tools:
-    required: true
-    description: |
-      The version of CodeQL passed to the `tools` input of the init action.
-      This can be any of the following:
-
-      - A local path to a tarball containing the CodeQL tools, or
-      - A URL to a GitHub release assets containing the CodeQL tools, or
-      - A special value `linked` which is forcing the use of the CodeQL tools
-        that the action has been bundled with.
-
-      If not specified, the Action will check in several places until it finds
-      the CodeQL tools.
-
-runs:
-  using: composite
-  steps:
-    - uses: ./../action/init
-      with:
-        languages: ${{ inputs.languages }}
-        config-file: ${{ inputs.config-file-test }}
-        queries: ${{ inputs.queries }}
-        packs: ${{ inputs.packs }}
-        tools: ${{ inputs.tools }}
-        db-location: ${{ runner.temp }}/codescanning-config-cli-test
-      env:
-        CODEQL_ACTION_TEST_MODE: 'true'
-
-    - name: Install dependencies
-      shell: bash
-      run: npm install --location=global ts-node js-yaml
-
-    - name: Check config
-      working-directory: ${{ github.action_path }}
-      shell: bash
-      env:
-        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
-      run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
-    - name: Clean up
-      shell: bash
-      if: always()
-      run: |
-        rm -rf $RUNNER_TEMP/codescanning-config-cli-test
-        rm -rf $RUNNER_TEMP/user-config.yaml

.github/actions/check-codescanning-config/index.ts

@@ -1,49 +0,0 @@
-
-import * as core from '@actions/core'
-import * as yaml from 'js-yaml'
-import * as fs from 'fs'
-import * as assert from 'assert'
-
-const actualConfig = loadActualConfig()
-
-function sortConfigArrays(config) {
-  for (const key of Object.keys(config)) {
-    const value = config[key];
-    if (key === 'queries' && Array.isArray(value)) {
-      config[key] = value.sort();
-    }
-  }
-  return config;
-}
-
-const rawExpectedConfig = process.argv[3].trim()
-if (!rawExpectedConfig) {
-  core.setFailed('No expected configuration provided')
-} else {
-  core.startGroup('Expected generated user config')
-  core.info(yaml.dump(JSON.parse(rawExpectedConfig)))
-  core.endGroup()
-}
-
-const expectedConfig = rawExpectedConfig ? JSON.parse(rawExpectedConfig) : undefined;
-
-assert.deepStrictEqual(
-  sortConfigArrays(actualConfig),
-  sortConfigArrays(expectedConfig),
-  'Expected configuration does not match actual configuration'
-);
-
-
-function loadActualConfig() {
-  if (!fs.existsSync(process.argv[2])) {
-    core.info('No configuration file found')
-    return undefined
-  } else {
-    const rawActualConfig = fs.readFileSync(process.argv[2], 'utf8')
-    core.startGroup('Actual generated user config')
-    core.info(rawActualConfig)
-    core.endGroup()
-
-    return yaml.load(rawActualConfig)
-  }
-}

.github/actions/check-sarif/action.yml

@@ -1,20 +0,0 @@
-name: Check SARIF
-description: Checks a SARIF file to see if certain queries were run and others were not run.
-inputs:
-  sarif-file:
-    required: true
-    description: The SARIF file to check
-
-  queries-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should be included in this SARIF file.
-
-  queries-not-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should NOT be included in this SARIF file.
-
-runs:
-  using: node24
-  main: index.js

.github/actions/check-sarif/index.js

@@ -1,43 +0,0 @@
-'use strict'
-
-const core = require('@actions/core')
-const fs = require('fs')
-
-const sarif = JSON.parse(fs.readFileSync(core.getInput('sarif-file'), 'utf8'))
-const rules = sarif.runs[0].tool.extensions.flatMap(ext => ext.rules || [])
-const ruleIds = rules.map(rule => rule.id)
-
-// Check that all the expected queries ran
-const expectedQueriesRun = getQueryIdsInput('queries-run')
-const queriesThatShouldHaveRunButDidNot = expectedQueriesRun.filter(queryId => !ruleIds.includes(queryId))
-
-if (queriesThatShouldHaveRunButDidNot.length > 0) {
-  core.setFailed(`The following queries were expected to run but did not: ${queriesThatShouldHaveRunButDidNot.join(', ')}`)
-}
-
-// Check that all the unexpected queries did not run
-const expectedQueriesNotRun = getQueryIdsInput('queries-not-run')
-
-const queriesThatShouldNotHaveRunButDid = expectedQueriesNotRun.filter(queryId => ruleIds.includes(queryId))
-
-if (queriesThatShouldNotHaveRunButDid.length > 0) {
-  core.setFailed(`The following queries were NOT expected to have run but did: ${queriesThatShouldNotHaveRunButDid.join(', ')}`)
-}
-
-
-core.startGroup('All queries run')
-rules.forEach(rule => {
-  core.info(`${rule.id}: ${(rule.properties && rule.properties.name) || rule.name}`)
-})
-core.endGroup()
-
-core.startGroup('Full SARIF')
-core.info(JSON.stringify(sarif, null, 2))
-core.endGroup()
-
-function getQueryIdsInput(name) {
-  return core.getInput(name)
-    .split(',')
-    .map(q => q.trim())
-    .filter(q => q.length > 0)
-}

.github/actions/prepare-mergeback-branch/action.yml

@@ -1,104 +0,0 @@
-name: "Prepare mergeback branch"
-description: Prepares a mergeback branch and opens a PR for it
-inputs:
-  base:
-    description: "The name of the base branch"
-    required: true
-  head:
-    description: "The name of the head branch"
-    required: true
-  branch:
-    description: "The name of the branch to create."
-    required: true
-  version:
-    description: "The new version"
-    required: true
-  token:
-    description: "The token to use"
-    required: true
-  dry-run:
-    description: "Set to true to skip creating the PR. The branch will still be pushed."
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Create mergeback branch
-      shell: bash
-      env:
-        VERSION: "${{ inputs.version }}"
-        NEW_BRANCH: "${{ inputs.branch }}"
-      run: |
-        set -exu
-
-        # Ensure we are on the new branch
-        git checkout "${NEW_BRANCH}"
-
-        # Update the version number ready for the next release
-        npm version patch --no-git-tag-version
-
-        # Update the changelog, adding a new version heading directly above the most recent existing one
-        awk '!f && /##/{print "'"## [UNRELEASED]\n\nNo user facing changes.\n"'"; f=1}1' CHANGELOG.md > temp && mv temp CHANGELOG.md
-        git add .
-        git commit -m "Update changelog and version after ${VERSION}"
-
-    # Update the build artifacts with the new version number
-    - name: Rebuild the Action
-      shell: bash
-      run: |
-        set -exu
-        npm ci
-        npm run build
-
-    - name: Check for rebuild changes
-      id: rebuild_changes
-      shell: bash
-      run: |
-        set -exu
-        git add --all
-        if git diff --cached --quiet; then
-          echo "has_changes=false" >> "${GITHUB_OUTPUT}"
-        else
-          echo "has_changes=true" >> "${GITHUB_OUTPUT}"
-        fi
-
-    - name: Commit rebuild
-      if: steps.rebuild_changes.outputs.has_changes == 'true'
-      shell: bash
-      run: |
-        set -exu
-        git commit -m "Rebuild"
-
-    - name: Push mergeback branch
-      shell: bash
-      env:
-        NEW_BRANCH: "${{ inputs.branch }}"
-      run: git push origin "${NEW_BRANCH}"
-
-    - name: Create PR
-      shell: bash
-      if: inputs.dry-run != 'true'
-      env:
-        VERSION: "${{ inputs.version }}"
-        BASE_BRANCH: "${{ inputs.base }}"
-        HEAD_BRANCH: "${{ inputs.head }}"
-        NEW_BRANCH: "${{ inputs.branch }}"
-        GITHUB_TOKEN: "${{ inputs.token }}"
-      run: |
-        set -exu
-        pr_title="Mergeback ${VERSION} ${HEAD_BRANCH} into ${BASE_BRANCH}"
-        pr_body=$(cat << EOF
-          This PR bumps the version number and updates the changelog after the ${VERSION} release.
-
-          Please do the following:
-
-          - [ ] Approve running the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".
-        EOF
-        )
-
-        gh pr create \
-          --head "${NEW_BRANCH}" \
-          --base "${BASE_BRANCH}" \
-          --title "${pr_title}" \
-          --body "${pr_body}" \
-          --assignee "${GITHUB_ACTOR}"

.github/actions/prepare-test/action.yml

@@ -1,79 +0,0 @@
-name: "Prepare test"
-description: Performs some preparation to run tests
-inputs:
-  version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'toolcache', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
-    required: true
-  use-all-platform-bundle:
-    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
-    required: false
-  setup-kotlin:
-    description: "If true, we setup kotlin"
-    default: 'true'
-    required: true
-outputs:
-  tools-url:
-    description: "The value that should be passed as the 'tools' input of the 'init' step."
-    value: ${{ steps.get-url.outputs.tools-url }}
-runs:
-  using: composite
-  steps:
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-        mv ../action/.github/workflows .github
-    - id: get-url
-      name: Determine URL
-      shell: bash
-      env:
-        VERSION: ${{ inputs.version }}
-        USE_ALL_PLATFORM_BUNDLE: ${{ inputs.use-all-platform-bundle }}
-      run: |
-        set -e # Fail this Action if `gh release list` fails.
-
-        if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
-          echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "linked" ]]; then
-          echo "tools-url=linked" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "toolcache" ]]; then
-          echo "tools-url=toolcache" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "default" ]]; then
-          echo "tools-url=" >> "$GITHUB_OUTPUT"
-          exit 0
-        fi
-
-        if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
-          artifact_name="codeql-bundle.tar.gz"
-        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          artifact_name="codeql-bundle-linux64.tar.gz"
-        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          artifact_name="codeql-bundle-osx64.tar.gz"
-        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          artifact_name="codeql-bundle-win64.tar.gz"
-        else
-          echo "::error::Unrecognized OS $RUNNER_OS"
-          exit 1
-        fi
-
-        if [[ "$VERSION" == *"nightly"* ]]; then
-          version=`echo "$VERSION" | sed -e 's/^.*\-//'`
-          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
-        elif [[ "$VERSION" == *"stable"* ]]; then
-          version=`echo "$VERSION" | sed -e 's/^.*\-//'`
-          echo "tools-url=https://github.com/github/codeql-action/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
-        else
-          echo "::error::Unrecognized version specified!"
-          exit 1
-        fi
-
-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
-      if: ${{ inputs.setup-kotlin == 'true' }}
-      with:
-        version: 1.8.21

.github/actions/query-filter-test/action.yml

@@ -1,62 +0,0 @@
-name: Query Filter Test
-description: Runs a test of query filters using the check SARIF action
-inputs:
-  sarif-file:
-    required: true
-    description: The SARIF file to check
-
-  queries-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should be included in this SARIF file.
-
-  queries-not-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should NOT be included in this SARIF file.
-
-  config-file:
-    required: true
-    description: |
-      The location of the codeql configuration file to use.
-
-  tools:
-    required: true
-    description: |
-      The version of CodeQL passed to the `tools` input of the init action.
-      This can be any of the following:
-
-      - A local path to a tarball containing the CodeQL tools, or
-      - A URL to a GitHub release assets containing the CodeQL tools, or
-      - A special value `linked` which is forcing the use of the CodeQL tools
-        that the action has been bundled with.
-
-      If not specified, the Action will check in several places until it finds
-      the CodeQL tools.
-
-runs:
-  using: composite
-  steps:
-    - uses: ./../action/init
-      with:
-        languages: javascript
-        config-file: ${{ inputs.config-file }}
-        tools: ${{ inputs.tools }}
-        db-location: ${{ runner.temp }}/query-filter-test
-      env:
-        CODEQL_ACTION_TEST_MODE: "true"
-    - uses: ./../action/analyze
-      with:
-        output: ${{ runner.temp }}/results
-        upload: never
-      env:
-        CODEQL_ACTION_TEST_MODE: "true"
-    - name: Check SARIF
-      uses: ./../action/.github/actions/check-sarif
-      with:
-        sarif-file:  ${{ inputs.sarif-file }}
-        queries-run: ${{ inputs.queries-run}}
-        queries-not-run: ${{ inputs.queries-not-run}}
-    - name: Cleanup after test
-      shell: bash
-      run: rm -rf "$RUNNER_TEMP/results" "$RUNNER_TEMP/query-filter-test"

.github/actions/release-branches/action.yml

@@ -1,28 +0,0 @@
-name: 'Release branches'
-description: 'Determine branches for release & backport'
-inputs:
-  major_version:
-    description: 'The version as extracted from the package.json file'
-    required: true
-  latest_tag:
-    description: 'The most recent tag published to the repository'
-    required: true
-outputs:
-  backport_source_branch:
-    description: "The release branch for the given tag"
-    value: ${{ steps.branches.outputs.backport_source_branch }}
-  backport_target_branches:
-    description: "JSON encoded list of branches to target with backports"
-    value: ${{ steps.branches.outputs.backport_target_branches }}
-runs:
-  using: "composite"
-  steps:
-    - id: branches
-      env:
-        MAJOR_VERSION: ${{ inputs.major_version }}
-        LATEST_TAG: ${{ inputs.latest_tag }}
-      run: |
-        npx tsx ./pr-checks/release-branches.ts \
-            --major-version "$MAJOR_VERSION" \
-            --latest-tag "$LATEST_TAG"
-      shell: bash

.github/actions/release-initialise/action.yml

@@ -1,32 +0,0 @@
-name: 'Prepare release job'
-description: 'Prepare for updating a release branch'
-
-runs:
-  using: "composite"
-  steps:
-
-    - name: Dump environment
-      run: env
-      shell: bash
-
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: '${{ toJson(github) }}'
-      run: echo "$GITHUB_CONTEXT"
-      shell: bash
-
-    - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 24
-        cache: 'npm'
-
-    - name: Install JavaScript dependencies
-      shell: bash
-      run: npm ci
-
-    - name: Update git config
-      run: |
-        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-        git config --global user.name "github-actions[bot]"
-      shell: bash

.github/actions/update-bundle/action.yml

@@ -1,14 +0,0 @@
-name: Update default CodeQL bundle
-description: Updates 'src/defaults.json' to point to a new CodeQL bundle release.
-
-runs:
-  using: composite
-  steps:
-    - name: Install ts-node
-      shell: bash
-      run: npm install -g ts-node
-
-    - name: Run update script
-      working-directory: ${{ github.action_path }}
-      shell: bash
-      run: ts-node ./index.ts

.github/actions/update-bundle/index.ts

@@ -1,67 +0,0 @@
-import * as fs from 'fs';
-import * as github from '@actions/github';
-
-interface BundleInfo {
-  bundleVersion: string;
-  cliVersion: string;
-}
-
-interface Defaults {
-  bundleVersion: string;
-  cliVersion: string;
-  priorBundleVersion: string;
-  priorCliVersion: string;
-}
-
-function getCodeQLCliVersionForRelease(release): string {
-  // We do not currently tag CodeQL bundles based on the CLI version they contain.
-  // Instead, we use a marker file `cli-version-<version>.txt` to record the CLI version.
-  // This marker file is uploaded as a release asset for all new CodeQL bundles.
-  const cliVersionsFromMarkerFiles = release.assets
-    .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
-    .filter((v) => v)
-    .map((v) => v as string);
-  if (cliVersionsFromMarkerFiles.length > 1) {
-    throw new Error(
-      `Release ${release.tag_name} has multiple CLI version marker files.`
-    );
-  } else if (cliVersionsFromMarkerFiles.length === 0) {
-    throw new Error(
-      `Failed to find the CodeQL CLI version for release ${release.tag_name}.`
-    );
-  }
-  return cliVersionsFromMarkerFiles[0];
-}
-
-async function getBundleInfoFromRelease(release): Promise<BundleInfo> {
-  return {
-    bundleVersion: release.tag_name,
-    cliVersion: getCodeQLCliVersionForRelease(release)
-  };
-}
-
-async function getNewDefaults(currentDefaults: Defaults): Promise<Defaults> {
-  const release = github.context.payload.release;
-  console.log('Updating default bundle as a result of the following release: ' +
-    `${JSON.stringify(release)}.`)
-
-  const bundleInfo = await getBundleInfoFromRelease(release);
-  return {
-    bundleVersion: bundleInfo.bundleVersion,
-    cliVersion: bundleInfo.cliVersion,
-    priorBundleVersion: currentDefaults.bundleVersion,
-    priorCliVersion: currentDefaults.cliVersion
-  };
-}
-
-async function main() {
-  const previousDefaults: Defaults = JSON.parse(fs.readFileSync('../../../src/defaults.json', 'utf8'));
-  const newDefaults = await getNewDefaults(previousDefaults);
-  // Update the source file in the repository. Calling workflows should subsequently rebuild
-  // the Action to update `lib/defaults.json`.
-  fs.writeFileSync('../../../src/defaults.json', JSON.stringify(newDefaults, null, 2) + "\n");
-}
-
-// Ideally, we'd await main() here, but that doesn't work well with `ts-node`.
-// So instead we rely on the fact that Node won't exit until the event loop is empty.
-main();

.github/actions/verify-debug-artifact-scan-completed/action.yml

@@ -1,6 +0,0 @@
-name: Verify that the best-effort debug artifact scan completed
-description: Verifies that the best-effort debug artifact scan completed successfully during tests
-runs:
-  using: node24
-  main: index.js
-  post: post.js

.github/actions/verify-debug-artifact-scan-completed/index.js

@@ -1,2 +0,0 @@
-// The main step is a no-op, since we can only verify artifact scan completion in the post step.
-console.log("Will verify artifact scan completion in the post step.");

.github/actions/verify-debug-artifact-scan-completed/post.js

@@ -1,11 +0,0 @@
-// Post step - runs after the workflow completes, when artifact scan has finished
-const process = require("process");
-
-const scanFinished = process.env.CODEQL_ACTION_ARTIFACT_SCAN_FINISHED;
-
-if (scanFinished !== "true") {
-  console.error("Error: Best-effort artifact scan did not complete. Expected CODEQL_ACTION_ARTIFACT_SCAN_FINISHED=true");
-  process.exit(1);
-}
-
-console.log("✓ Best-effort artifact scan completed successfully");

.github/codeql/codeql-config-javascript.yml

@@ -1,17 +0,0 @@
-name: "CodeQL config"
-queries:
-  - name: Run custom queries
-    uses: ./queries
-  # Run all extra query suites, both because we want to
-  # and because it'll act as extra testing. This is why
-  # we include both even though one is a superset of the
-  # other, because we're testing the parsing logic and
-  # that the suites exist in the codeql bundle.
-  - uses: security-and-quality
-  - uses: security-experimental
-  - uses: security-extended
-paths-ignore:
-  - lib
-  - tests
-  - "**/*.test.ts"
-  - "**/testing-util.ts"

.github/codeql/codeql-config.yml

@@ -0,0 +1,4 @@
+me: "CodeQL config"
+queries: 
+  - name: Run custom queries
+    uses: ./queries

.github/copilot-instructions.md

@@ -1,40 +0,0 @@
-# CodeQL Action - Copilot Instructions
-
-The CodeQL Action is used in GitHub Actions workflows to run CodeQL scans using the CodeQL CLI.
-
-## Overview
-
-- The repository contains two TypeScript projects.
-- The main TypeScript codebase is in the `src` directory, with accompanying unit tests in `.test.ts` files in the same directory.
-- The main codebase is compiled to bundled JavaScript code, which is also contained in the repository in the `lib` directory.
-- A secondary TypeScript codebase with scripts that are only used for development purposes or by CI is in the `pr-checks` directory. This codebase is not compiled to bundled JavaScript. It is executed directly with `tsx`, which handles compilation internally.
-
-## Review instructions
-
-- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Word your comments constructively as suggestions for improvements. Do not word suggestions as commands.
-- If you want to comment on a change that you believe will fail a CI check, do not present the CI failure you expect as a fact. Instead, write that you think a change "may" lead to a failure in CI. Suggest that, if such a failure manifests, the changes you are commenting on may be the place responsible for the failure and are worth looking at.
-- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one.
-- If a change is a net improvement, for example because it improves on an existing limitation of existing code, do not complain about pre-existing problems that remain. You may comment on them, but you should make it clear that the thing you are commenting on is not new by writing e.g. "Not new in this PR, but [..]" followed by your description of the issue and a suggestion that it could be improved at the same time with e.g. "Consider whether this is worth addressing as part of this PR as well."
-
-## Generated code
-
-The main codebase of the CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from. The secondary TypeScript codebase has sources in the `pr-checks` directory, which are executed directly with `tsx` and not compiled to JavaScript in the `lib` folder.
-
-GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that start with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.
-
-## Release process
-
-Changes that are merged to the `main` branch are not used in production straight away. Instead, changes from `main` must first be released using the release process, which has to be manually triggered by a staff member. Therefore, it is possible for further changes to be made to the code after some changes have been merged to `main` but before they are released. Once the release process automation is started, a series of PRs are automatically generated:
-
-- A release-PR is a PR which matches all of the following patterns:
-
-  - PR title starts with the exact prefix: `Merge main into releases/v`
-    - Equivalent regex: `^Merge main into releases\/v`
-  - AND head (source) branch matches the update-branch pattern:
-    - Regex: `^update-v[0-9]+(?:\.[0-9]+)*(?:-[a-f0-9]+)?` (e.g. `update-v3.29.9-cc722e476`)
-  - AND base (target) branch matches a release branch:
-    - Regex: `^releases\/v` (e.g. `releases/v3`)
-
-- Consider all files in release-PRs to have already been reviewed and do not review them, except for the following two files:
-  - `CHANGELOG.md`
-  - `package.json`

.github/dependabot.yml

@@ -1,42 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directories:
-      - "/"
-      - "/pr-checks"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    labels:
-      - Rebuild
-    # Ignore incompatible dependency updates
-    ignore:
-      # This is broken due to the way configuration files have changed.
-      # This might be fixed when we move to eslint v9.
-      - dependency-name: "eslint-plugin-import"
-        versions: [">=2.30.0"]
-    groups:
-      npm-minor:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-  - package-ecosystem: github-actions
-    directories:
-      - "/.github/workflows"
-      - "/.github/actions"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    labels:
-      - Rebuild
-    groups:
-      actions-minor:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"

.github/instructions/release-merge.instructions.md

@@ -1,16 +0,0 @@
----
-applyTo: "CHANGELOG.md,src/defaults.json,lib/defaults.json,src/api-compatibility.json"
----
-
-# Merging release, mergeback, and backport PRs
-
-The release process creates a cascade of PRs (`main` → `releases/vN`, then
-`releases/vN` → `main` mergeback, then `releases/vN` → `releases/v(N-1)`
-backport). These PRs reliably touch `CHANGELOG.md`, `src/defaults.json` /
-`lib/defaults.json` (bundle/CLI version bump), and `src/api-compatibility.json`.
-
-Such PRs **must be merged with a merge commit**. Never squash or rebase, as
-that breaks the branch linkage the release automation relies on.
-
-When arming auto-merge on these PRs, use `--merge` (e.g. `gh pr merge --merge`),
-not `--squash` or `--rebase`.

.github/pull_request_template.md

@@ -1,82 +1,7 @@
-<!--
-    For GitHub staff: Remember that this is a public repository. Do not link to internal resources.
-                      If necessary, link to this PR from an internal issue and include further details there.
-
-    Everyone: Include a summary of the context of this change, what it aims to accomplish, and why you
-              chose the approach you did if applicable. Indicate any open questions you want to answer
-              during the review process and anything you want reviewers to pay particular attention to.
-
-    See https://github.com/github/codeql-action/blob/main/CONTRIBUTING.md for additional information.
--->
-
-### Risk assessment
-
-For internal use only. Please select the risk level of this change:
-
-- **Low risk:** Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
-- **High risk:** Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.
-
-#### Which use cases does this change impact?
-
-<!-- Delete options that don't apply. If in doubt, do not delete an option. -->
-
-Workflow types:
-
-- **Advanced setup** - Impacts users who have custom CodeQL workflows.
-- **Managed** - Impacts users with `dynamic` workflows (Default Setup, Code Quality, ...).
-
-Products:
-
-- **Code Scanning** - The changes impact analyses when `analysis-kinds: code-scanning`.
-- **Code Quality** - The changes impact analyses when `analysis-kinds: code-quality`.
-- **Other first-party** - The changes impact other first-party analyses.
-- **Third-party analyses** - The changes affect the `upload-sarif` action.
-
-Environments:
-
-- **Dotcom** - Impacts CodeQL workflows on `github.com` and/or GitHub Enterprise Cloud with Data Residency.
-- **GHES** - Impacts CodeQL workflows on GitHub Enterprise Server.
-- **Testing/None** - This change does not impact any CodeQL workflows in production.
-
-#### How did/will you validate this change?
-
-<!-- Delete options that don't apply. -->
-
-- **Test repository** - This change will be tested on a test repository before merging.
-- **Unit tests** - I am depending on unit test coverage (i.e. tests in `.test.ts` files).
-- **End-to-end tests** - I am depending on PR checks (i.e. tests in `pr-checks`).
-- **Other** - Please provide details.
-- **None** - I am not validating these changes.
-
-#### If something goes wrong after this change is released, what are the mitigation and rollback strategies?
-
-<!-- Delete strategies that don't apply. -->
-
-- **Feature flags** - All new or changed code paths can be fully disabled with corresponding feature flags.
-- **Rollback** - Change can only be disabled by rolling back the release or releasing a new version with a fix.
-- **Development/testing only** - This change cannot cause any failures in production.
-- **Other** - Please provide details.
-
-#### How will you know if something goes wrong after this change is released?
-
-<!-- Delete options that don't apply. -->
-
-- **Telemetry** - I rely on existing telemetry or have made changes to the telemetry.
-    - **Dashboards** - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
-    - **Alerts** - New or existing monitors will trip if something goes wrong with this change.
-- **Other** - Please provide details.
-
-#### Are there any special considerations for merging or releasing this change?
-
-<!--
-    Consider whether this change depends on a different change in another repository that should be released first.
--->
-
-- **No special considerations** - This change can be merged at any time.
-- **Special considerations** - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.
-
 ### Merge / deployment checklist
 
-- Confirm this change is backwards compatible with existing workflows.
-- Consider adding a [changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) entry for this change.
-- Confirm the [readme](https://github.com/github/codeql-action/blob/main/README.md) and docs have been updated if necessary.
+- Run test builds as necessary. Can be on this repository or elsewhere as needed in order to test the change - please include links to tests in other repos!
+  - [ ] CodeQL using init/analyze actions
+  - [ ] 3rd party tool using upload action
+- [ ] Confirm this change is backwards compatible with existing workflows.
+- [ ] Confirm the [readme](https://github.com/github/codeql-action/blob/master/README.md) has been updated if necessary.

.github/sizeup.yml

@@ -1,55 +0,0 @@
-labeling:
-  applyCategoryLabels: true
-  categoryLabelPrefix: "size/"
-
-commenting:
-  addCommentWhenScoreThresholdHasBeenExceeded: false
-
-sizeup:
-  categories:
-    - name: extra small
-      lte: 25
-      label:
-        name: XS
-        description: Should be very easy to review
-        color: 3cbf00
-    - name: small
-      lte: 100
-      label:
-        name: S
-        description: Should be easy to review
-        color: 5d9801
-    - name: medium
-      lte: 250
-      label:
-        name: M
-        description: Should be of average difficulty to review
-        color: 7f7203
-    - name: large
-      lte: 500
-      label:
-        name: L
-        description: May be hard to review
-        color: a14c05
-    - name: extra large
-      lte: 1000
-      label:
-        name: XL
-        description: May be very hard to review
-        color: c32607
-    - name: extra extra large
-      label:
-        name: XXL
-        description: May be extremely hard to review
-        color: e50009
-  ignoredFilePatterns:
-    - ".github/workflows/__*"
-    - "lib/**/*"
-    - "package-lock.json"
-  testFilePatterns:
-    - "**/*.test.ts"
-  scoring:
-    # This formula and the aliases below it are written in prefix notation.
-    # For an explanation of how this works, please see:
-    # https://github.com/lerebear/sizeup-core/blob/main/README.md#prefix-notation
-    formula: "- - + additions deletions comments whitespace"

.github/workflows/__go.yml

@@ -1,80 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: Manual Check - go
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  workflow_dispatch:
-    inputs:
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-jobs:
-  go-custom-queries:
-    name: 'Go: Custom queries'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-custom-queries.yml
-    with:
-      dotnet-version: ${{ inputs.dotnet-version }}
-      go-version: ${{ inputs.go-version }}
-  go-indirect-tracing-workaround-diagnostic:
-    name: 'Go: diagnostic when Go is changed after init step'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-indirect-tracing-workaround-no-file-program:
-    name: 'Go: diagnostic when `file` is not installed'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-indirect-tracing-workaround:
-    name: 'Go: workaround for indirect tracing'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-tracing-autobuilder:
-    name: 'Go: tracing with autobuilder step'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-tracing-autobuilder.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-tracing-custom-build-steps:
-    name: 'Go: tracing with custom build steps'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
-    with:
-      go-version: ${{ inputs.go-version }}
-  go-tracing-legacy-workflow:
-    name: 'Go: tracing with legacy workflow'
-    permissions:
-      contents: read
-      security-events: read
-    uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
-    with:
-      go-version: ${{ inputs.go-version }}

.github/workflows/check-expected-release-files.yml

@@ -1,33 +0,0 @@
-name: Check Expected Release Files
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/check-expected-release-files.yml
-      - src/defaults.json
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check-expected-release-files:
-    runs-on: ubuntu-slim
-
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout CodeQL Action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Check Expected Release Files
-        run: |
-          bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")"
-          set -x
-          for expected_file in "codeql-bundle.tar.gz" "codeql-bundle-linux64.tar.gz" "codeql-bundle-osx64.tar.gz" "codeql-bundle-win64.tar.gz"; do
-            curl --location --fail --head --request GET "https://github.com/github/codeql-action/releases/download/$bundle_version/$expected_file" > /dev/null
-          done

.github/workflows/codeql.yml

@@ -1,139 +1,17 @@
 name: "CodeQL action"
 
-on:
-  push:
-    branches: [main, releases/v*]
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    # Weekly on Sunday.
-    - cron: '30 1 * * 0'
-  workflow_dispatch:
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+on: [push]
 
 jobs:
-  # Identify the CodeQL tool versions to use in the analysis job.
-  check-codeql-versions:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    outputs:
-      versions: ${{ steps.compare.outputs.versions }}
-
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up default CodeQL bundle
-      id: setup-default
-      uses: ./setup-codeql
-    - name: Set up linked CodeQL bundle
-      id: setup-linked
-      uses: ./setup-codeql
-      with:
-        tools: linked
-    - name: Compare default and linked CodeQL bundle versions
-      id: compare
-      env:
-        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-      run: |
-        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
-
-        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-        # required status check.
-        #
-        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-        # the same as running with `tools: null`.
-        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-          VERSIONS_JSON='[null]'
-        else
-          VERSIONS_JSON='[null, "linked"]'
-        fi
-
-        # Output a JSON-encoded list with the distinct versions to test against.
-        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
-
-  analyze-javascript:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: [check-codeql-versions]
+  build:
     strategy:
-      fail-fast: false
       matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
-        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
+        os: [ubuntu-latest,windows-latest,macos-latest]
     runs-on: ${{ matrix.os }}
 
-    permissions:
-      contents: read
-      security-events: write
-
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      id: init
+    - uses: actions/checkout@v1
+    - uses: ./init
       with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config-javascript.yml
-        tools: ${{ matrix.tools }}
-    # confirm steps.init.outputs.codeql-path points to the codeql binary
-    - name: Print CodeQL Version
-      run: >
-        "$CODEQL" version --format=json
-      env:
-        CODEQL: ${{steps.init.outputs.codeql-path}}
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
-
-  analyze-other:
-    if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: none
-        config: >
-          paths-ignore:
-            - lib
-            - tests
-          queries:
-            - uses: security-and-quality
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:${{ matrix.language }}"
-        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+       config-file: ./.github/codeql/codeql-config.yml
+    - uses: ./analyze

.github/workflows/codescanning-config-cli.yml

@@ -1,227 +0,0 @@
-# Tests that the generated code scanning config file contains the expected contents
-
-name: Code-Scanning config CLI tests
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  # Diff informed queries add an additional query filter which is not yet
-  # taken into account by these tests.
-  CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
-
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  code-scanning-config-tests:
-    if: github.triggering_actor != 'dependabot[bot]'
-    continue-on-error: true
-
-    permissions:
-      contents: read
-      packages: read
-      security-events: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - os: ubuntu-latest
-          version: linked
-        - os: ubuntu-latest
-          version: default
-        - os: ubuntu-latest
-          version: nightly-latest
-
-    # Code-Scanning config not created because environment variable is not set
-    name: Code Scanning Configuration tests
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Set up Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: 24
-        cache: 'npm'
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-
-    - name: Empty file
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: "{}"
-        # Request multiple languages so later checks can reuse the combined bundle.
-        languages: javascript,python
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-            }
-          }
-        languages: javascript
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config overriden by input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql/javascript-queries"]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config merging with input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Multi-language packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-              "ruby": ["codeql/ruby-queries"]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript,ruby
-        config-file-test: .github/codeql/multi-language-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Other config properties
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "name": "Config using all properties",
-            "packs": ["codeql/javascript-queries" ],
-            "disable-default-queries": true,
-            "paths-ignore": ["xxx"],
-            "paths": ["yyy"]
-          }
-        languages: javascript
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/other-config-properties.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/debug-artifacts-failure-safe.yml

@@ -1,117 +0,0 @@
-# Checks logs, SARIF, and database bundle debug artifacts exist
-# when the analyze step fails.
-name: PR Check - Debug artifacts after failure
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  upload-artifacts:
-    if: github.triggering_actor != 'dependabot[bot]'
-    strategy:
-      fail-fast: false
-      matrix:
-        version:
-        - stable-v2.20.3
-        - default
-        - linked
-        - nightly-latest
-    name: Upload debug artifacts after failure in analyze
-    continue-on-error: true
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dump GitHub event
-        run: cat "${GITHUB_EVENT_PATH}"
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: ^1.13.1
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '9.x'
-      - name: Assert best-effort artifact scan completed
-        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
-      - uses: ./../action/init
-        with:
-          languages: cpp,csharp,go,java,javascript,python
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          debug: true
-          debug-artifact-name: my-debug-artifacts
-          debug-database-name: my-db
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
-        id: analysis
-        env:
-          # Forces a failure in this step.
-          CODEQL_ACTION_EXTRA_OPTIONS: '{ "database": { "finalize": ["--invalid-option"] } }'
-        with:
-          expect-error: true
-  download-and-check-artifacts:
-    name: Download and check debug artifacts after failure in analyze
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: upload-artifacts
-    timeout-minutes: 45
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      - name: Check expected artifacts exist
-        run: |
-          LANGUAGES="cpp csharp go java javascript python"
-          for version in $VERSIONS; do
-            echo "Artifacts from version $version:"
-            pushd "./my-debug-artifacts-${version//./}"
-            for language in $LANGUAGES; do
-              echo "- Checking $language"
-              if [[ ! -f "my-db-$language-partial.zip" ]] ; then
-                echo "Missing a partial database bundle for $language"
-                exit 1
-              fi
-              if [[ ! -d "log" ]] ; then
-                echo "Missing database initialization logs"
-                exit 1
-              fi
-              if [[ ! "$language" == "go" ]] && [[ ! -d "$language/log" ]] ; then
-                echo "Missing logs for $language"
-                exit 1
-              fi
-            done
-            popd
-          done
-        env:
-          GO111MODULE: auto

.github/workflows/debug-artifacts-safe.yml

@@ -1,111 +0,0 @@
-# Checks logs, SARIF, and database bundle debug artifacts exist.
-name: PR Check - Debug artifact upload
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  upload-artifacts:
-    if: github.triggering_actor != 'dependabot[bot]'
-    strategy:
-      fail-fast: false
-      matrix:
-        version:
-        - stable-v2.20.3
-        - default
-        - linked
-        - nightly-latest
-    name: Upload debug artifacts
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: ^1.13.1
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '9.x'
-      - name: Assert best-effort artifact scan completed
-        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
-      - uses: ./../action/init
-        id: init
-        with:
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          debug: true
-          debug-artifact-name: my-debug-artifacts
-          debug-database-name: my-db
-          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-          languages: cpp,csharp,go,java,javascript,python,ruby
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
-        id: analysis
-  download-and-check-artifacts:
-    name: Download and check debug artifacts
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs: upload-artifacts
-    timeout-minutes: 45
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      - name: Check expected artifacts exist
-        run: |
-          VERSIONS="stable-v2.20.3 default linked nightly-latest"
-          LANGUAGES="cpp csharp go java javascript python"
-          for version in $VERSIONS; do
-            pushd "./my-debug-artifacts-${version//./}"
-            echo "Artifacts from version $version:"
-            for language in $LANGUAGES; do
-              echo "- Checking $language"
-              if [[ ! -f "$language.sarif" ]] ; then
-                echo "Missing a SARIF file for $language"
-                exit 1
-              fi
-              if [[ ! -f "my-db-$language.zip" ]] ; then
-                echo "Missing a database bundle for $language"
-                exit 1
-              fi
-              if [[ ! -d "$language/log" ]] ; then
-                echo "Missing logs for $language"
-                exit 1
-              fi
-            done
-            popd
-          done
-        env:
-          GO111MODULE: auto

.github/workflows/deflake.yml

@@ -1,106 +0,0 @@
-# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
-# already passed CI before being merged. Therefore if they fail, we should make sure that there
-# wasn't a transient failure by rerunning the failed jobs once before investigating further.
-name: Deflake
-
-on:
-  workflow_run:
-    types: [completed]
-    # Exclude workflows that have significant side effects, like publishing releases. It's OK to
-    # retry CodeQL analysis.
-    workflows:
-      - Check Expected Release Files
-      - Code-Scanning config CLI tests
-      - CodeQL action
-      - Manual Check - go
-      - "PR Check - All-platform bundle"
-      - "PR Check - Analysis kinds"
-      - "PR Check - Analyze: 'ref' and 'sha' from inputs"
-      - "PR Check - autobuild-action"
-      - "PR Check - Autobuild direct tracing (custom working directory)"
-      - "PR Check - Autobuild working directory"
-      - "PR Check - Build mode autobuild"
-      - "PR Check - Build mode manual"
-      - "PR Check - Build mode none"
-      - "PR Check - Build mode rollback"
-      - "PR Check - Bundle: Caching checks"
-      - "PR Check - Bundle: From nightly"
-      - "PR Check - Bundle: From toolcache"
-      - "PR Check - Bundle: Zstandard checks"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
-      - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
-      - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
-      - "PR Check - Config export"
-      - "PR Check - Config input"
-      - "PR Check - Custom source root"
-      - "PR Check - Debug artifact upload"
-      - "PR Check - Debug artifacts after failure"
-      - "PR Check - Diagnostic export"
-      - "PR Check - Export file baseline information"
-      - "PR Check - Extractor ram and threads options test"
-      - "PR Check - Go: Custom queries"
-      - "PR Check - Go: diagnostic when Go is changed after init step"
-      - "PR Check - Go: diagnostic when `file` is not installed"
-      - "PR Check - Go: tracing with autobuilder step"
-      - "PR Check - Go: tracing with custom build steps"
-      - "PR Check - Go: tracing with legacy workflow"
-      - "PR Check - Go: workaround for indirect tracing"
-      - "PR Check - Job run UUID added to SARIF"
-      - "PR Check - Language aliases"
-      - "PR Check - Local CodeQL bundle"
-      - "PR Check - Multi-language repository"
-      - "PR Check - Overlay database init fallback"
-      - "PR Check - Packaging: Action input"
-      - "PR Check - Packaging: Config and input"
-      - "PR Check - Packaging: Config and input passed to the CLI"
-      - "PR Check - Packaging: Config file"
-      - "PR Check - Packaging: Download using registries"
-      - "PR Check - Proxy test"
-      - "PR Check - Remote config file"
-      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
-      - "PR Check - Ruby analysis"
-      - "PR Check - Rust analysis"
-      - "PR Check - Split workflow"
-      - "PR Check - Start proxy"
-      - "PR Check - Submit SARIF after failure"
-      - "PR Check - Swift analysis using a custom build command"
-      - "PR Check - Swift analysis using autobuild"
-      - "PR Check - Test different uses of `upload-sarif`"
-      - "PR Check - Test unsetting environment variables"
-      - "PR Check - Upload-sarif: ref and sha from inputs"
-      - "PR Check - Use a custom `checkout_path`"
-      - PR Checks
-      - Query filters tests
-      - Test that the workaround for python 3.12 on windows works
-
-jobs:
-  rerun-on-failure:
-    name: Rerun failed jobs
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      github.event.workflow_run.run_attempt == 1 &&
-      (
-        github.event.workflow_run.head_branch == 'main' ||
-        startsWith(github.event.workflow_run.head_branch, 'releases/') ||
-        github.event.workflow_run.event == 'merge_group'
-      )
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NAME: ${{ github.event.workflow_run.name }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          echo "Rerunning failed jobs for workflow run ${RUN_ID}"
-          gh run rerun "${RUN_ID}" --failed
-          echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/integration-testing.yml

@@ -0,0 +1,22 @@
+name: "Integration Testing"
+
+on: [push]
+
+jobs:
+  dispatch-events:
+    if: github.event.repository.full_name == 'github/codeql-action'
+    runs-on: ubuntu-latest
+    steps:
+    - name: Send repository dispatch events
+      run: |
+        curl -X POST \
+          -H "Authorization: Bearer ${{ secrets.CODEQL_TESTING_TOKEN }}" \
+          -H "Accept: application/vnd.github.everest-preview+json" \
+          https://api.github.com/repos/Anthophila/amazon-cognito-js-copy/dispatches \
+          -d '{"event_type":"codeql-integration","client_payload": {"sha": "${{ github.sha }}"}}'
+
+        curl -X POST \
+          -H "Authorization: Bearer ${{ secrets.CODEQL_TESTING_TOKEN }}" \
+          -H "Accept: application/vnd.github.everest-preview+json" \
+          https://api.github.com/repos/Anthophila/electron-test-action/dispatches \
+          -d '{"event_type":"codeql-integration","client_payload": {"sha": "${{ github.sha }}"}}'

.github/workflows/js-uptodate-check.yml

@@ -0,0 +1,27 @@
+name: "Check generated JavaScript"
+
+on: [pull_request]
+
+jobs:
+  check-js:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: Check generated JavaScript
+      run: |
+        # Sanity check that repo is clean to start with
+        if [ ! -z "$(git status --porcelain)" ]; then
+          # If we get a fail here then this workflow needs attention...
+          >&2 echo "Failed: Repo should be clean before testing!"
+          exit 1
+        fi
+        # Generate the JavaScript files
+        npm run-script build
+        # Check that repo is still clean
+        if [ ! -z "$(git status --porcelain)" ]; then
+          # If we get a fail here then the PR needs attention
+          >&2 echo "Failed: JavaScript files are not up to date. Run 'npm run-script build' to update"
+          exit 1
+        fi
+        echo "Success: JavaScript files are up to date"

.github/workflows/label-pr-size.yml

@@ -1,26 +0,0 @@
-name: Label PR with size
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - edited
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  sizeup:
-    name: Label PR with size
-    runs-on: ubuntu-slim
-    if: github.event.pull_request.merged != true
-
-    steps:
-      - name: Run sizeup
-        uses: lerebear/sizeup-action@b7beb3dd273e36039e16e48e7bc690c189e61951 # 0.8.12
-        with:
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          configuration-file-path: ".github/sizeup.yml"

.github/workflows/npm-test.yml

@@ -0,0 +1,12 @@
+name: "npm run-script test"
+
+on: [push]
+
+jobs:
+  npm-test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: npm run-script test
+      run: npm run-script test

.github/workflows/post-release-mergeback.yml

@@ -1,165 +0,0 @@
-# This workflow runs after a merge to any release branch of the action. It:
-# 1. Tags the merge commit on the release branch that represents the new release with an `vN.x.y`
-#    tag
-# 2. Updates the `vN` tag to refer to this merge commit.
-# 3. Iff vN == vLatest, merges any changes from the release back into the main branch.
-#    Typically, this is two commits – one to update the version number and one to rebuild.
-name: Tag release and merge back
-
-on:
-  workflow_dispatch:
-    inputs:
-      baseBranch:
-        description: 'The base branch to merge into'
-        default: main
-        required: false
-
-  push:
-    branches:
-      - releases/v*
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  merge-back:
-    runs-on: ubuntu-latest
-    environment: Automation
-    if: github.repository == 'github/codeql-action'
-    env:
-      BASE_BRANCH: "${{ github.event.inputs.baseBranch || 'main' }}"
-      HEAD_BRANCH: "${{ github.head_ref || github.ref }}"
-
-    permissions:
-      contents: write # needed to create tags and push commits
-      pull-requests: write
-
-    steps:
-      - name: Dump environment
-        run: env
-
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
-        run: echo "${GITHUB_CONTEXT}"
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install JavaScript dependencies
-        run: npm ci
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Get version and new branch
-        id: getVersion
-        run: |
-          VERSION="v$(jq '.version' -r 'package.json')"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          short_sha="${GITHUB_SHA:0:8}"
-          NEW_BRANCH="mergeback/${VERSION}-to-${BASE_BRANCH}-${short_sha}"
-          echo "newBranch=${NEW_BRANCH}" >> $GITHUB_OUTPUT
-          LATEST_RELEASE_BRANCH=$(git branch -r | grep -E "origin/releases/v[0-9]+$" | sed 's/origin\///g' | sort -V | tail -1 | xargs)
-          echo "latest_release_branch=${LATEST_RELEASE_BRANCH}" >> $GITHUB_OUTPUT
-
-      - name: Dump branches
-        env:
-          NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
-        run: |
-          echo "BASE_BRANCH ${BASE_BRANCH}"
-          echo "HEAD_BRANCH ${HEAD_BRANCH}"
-          echo "NEW_BRANCH ${NEW_BRANCH}"
-          echo "LATEST_RELEASE_BRANCH ${LATEST_RELEASE_BRANCH}"
-          echo "GITHUB_REF ${GITHUB_REF}"
-
-      - name: Create mergeback branch
-        env:
-          NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
-        run: |
-          git checkout -b "${NEW_BRANCH}"
-
-      - name: Check for tag
-        id: check
-        env:
-          VERSION: "${{ steps.getVersion.outputs.version }}"
-        run: |
-          set +e # don't fail on an errored command
-          git ls-remote --tags origin | grep "${VERSION}"
-          exists="$?"
-          if [ "${exists}" -eq 0 ]; then
-            echo "Tag ${VERSION} exists. Not going to re-release."
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "Tag ${VERSION} does not exist yet."
-          fi
-
-      # we didn't tag the release during the update-release-branch workflow because the
-      # commit that actually makes it to the release branch is a merge commit,
-      # and not yet known during the first workflow. We tag now because we know the correct commit.
-      - name: Tag release
-        if: steps.check.outputs.exists != 'true'
-        env:
-          VERSION: ${{ steps.getVersion.outputs.version }}
-        run: |
-          # Create the `vx.y.z` tag
-          git tag --annotate "${VERSION}" --message "${VERSION}"
-          # Update the `vx` tag
-          major_version_tag=$(cut -d '.' -f1 <<< "${VERSION}")
-          # Use `--force` to overwrite the major version tag
-          git tag --annotate "${major_version_tag}" --message "${major_version_tag}" --force
-          # Push the tags, using:
-          # - `--atomic` to make sure we either update both tags or neither (an intermediate state,
-          #   e.g. where we update the vN.x.y tag on the remote but not the vN tag, could result in
-          #   unwanted Dependabot updates, e.g. from vN to vN.x.y)
-          # - `--force` since we're overwriting the `vN` tag
-          git push origin --atomic --force refs/tags/"${VERSION}" refs/tags/"${major_version_tag}"
-
-      - name: Prepare partial Changelog
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-        run: |
-          npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG"
-
-          echo "::group::Partial CHANGELOG"
-          cat $PARTIAL_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
-
-      - name: Create the GitHub release
-        if: steps.check.outputs.exists != 'true'
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-          VERSION: "${{ steps.getVersion.outputs.version }}"
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          # Do not mark this release as latest. The most recent CLI release must be marked as latest.
-          gh release create \
-            "$VERSION" \
-            --latest=false \
-            --title "$VERSION" \
-            --notes-file "$PARTIAL_CHANGELOG"
-
-      - name: Create mergeback branch and PR
-        if: ${{ endsWith(github.ref_name, steps.getVersion.outputs.latest_release_branch) }}
-        uses: ./.github/actions/prepare-mergeback-branch
-        with:
-          base: "${{ env.BASE_BRANCH }}"
-          head: "${{ env.HEAD_BRANCH }}"
-          branch: "${{ steps.getVersion.outputs.newBranch }}"
-          version: "${{ steps.getVersion.outputs.version }}"
-          token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/pr-checks.yml

@@ -1,250 +0,0 @@
-name: PR Checks
-
-on:
-  workflow_dispatch:
-  workflow_call:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'workflow_call' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  unit-tests:
-    name: Unit Tests
-    if: github.triggering_actor != 'dependabot[bot]'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        node-version: [20, 24]
-    permissions:
-      contents: read
-      security-events: write # needed to upload ESLint results
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
-
-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-unit-tests-${{ github.ref }}-${{ github.event_name }}-${{ matrix.os }}-node${{ matrix['node-version'] }}
-
-    steps:
-      - name: Prepare git (Windows)
-        if: runner.os == 'Windows'
-        run: git config --global core.autocrlf false
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "npm"
-
-      # Install a new enough version of `npm` to understand `min-release-age`
-      # that is still compatible with Node 20.
-      - name: Install newer npm
-        if: matrix.node-version == 20
-        run: npm install -g npm@11.19.1
-
-      - name: Install dependencies
-        run: |
-          # Use the system Bash shell to ensure we can run commands like `npm ci`
-          # that are not available in the default shell on Windows.
-          npm config set script-shell bash
-          npm ci
-
-      - name: Verify compiled JS up to date
-        run: .github/workflows/script/check-js.sh
-
-      - name: Run unit tests
-        if: always()
-        run: npm test
-
-      - name: Lint
-        if: always() && matrix.os != 'windows-latest'
-        run: npm run lint-ci
-
-      - name: Upload sarif
-        uses: ./upload-sarif
-        # The merge queue deletes its `gh-readonly-queue` ref as soon as the queue entry resolves,
-        # so uploading against it races with that deletion. Both the `merge_group` run and the
-        # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
-        # rather than the event. The same results are uploaded by the `pull_request` run and again
-        # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
-        with:
-          sarif_file: eslint.sarif
-          category: eslint
-
-  # These checks do not need to be run as part of the same matrix that we use for the `unit-tests`
-  # job.
-  other-checks:
-    name: Other checks
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Check for incorrect addresses in package-lock.json
-        run: |
-          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
-              'package-lock.json'; then
-            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
-            exit 1
-          fi
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: "npm"
-
-      - name: Install dependencies
-        id: install-deps
-        run: npm ci
-
-      - name: Verify PR checks up to date
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: .github/workflows/script/verify-pr-checks.sh
-
-      - name: Run pr-checks tests
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        working-directory: pr-checks
-        run: npx tsx --test
-
-      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: npx tsx pr-checks/changenotes.ts validate
-
-      - name: Verify all Actions use the same Node version
-        id: head-version
-        run: |
-          NODE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
-          echo "NODE_VERSION: ${NODE_VERSION}"
-          if [[ $(echo "$NODE_VERSION" | wc -l) -gt 1 ]]; then
-            echo "::error::More than one node version used in 'action.yml' files."
-            exit 1
-          fi
-          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Fetch base commit
-        id: fetch-base
-        # Forks and Dependabot PRs don't have permission to write comments, so skip the repo size
-        # check in those cases.
-        if: >-
-          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.event.pull_request.user.login != 'dependabot[bot]'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Compare against the merge base so the size delta reflects only the commits actually
-          # added by this PR, ignoring any changes that have landed on the base branch since the
-          # PR branched off.
-          merge_base=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_SHA...$HEAD_SHA" --jq '.merge_base_commit.sha')
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-
-      - name: Check repo size
-        if: steps.fetch-base.outcome == 'success'
-        working-directory: pr-checks
-        env:
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: npx tsx check-repo-size.ts --output-dir "$RUNNER_TEMP/repo-size"
-
-      - name: Upload repo size comment
-        if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: repo-size-comment
-          path: ${{ runner.temp }}/repo-size/
-          if-no-files-found: error
-
-      - name: "Backport: Check out base ref"
-        id: checkout-base
-        if: ${{ startsWith(github.head_ref, 'backport-') }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.base_ref }}
-
-      - name: "Backport: Verify Node versions unchanged"
-        if: steps.checkout-base.outcome == 'success'
-        env:
-          HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}
-        run: |
-          BASE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
-          echo "HEAD_VERSION: ${HEAD_VERSION}"
-          echo "BASE_VERSION: ${BASE_VERSION}"
-          if [[ "$BASE_VERSION" != "$HEAD_VERSION" ]]; then
-            echo "::error::Cannot change the Node version of an Action in a backport PR."
-            exit 1
-          fi
-
-  post-repo-size-comment:
-    name: Post repo size comment
-    needs: other-checks
-    # Keep write permissions isolated from the job that checks out and tests PR code. This job only
-    # posts the candidate comment body produced by the read-only `pr-checks` job.
-    if: >-
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
-      needs.other-checks.result == 'success'
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 10
-
-    concurrency:
-      cancel-in-progress: true
-      group: check-repo-size-${{ github.event.pull_request.number }}
-
-    steps:
-      - name: Download repo size comment
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: repo-size-comment
-          path: repo-size-comment
-
-      - name: Post repo size comment
-        env:
-          COMMENT_MARKER: "<!-- repo-size-diff-bot -->"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          significant=$(jq -r '.significant' repo-size-comment/metadata.json)
-          comment_id=$(
-            gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-              --paginate \
-              --jq ".[] | select(.body | contains(\"$COMMENT_MARKER\")) | .id" \
-              | head -n 1
-          )
-
-          if [[ -n "$comment_id" ]]; then
-            echo "Updating existing comment $comment_id."
-            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --field body=@repo-size-comment/body.md
-          elif [[ "$significant" == "true" ]]; then
-            echo "Creating new repo size comment."
-            gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --field body=@repo-size-comment/body.md
-          else
-            echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
-          fi

.github/workflows/prepare-release.yml

@@ -1,77 +0,0 @@
-name: Prepare release
-on:
-  workflow_call:
-    outputs:
-      version:
-        description: "The version that is being released."
-        value: ${{ jobs.prepare.outputs.version }}
-      major_version:
-        description: "The major version of the release."
-        value: ${{ jobs.prepare.outputs.major_version }}
-      latest_tag:
-        description: "The most recent, existing release tag."
-        value: ${{ jobs.prepare.outputs.latest_tag }}
-      backport_source_branch:
-        description: "The release branch for the given tag."
-        value: ${{ jobs.prepare.outputs.backport_source_branch }}
-      backport_target_branches:
-        description: "JSON encoded list of branches to target with backports."
-        value: ${{ jobs.prepare.outputs.backport_target_branches }}
-
-  push:
-    paths:
-      - .github/workflows/prepare-release.yml
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Release info"
-    runs-on: ubuntu-latest
-    if: github.repository == 'github/codeql-action'
-
-    permissions:
-      contents: read
-
-    outputs:
-      version: ${{ steps.versions.outputs.version }}
-      major_version: ${{ steps.versions.outputs.major_version }}
-      latest_tag: ${{ steps.versions.outputs.latest_tag }}
-      backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}
-      backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-
-      - name: Configure runner for release
-        uses: ./.github/actions/release-initialise
-
-      - name: Get version tags
-        id: versions
-        run: |
-          VERSION="v$(jq '.version' -r 'package.json')"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          MAJOR_VERSION=$(cut -d '.' -f1 <<< "${VERSION}")
-          echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
-          LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-          echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
-
-      - name: Determine older release branches
-        id: branches
-        uses: ./.github/actions/release-branches
-        with:
-          major_version: ${{ steps.versions.outputs.major_version }}
-          latest_tag: ${{ steps.versions.outputs.latest_tag }}
-
-      - name: Print release information
-        run: |
-          echo 'version: ${{ steps.versions.outputs.version }}'
-          echo 'major_version: ${{ steps.versions.outputs.major_version }}'
-          echo 'latest_tag: ${{ steps.versions.outputs.latest_tag }}'
-          echo 'backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}'
-          echo 'backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}'

.github/workflows/publish-immutable-action.yml

@@ -1,27 +0,0 @@
-name: 'Publish Immutable Action Version'
-
-on:
-  push:
-    tags:
-      # Match version tags, but not the major version tags.
-      - 'v[0-9]+.**'
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  publish:
-    runs-on: ubuntu-slim
-    permissions:
-      contents: read
-      id-token: write
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Publish immutable release
-        id: publish
-        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/python312-windows.yml

@@ -1,53 +0,0 @@
-name: Test that the workaround for python 3.12 on windows works
-
-on:
-  push:
-    branches: [main, releases/v*]
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    # Weekly on Monday.
-    - cron: '0 0 * * 1'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  test-setup-python-scripts:
-    if: github.triggering_actor != 'dependabot[bot]'
-    env:
-      CODEQL_ACTION_TEST_MODE: true
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      # We currently need `security-events: read` to access feature flags.
-      security-events: read
-    runs-on: windows-latest
-
-    steps:
-    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-      with:
-        python-version: 3.12
-
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Prepare test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: default
-
-    - name: Initialize CodeQL
-      uses: ./../action/init
-      with:
-        tools: linked
-        languages: python
-
-    - name: Analyze
-      uses: ./../action/analyze

.github/workflows/query-filters.yml

@@ -1,75 +0,0 @@
-name: Query filters tests
-
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  query-filters:
-    name: Query Filters Tests
-    if: github.triggering_actor != 'dependabot[bot]'
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Install Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: 24
-        cache: npm
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: linked
-
-    - name: Check SARIF for default queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters1.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Check SARIF for query packs with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters2.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Check SARIF for query packs and local queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-        config-file: ./.github/codeql/codeql-config-query-filters3.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/rebuild.yml

@@ -1,142 +0,0 @@
-name: Rebuild Action
-
-on:
-  pull_request:
-    types: [labeled]
-  workflow_dispatch:
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  rebuild:
-    name: Rebuild Action
-    runs-on: ubuntu-latest
-    if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
-
-    env:
-      HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }}
-      BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
-
-    permissions:
-      contents: write # needed to push rebuilt commit
-      pull-requests: write # needed to comment on the PR
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          ref: ${{ env.HEAD_REF }}
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Remove label
-        if: github.event_name == 'pull_request'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh pr edit --repo github/codeql-action "$PR_NUMBER" \
-            --remove-label "Rebuild"
-
-      - name: Configure git
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Merge in changes from base branch
-        id: merge
-        run: |
-          git fetch origin "$BASE_BRANCH"
-
-          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
-          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
-          if git merge "origin/$BASE_BRANCH"; then
-            echo "Merge succeeded cleanly."
-          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
-            echo "Merge conflicts detected, continuing."
-            echo "merge-in-progress=true" >> $GITHUB_OUTPUT
-
-            # Check for merge conflicts outside of `lib`.
-            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
-            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
-              echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              echo "$CONFLICTS_OUTSIDE_LIB"
-              exit 1
-            fi
-
-            echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
-              "these by rebuilding the Action."
-          else
-            echo "git merge failed for a reason other than merge conflicts."
-            exit 1
-          fi
-
-      - name: Compile TypeScript
-        run: |
-          npm ci
-          npm run lint -- --fix
-          npm run build
-
-      - name: Sync back version updates to generated workflows
-        # Only sync back versions on Dependabot update PRs
-        if: startsWith(env.HEAD_REF, 'dependabot/')
-        working-directory: pr-checks
-        run: |
-          npm ci
-          npx tsx sync-back.ts --verbose
-
-      - name: Generate workflows
-        working-directory: pr-checks
-        run: ./sync.sh
-
-      - name: "Merge in progress: Finish merge and push"
-        if: steps.merge.outputs.merge-in-progress == 'true'
-        run: |
-          echo "Finishing merge and pushing changes."
-          git add --all
-          git commit --no-edit
-          git push
-
-      - name: "No merge in progress: Check for changes and push"
-        if: steps.merge.outputs.merge-in-progress != 'true'
-        id: push
-        run: |
-          if [ ! -z "$(git status --porcelain)" ]; then
-            echo "Changes detected, committing and pushing."
-            git add --all
-            # If the merge originally had conflicts, finish the merge.
-            # Otherwise, just commit the changes.
-            if git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
-              echo "In progress merge detected, finishing it up."
-              git commit --no-edit
-            else
-              echo "No in-progress merge detected, committing changes."
-              git commit -m "Rebuild"
-            fi
-            echo "Pushing changes"
-            git push
-            echo "changes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No changes detected, nothing to commit."
-          fi
-
-      - name: Notify about rebuild
-        if: >-
-          github.event_name == 'pull_request' &&
-            (
-              steps.merge.outputs.merge-in-progress == 'true' ||
-              steps.push.outputs.changes == 'true'
-            )
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          echo "Pushed a commit to rebuild the Action." \
-            "Please approve running the PR checks." |
-            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

.github/workflows/rollback-release.yml

@@ -1,187 +0,0 @@
-name: Rollback release
-on:
-  # You can trigger this workflow via workflow dispatch to start a rollback.
-  # This will create a draft release that mirrors the release for `rollback-tag`.
-  workflow_dispatch:
-    inputs:
-      rollback-tag:
-        type: string
-        description: "The tag of an old release to roll-back to."
-        required: true
-  # Only for dry-runs of changes to the workflow.
-  push:
-    # Don't run dry-run on release branches, since that's unnecessary.
-    branches-ignore:
-      - releases/v*
-    paths:
-      - .github/workflows/rollback-release.yml
-      - .github/actions/prepare-mergeback-branch/**
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Prepare"
-    if: github.repository == 'github/codeql-action'
-
-    permissions:
-      contents: read
-
-    uses: ./.github/workflows/prepare-release.yml
-
-  rollback:
-    name: "Create rollback release"
-    if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-
-    # Don't set the deployment environment for test runs
-    # The Actions token does not have permissions to push changes to workflow files.
-    # Since workflow files may change as part of a backport PR, we use the "Automation" environment for real runs to authenticate as a GitHub App and push these changes.
-    environment: ${{ github.event_name == 'workflow_dispatch' && 'Automation' || '' }}
-
-    needs:
-      - prepare
-
-    permissions:
-      contents: write # needed to push to the repo (tags and releases)
-      pull-requests: write # needed to create the mergeback PR
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-
-      - name: Configure runner for release
-        uses: ./.github/actions/release-initialise
-
-      - name: Create tag for testing
-        if: github.event_name != 'workflow_dispatch'
-        run: git tag v0.0.0
-
-      # We start by preparing the mergeback branch, mainly so that we have the updated changelog
-      # readily available for the partial changelog that's needed for the release.
-      - name: Prepare mergeback branch
-        id: mergeback-branch
-        env:
-          BASE_BRANCH: ${{ (github.event_name == 'workflow_dispatch' && 'main') || github.ref_name }}
-          VERSION: ${{ needs.prepare.outputs.version }}
-        run: |
-          set -x
-
-          # Checkout the base branch, since we may be testing on a different branch
-          git checkout "$BASE_BRANCH"
-
-          # Generate a new branch name for the mergeback PR
-          short_sha="${GITHUB_SHA:0:8}"
-          NEW_BRANCH="mergeback/${VERSION}-to-${BASE_BRANCH}-${short_sha}"
-          echo "new-branch=${NEW_BRANCH}" >> $GITHUB_OUTPUT
-
-          # Create the mergeback branch
-          git checkout -b "${NEW_BRANCH}"
-
-      - name: Prepare rollback changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
-          # but use `v0.0.0` for testing.
-          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}
-          VERSION: "${{ needs.prepare.outputs.version }}"
-        run: |
-          npx tsx pr-checks/rollback-changelog.ts \
-            --target-version "${ROLLBACK_TAG:1}" \
-            --rollback-version "${LATEST_TAG:1}" \
-            --new-version "$VERSION" > $NEW_CHANGELOG
-
-          echo "::group::New CHANGELOG"
-          cat $NEW_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Create tags
-        env:
-          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
-          # but use `v0.0.0` for testing.
-          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          # Use `needs.prepare.outputs.version` for actual runs and `v0.0.1` for testing.
-          RELEASE_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.version, 'v0.0.1') }}
-          # Use `needs.prepare.outputs.major_version` for actual runs and `v0` for testing.
-          MAJOR_VERSION_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.major_version, 'v0') }}
-        run: |
-          git checkout "refs/tags/${ROLLBACK_TAG}"
-          git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
-          git tag --annotate "${MAJOR_VERSION_TAG}" --message "${MAJOR_VERSION_TAG}" --force
-
-      - name: Push tags
-        # skip when testing
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
-          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
-        run: |
-          git push origin --atomic --force refs/tags/"${RELEASE_TAG}" refs/tags/"${MAJOR_VERSION_TAG}"
-
-      - name: Prepare partial Changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-        run: |
-          npx tsx pr-checks/prepare-changelog.ts \
-            --changelog="$NEW_CHANGELOG" \
-            --output="$PARTIAL_CHANGELOG"
-
-          echo "::group::Partial CHANGELOG"
-          cat $PARTIAL_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Generate token
-        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
-
-      - name: Create the rollback release
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-          VERSION: "${{ needs.prepare.outputs.version }}"
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          RELEASE_URL: "${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ needs.prepare.outputs.version }}"
-        run: |
-          set -exu
-
-          # Do not mark this release as latest. The most recent bundle release must be marked as latest.
-          # Set as a draft to give us an opportunity to review the rollback release.
-          gh release create \
-            "$VERSION" \
-            --latest=false \
-            --draft \
-            --title "$VERSION" \
-            --notes-file "$PARTIAL_CHANGELOG"
-
-          echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY
-
-      - name: Update changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"
-        run: |
-          git checkout "${NEW_BRANCH}"
-          mv ${NEW_CHANGELOG} CHANGELOG.md
-
-      - name: Create mergeback branch and PR
-        uses: ./.github/actions/prepare-mergeback-branch
-        with:
-          base: "main"
-          head: ""
-          branch: "${{ steps.mergeback-branch.outputs.new-branch }}"
-          version: "${{ needs.prepare.outputs.version }}"
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          # Setting this to `true` for non-workflow_dispatch events will
-          # still push the `branch`, but won't create a corresponding PR
-          dry-run: "${{ github.event_name != 'workflow_dispatch' }}"

.github/workflows/script/check-js.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-# Wipe the lib directory in case there are extra unnecessary files in there
-rm -rf lib
-# Generate the JavaScript files
-npm run-script build
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
-    git status
-
-    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/js.diff"
-    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    # Reset bundled files to allow other checks to test for changes
-    git checkout lib
-
-    # Fail this check
-    exit 1
-fi
-echo "Success: JavaScript files are up to date"

.github/workflows/script/verify-pr-checks.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-
-# Wipe the generated PR checks in case there are extra unnecessary files in there
-rm -rf .github/workflows/__*
-
-# Generate the PR checks
-pr-checks/sync.sh
-
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    git diff
-    git status
-    >&2 echo "Failed: PR checks are not up to date. Run 'cd pr-checks && ./sync.sh' to update"
-
-    echo "### Generated workflows diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/workflows.diff"
-    cat "$RUNNER_TEMP/workflows.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    exit 1
-fi
-echo "Success: PR checks are up to date"

.github/workflows/test-codeql-bundle-all.yml

@@ -1,62 +0,0 @@
-name: 'PR Check - CodeQL Bundle All'
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-    - main
-    - releases/v*
-  pull_request:
-  merge_group:
-    types: [checks_requested]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-defaults:
-  run:
-    shell: bash
-jobs:
-  test-codeql-bundle-all:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - os: ubuntu-latest
-          version: nightly-latest
-    name: 'CodeQL Bundle All'
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-        use-all-platform-bundle: true
-    - name: Install .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '9.x'
-    - id: init
-      uses: ./../action/init
-      with:
-        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - name: Build code
-      run: ./build.sh
-    - uses: ./../action/analyze
-    env:
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/ts-lint.yml

@@ -0,0 +1,12 @@
+name: "TSLint"
+
+on: [push]
+
+jobs:
+  tslint:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: tslint
+      run: npm run-script lint

.github/workflows/update-bundle.yml

@@ -1,123 +0,0 @@
-name: Update default CodeQL bundle
-
-on:
-  release:
-    # From https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
-    # Note: The prereleased type will not trigger for pre-releases published
-    # from draft releases, but the published type will trigger. If you want a
-    # workflow to run when stable and pre-releases publish, subscribe to
-    # published instead of released and prereleased.
-    #
-    # From https://github.com/orgs/community/discussions/26281
-    # As a work around, in published type workflow,  you could add if condition
-    # to filter pre-release attribute.
-    types: [published]
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  update-bundle:
-    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull requests
-    steps:
-      - name: Dump environment
-        run: env
-
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
-        run: echo "$GITHUB_CONTEXT"
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Update bundle
-        uses: ./.github/actions/update-bundle
-
-      - name: Set up CodeQL CLI from new bundle
-        id: setup-codeql
-        uses: ./setup-codeql
-        with:
-          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
-
-      - name: Update built-in languages
-        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
-        env:
-          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
-
-      - name: Bump Action minor version if new CodeQL minor version series
-        id: bump-action-version
-        run: |
-          prior_cli_version=$(jq -r '.priorCliVersion' src/defaults.json)
-          cli_version=$(jq -r '.cliVersion' src/defaults.json)
-
-          prior_minor=$(echo "$prior_cli_version" | cut -d. -f2)
-          current_minor=$(echo "$cli_version" | cut -d. -f2)
-
-          if [[ "$current_minor" != "$prior_minor" ]]; then
-            echo "New CodeQL minor version series ($prior_cli_version -> $cli_version), bumping Action minor version"
-            npm version minor --no-git-tag-version
-            echo "bumped=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Same minor version series ($prior_cli_version -> $cli_version), skipping Action version bump"
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Rebuild Action
-        run: npm run build
-
-      - name: Commit and push changes
-        env:
-          RELEASE_TAG: "${{ github.event.release.tag_name }}"
-        run: |
-          git checkout -b "update-bundle/$RELEASE_TAG"
-          git commit -am "Update default bundle to $RELEASE_TAG"
-          git push --set-upstream origin "update-bundle/$RELEASE_TAG"
-
-      - name: Open pull request
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ACTION_VERSION_BUMPED: ${{ steps.bump-action-version.outputs.bumped }}
-        run: |
-          cli_version=$(jq -r '.cliVersion' src/defaults.json)
-          action_version=$(jq -r '.version' package.json)
-
-          pr_body="This pull request updates the default CodeQL bundle, as used with \`tools: linked\` and on GHES, to $cli_version."
-          if [[ "$ACTION_VERSION_BUMPED" == "true" ]]; then
-            pr_body+=$'\n\n'"Since this is a new CodeQL minor version series, this PR also bumps the Action version to $action_version."
-          fi
-
-          pr_url=$(gh pr create \
-            --title "Update default bundle to $cli_version" \
-            --body "$pr_body" \
-            --assignee "$GITHUB_ACTOR" \
-          )
-          echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
-          echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"
-
-      - name: Create changelog note
-        run: |
-          npx tsx pr-checks/bundle-changelog.ts
-
-      - name: Push changelog note
-        run: |
-          git commit -am "Add changelog note"
-          git push

.github/workflows/update-release-branch.yml

@@ -1,121 +0,0 @@
-name: Update release branch
-on:
-  # You can trigger this workflow via workflow dispatch to start a release.
-  # This will open a PR to update the latest release branch.
-  workflow_dispatch:
-
-  # When a release is complete this workflow will open up backport PRs to older release branches.
-  # NB while it will trigger on any release branch update, the backport job will not proceed for
-  # anything other than than releases/v{latest}
-  push:
-    branches:
-      - releases/*
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Prepare"
-    permissions:
-      contents: read
-
-    uses: ./.github/workflows/prepare-release.yml
-
-  update:
-    name: "Update release branch"
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch'
-    needs: [prepare]
-    env:
-      REF_NAME: "${{ github.ref_name }}"
-      REPOSITORY: "${{ github.repository }}"
-      MAJOR_VERSION: "${{ needs.prepare.outputs.major_version }}"
-      LATEST_TAG: "${{ needs.prepare.outputs.latest_tag }}"
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull request
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-    - uses: ./.github/actions/release-initialise
-
-    # when the workflow has been manually triggered on main,
-    # we know that we definitely want the release branch to exist
-    - name: Ensure release branch exists
-      run: |
-        echo "MAJOR_VERSION ${MAJOR_VERSION}"
-        RELEASE_BRANCH=releases/${MAJOR_VERSION}
-        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-            echo "Branch $RELEASE_BRANCH already exists"
-            echo ""
-        else
-            echo "Creating $RELEASE_BRANCH branch"
-            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-            git push --set-upstream origin ${RELEASE_BRANCH}
-            git branch --show-current
-            echo ""
-        fi
-        echo "Returning to branch: ${REF_NAME}"
-        git checkout ${REF_NAME}
-
-    - name: Update current release branch
-      if: github.event_name == 'workflow_dispatch'
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${REF_NAME}
-        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch '${{ env.REF_NAME }}' \
-          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-          --is-primary-release \
-          --conductor ${GITHUB_ACTOR}
-
-  backport:
-    name: "Create backport"
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    environment: Automation
-    needs: [prepare]
-    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        target_branch: ${{ fromJson(needs.prepare.outputs.backport_target_branches) }}
-    env:
-      SOURCE_BRANCH: ${{ needs.prepare.outputs.backport_source_branch }}
-      TARGET_BRANCH: ${{ matrix.target_branch }}
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull request
-    steps:
-    - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-token
-      with:
-        app-id: ${{ vars.AUTOMATION_APP_ID }}
-        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
-
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-        token: ${{ steps.app-token.outputs.token }}
-    - uses: ./.github/actions/release-initialise
-
-    - name: Update older release branch
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${SOURCE_BRANCH}
-        echo TARGET_BRANCH=${TARGET_BRANCH}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch ${SOURCE_BRANCH} \
-          --target-branch ${TARGET_BRANCH} \
-          --conductor ${GITHUB_ACTOR}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -1,90 +0,0 @@
-name: Update Supported Enterprise Server Versions
-
-on:
-  schedule:
-    - cron: "0 0 * * *"
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - .github/workflows/update-supported-enterprise-server-versions.yml
-      - pr-checks/update-ghes-versions.ts
-
-jobs:
-  update-supported-enterprise-server-versions:
-    name: Update Supported Enterprise Server Versions
-    timeout-minutes: 45
-    runs-on: ubuntu-slim
-    if: github.repository == 'github/codeql-action'
-    permissions:
-      contents: write # needed to push commits
-      pull-requests: write # needed to create pull request
-
-    steps:
-      - name: Checkout CodeQL Action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Checkout Enterprise Releases
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: github/enterprise-releases
-          token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }}
-          path: ${{ github.workspace }}/enterprise-releases/
-          sparse-checkout: releases.json
-
-      - name: Update Supported Enterprise Server Versions
-        working-directory: pr-checks
-        run: |
-          npx tsx update-ghes-versions.ts
-          rm --recursive "$ENTERPRISE_RELEASES_PATH"
-        env:
-          ENTERPRISE_RELEASES_PATH: ${{ github.workspace }}/enterprise-releases/
-
-      - name: Rebuild
-        run: npm run build
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Commit changes
-        id: prepare-commit
-        run: |
-          if [[ -z $(git status --porcelain) ]]; then
-            echo "No changes to commit"
-            echo "committed=false" >> $GITHUB_OUTPUT
-          else
-            git checkout -b update-supported-enterprise-server-versions
-            git add .
-            git commit --message "Update supported GitHub Enterprise Server versions"
-
-            echo "committed=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Open PR
-        if: github.event_name != 'pull_request' && steps.prepare-commit.outputs.committed == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git push origin update-supported-enterprise-server-versions
-
-          body="This PR updates the list of supported GitHub Enterprise Server versions, either because a new "
-          body+="version is about to be feature frozen, or because an old release has been deprecated."
-          body+=$'\n\n'
-          body+="If an old release has been deprecated, please follow the instructions in CONTRIBUTING.md to "
-          body+="deprecate the corresponding version of CodeQL."
-
-          gh pr create --draft \
-            --title "Update supported GitHub Enterprise Server versions" \
-            --body "$body"

.gitignore

@@ -1,15 +0,0 @@
-# Dependency directories
-node_modules/
-# Build output for tests
-build/
-# Java build files
-.gradle/
-*.class
-# macOS
-.DS_Store
-# eslint sarif report
-eslint.sarif
-# for local incremental compilation
-tsconfig.tsbuildinfo
-# esbuild metadata file
-meta.json

.npmrc

@@ -1,2 +0,0 @@
-lockfile-version=3
-min-release-age=7

.pre-commit-config.yaml

@@ -1,20 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: lint-ts
-        name: Lint typescript code
-        files: \.ts$
-        language: system
-        entry: npm run lint -- --fix
-      - id: compile-ts
-        name: Compile typescript
-        files: \.[tj]s$
-        language: system
-        entry: npm run build
-        pass_filenames: false
-      - id: pr-checks-sync
-        name: Synchronize PR check workflows
-        files: ^.github/workflows/__.*\.yml$|^pr-checks
-        language: system
-        entry: pr-checks/sync.sh
-        pass_filenames: false

.vscode/launch.json

@@ -1,25 +0,0 @@
-{
-  // Use IntelliSense to learn about possible attributes.
-  // Hover to view descriptions of existing attributes.
-  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "type": "node",
-      "request": "launch",
-      "name": "Debug AVA test file",
-      "runtimeExecutable": "${workspaceFolder}/node_modules/.bin/ava",
-      "runtimeArgs": [
-        "${file}",
-        "--break",
-        "--serial",
-        "--timeout=20m"
-      ],
-      "port": 9229,
-      "outputCapture": "std",
-      "skipFiles": [
-        "<node_internals>/**/*.js"
-      ]
-    }
-  ]
-}

.vscode/settings.json

@@ -1,29 +0,0 @@
-{
-  "files.exclude": {
-    // include the defaults from VS Code
-    "**/.git": true,
-    "**/.DS_Store": true,
-
-    // transpiled JavaScript
-    "build": true,
-    "lib": true,
-
-    // exclude "tests" by default because it causes VSCode to start language-specific extensions
-    // that are not typically needed during development (or indeed may not work correctly)
-    "tests": true
-  },
-  "search.exclude": {
-    "**/node_modules": true,
-    "build": true,
-    "lib": true,
-  },
-  // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
-  // an intermediate stage where many files are modified. This setting suppresses these warnings.
-  "git.ignoreLimitWarning": true,
-  // Use the vendored TypeScript version to have a consistent development experience across
-  // machines.
-  "js/ts.tsdk.path": "node_modules/typescript/lib",
-  "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
-}

.vscode/tasks.json

@@ -1,15 +0,0 @@
-{
-	"version": "2.0.0",
-	"tasks": [
-		{
-			"type": "typescript",
-			"tsconfig": "tsconfig.json",
-			"option": "watch",
-			"problemMatcher": [
-				"$tsc-watch"
-			],
-			"group": "build",
-			"label": "tsc: watch - tsconfig.json"
-		}
-	]
-}

.vscode/tests.code-snippets

@@ -1,30 +0,0 @@
-{
-  // Place your codeql-action workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and
-  // description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope
-  // is left empty or omitted, the snippet gets applied to all languages. The prefix is what is
-  // used to trigger the snippet and the body will be expanded and inserted. Possible variables are:
-  // $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders.
-  // Placeholders with the same ids are connected.
-  // Example:
-  // "Print to console": {
-  // 	"scope": "javascript,typescript",
-  // 	"prefix": "log",
-  // 	"body": [
-  // 		"console.log('$1');",
-  // 		"$2"
-  // 	],
-  // 	"description": "Log output to console"
-  // }
-  "Test Macro": {
-    "scope": "javascript, typescript",
-    "prefix": "testMacro",
-    "body": [
-      "const ${1:nameMacro} = makeMacro({",
-      "  exec: async (t: ExecutionContext<unknown>) => {},",
-      "",
-      "  title: (providedTitle = \"\") => `${2:common title} - \\${providedTitle}`,",
-      "});",
-    ],
-    "description": "An Ava test macro",
-  },
-}

CODEOWNERS

@@ -1 +0,0 @@
-**/* @github/codeql-action-reviewers

CONTRIBUTING.md

@@ -1,9 +1,8 @@
-# Contributing
+## Contributing
 
 [fork]: https://github.com/github/codeql-action/fork
 [pr]: https://github.com/github/codeql-action/compare
 [code-of-conduct]: CODE_OF_CONDUCT.md
-[readme]: README.md#supported-versions-of-the-codeql-cli-and-github-enterprise-server
 
 Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
 
@@ -11,42 +10,13 @@ Contributions to this project are [released](https://help.github.com/articles/gi
 
 Please note that this project is released with a [Contributor Code of Conduct][code-of-conduct]. By participating in this project you agree to abide by its terms.
 
-## Development and Testing
-
-Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
-
-### Common tasks
-
-* Transpile the TypeScript to JavaScript: `npm run build`.  Note that the JavaScript files are committed to git.
-* Run tests: `npm run test`.  You’ll need to ensure that the JavaScript files are up-to-date first by running the command above.
-* Run the linter: `npm run lint`.
-* Run tests for a specific path: `npm run ava -- ./src/filename.test.ts` or `npm run ava -- ./src/feature-flags/`
-
-This project also includes configuration to run tests from VSCode (with support for breakpoints) - open the test file you wish to run and choose "Debug AVA test file" from the Run menu in the Run panel.
-
-You may want to run `tsc --watch` from the command line or inside of vscode in order to ensure build artifacts are up to date as you are working.
-
-### Checking in compiled artifacts
-
-Because CodeQL Action users consume the code directly from this repository, and there can be no build step during a GitHub Actions run, this repository contains all compiled artifacts. There is a PR check that will fail if any of the compiled artifacts are not up to date. Compiled artifacts are stored in the `lib/` directory. For all day-to-day development purposes, this folder can be ignored.
-
-### Running the action
-
-To see the effect of your changes and to test them, push your changes in a branch and then look at the [Actions output](https://github.com/github/codeql-action/actions) for that branch.  You can also exercise the code locally by running the automated tests.
-
-### Integration tests
-
-As well as the unit tests (see _Common tasks_ above), there are integration tests, defined in `.github/workflows/integration-testing.yml`.  These are run by a CI check.  Depending on the change you’re making, you may want to add a test to this file or extend an existing one.
-
 ## Submitting a pull request
 
-1. [Fork][fork] and clone the repository.
-2. Create a new branch: `git checkout -b my-branch-name`.
-3. Make your change, add tests, and make sure the tests still pass. Ensure that you have run `npm run build` and committed any changes to the compiled artifacts.
-4. Push to your fork and [submit a pull request][pr].
-5. Pat yourself on the back and wait for your pull request to be reviewed and merged.
-
-If you're a GitHub staff member, you can merge your own PR once it's approved; for external contributors, GitHub staff will merge your PR once it's approved.
+1. [Fork][fork] and clone the repository
+2. Create a new branch: `git checkout -b my-branch-name`
+3. Make your change, add tests, and make sure the tests still pass
+4. Push to your fork and [submit a pull request][pr]
+5. Pat your self on the back and wait for your pull request to be reviewed and merged.
 
 Here are a few things you can do that will increase the likelihood of your pull request being accepted:
 
@@ -54,81 +24,6 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
 
-## Releasing (write access required)
-
-1. The first step of releasing a new version of the `codeql-action` is running the "Update release branch" workflow.
-    This workflow goes through the pull requests that have been merged to `main` since the last release, creates a changelog, then opens a pull request to merge the changes since the last release into the `releases/v3` release branch.
-
-    You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
-1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it **with a merge commit** (`gh pr merge --merge`).
-1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
-1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
-1. Approve the mergeback and backport pull request (if applicable) and automerge them **with a merge commit** (`gh pr merge --merge`).
-
-    > [!NOTE]
-    > The release, mergeback, and backport pull requests must always be merged with a merge commit — **never squash or rebase**. The mergeback tags the release using the merge commit of the "Merge main into releases/v3" pull request, so squashing or rebasing breaks tagging and the branch linkage the release automation relies on.
-
-Once the mergeback and backport pull request have been merged, the release is complete.
-
-## Keeping the PR checks up to date (admin access required)
-
-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [sync-checks.ts](pr-checks/sync-checks.ts) script:
-
-- At a minimum, you must provide a token with permissions to update branch protection rules. For example, `gh auth token | pr-checks/sync-checks.ts --token-stdin` uses the same token that `gh` uses. You can also set the `GH_TOKEN` or `GITHUB_TOKEN` environment variable. If no token is provided or the token has insufficient permissions, the script will fail.
-- By default, the script performs a dry run and outputs information about the changes it would make to the branch protection rules. To actually apply the changes, specify the `--apply` flag.
-- If you run the script without any other arguments, it will retrieve the set of workflows that ran for the latest commit on `main`.
-- You can specify a different git ref with the `--ref` input. You will likely want to use this if you have a PR that removes or adds PR checks. For example, `--ref "some/branch/name"` to use the HEAD of the `some/branch/name` branch.
-
-After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v4`, and any other currently supported major versions have been updated.
-
-Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.
-
-## Deprecating a CodeQL version (write access required)
-
-We typically deprecate a version of CodeQL when the GitHub Enterprise Server (GHES) version that it first shipped in is deprecated.
-
-1. Work out the next minimum version of CodeQL. This is the version that shipped in the version of GHES after the one that has just been deprecated.
-1. Notify users using the old version of CodeQL about the deprecation.
-    - Update `CODEQL_NEXT_MINIMUM_VERSION`, `GHES_VERSION_MOST_RECENTLY_DEPRECATED`, and `GHES_MOST_RECENT_DEPRECATION_DATE` in `src/codeql.ts` to reflect the new minimum version of CodeQL and the GHES version that has just been deprecated.
-    - Add a changelog note announcing the deprecation.
-    - Update the CLI version referenced in the [readme] by adding a new row to the compatibility table.
-    - Example PR: https://github.com/github/codeql-action/pull/1884
-1. Release the Action, or wait for the next scheduled release of the Action, then wait at least a week so users have time to see and act on the deprecation warning.
-1. Remove support for the old version of CodeQL.
-    - Bump `CODEQL_MINIMUM_VERSION` in `src/codeql.ts` to the new minimum version of CodeQL.
-    - Remove any code that is only needed to support the old version of CodeQL. This is often behind a version guard, so look for instances of version numbers between the old minimum version and the new minimum version in the codebase. A good place to start is the list of version numbers in `src/codeql.ts`.
-    - Update the default set of CodeQL test versions in `pr-checks/sync.ts`.
-        - Remove the old minimum version of CodeQL.
-        - Add the latest patch release for any new CodeQL minor version series that have shipped in GHES.
-        - Run the script to update the generated PR checks.
-    - Do the same for PR checks that aren't auto-generated.
-    - Add a changelog note announcing the new minimum version of CodeQL that is now required.
-    - Example PR: https://github.com/github/codeql-action/pull/1907
-
-## Adding a new CodeQL Action major version
-
-We sometimes maintain multiple versions of the CodeQL Action to enable customers on older but still supported versions of GitHub Enterprise Server (GHES) to continue to benefit from the latest CodeQL improvements. To accomplish this, the release process automation listens to updates to the release branch for the newest supported version.  When this branch is updated, the release process automatically opens backport PRs to update the release branches for older versions.
-
-To add a new major version of the Action:
-
-1. Change the `version` field of `package.json` by running `npm version x.y.z` where `x` is the new major version, and `y` and `z` match the latest minor and patch versions of the last release.
-1. Update appropriate documentation to explain the reasoning behind the releases: see [the diff](https://github.com/github/codeql-action/pull/2677/commits/913d60579d4b560addf53ec3c493d491dd3c1378) in our last major version deprecation for examples on which parts of the documentation should be updated.
-1. Consider the timeline behind deprecating the prior Action version: see [CodeQL Action deprecation documentation](#deprecating-a-codeql-action-major-version-write-access-required)
-1. If the new major version runs on a new version of Node, add a PR check to ensure the codebase continues to compile against the previous version of Node. See [Remove Node 16 compilation PR check](https://github.com/github/codeql-action/pull/2695) for an example.
-
-## Deprecating a CodeQL Action major version (write access required)
-
-We typically deprecate older versions of the Action once all supported GHES versions are compatible with the version of Node.js we are using on `main`.
-
-To deprecate an older version of the Action:
-
-1. Notify any users who are still pinned to the `vN` tag of the deprecated version of the Action, giving as much notice as is practical.
-   - Add a changelog note announcing the deprecation.
-   - Implement an Actions warning for customers using the deprecated version.
-1. Wait for the deprecation period to pass.
-1. Upgrade the Actions warning for customers using the deprecated version to a non-fatal error, and mention that this version of the Action is no longer supported.
-1. Make a PR to bump the `OLDEST_SUPPORTED_MAJOR_VERSION` in [config.ts](pr-checks/config.ts).  Once this PR is merged, the release process will no longer backport changes to the deprecated release version.
-
 ## Resources
 
 - [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)

README.md

@@ -1,95 +1,168 @@
 # CodeQL Action
 
-This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
+This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/semmle/ql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
 
-For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).
+## Usage
+
+To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:
+
+```yaml
+
+name: "Code Scanning - Action"
+
+on:
+  push:
+  schedule:
+    - cron: '0 0 * * 0'
+
+jobs:
+  CodeQL-Build:
+
+    strategy:
+      fail-fast: false
+
+    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        # Override language selection by uncommenting this and choosing your languages
+        # with:
+        #   languages: go, javascript, csharp, python, cpp, java
+
+      # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below).
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v1
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following
+      #    three lines and modify them (or add more) to build your code if your
+      #    project uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
+```
+
+If you prefer to integrate this within an existing CI workflow, it should end up looking something like this:
+
+```yaml
+- name: Initialize CodeQL
+  uses: github/codeql-action/init@v1
+  with:
+    languages: go, javascript
+
+# Here is where you build your code
+- run: |
+  make bootstrap
+  make release
+
+- name: Perform CodeQL Analysis
+  uses: github/codeql-action/analyze@v1
+```
+
+### Actions triggers
+
+The CodeQL action should be run on `push` events, and on a `schedule`. `Push` events allow us to do a detailed analysis of the delta in a pull request, while the `schedule` event ensures that GitHub regularly scans the repository for the latest vulnerabilities, even if the repository becomes inactive. This action does not support the `pull_request` event.
+
+### Configuration
+
+You may optionally specify additional queries for CodeQL to execute by using a config file. The queries must belong to a [QL pack](https://help.semmle.com/codeql/codeql-cli/reference/qlpack-overview.html) and can be in your repository or any public repository. You can choose a single .ql file, a folder containing multiple .ql files, a .qls [query suite](https://help.semmle.com/codeql/codeql-cli/procedures/query-suites.html) file, or any combination of the above. To use queries from other repositories use the same syntax as when [using an action](https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses).
+
+You can disable the default queries using `disable-default-queries: true`.
+
+You can choose to ignore some files or folders from the analysis, or include additional files/folders for analysis. This *only* works for Javascript and Python analysis.
+Identifying potential files for extraction:
+
+- Scans each folder that's defined as `paths` in turn, traversing subfolders, and looking for relevant files.
+- If it finds a subfolder that's defined as `paths-ignore`, stop traversing.
+- If a file or folder is both in `paths` and `paths-ignore`, the `paths-ignore` is ignored.
+
+Use the `config-file` parameter of the init action to enable the configuration file. For example:
+
+```yaml
+- uses: github/codeql-action/init@v1
+  with:
+    config-file: ./.github/codeql/codeql-config.yml
+```
+
+A config file looks like this:
+
+```yaml
+name: "My CodeQL config"
+
+disable-default-queries: true
+
+queries:
+  - name: In-repo queries (Runs the queries located in the my-queries folder of the repo)
+    uses: ./my-queries
+  - name: External Javascript QL pack (Runs a QL pack located in an external repo)
+    uses: /Semmle/ql/javascript/ql/src/Electron@master
+  - name: External query (Runs a single query located in an external QL pack)
+    uses: Semmle/ql/javascript/ql/src/AngularJS/DeadAngularJSEventListener.ql@master
+  - name: Select query suite (Runs a query suites)
+    uses: ./codeql-querypacks/complex-python-querypack/rootAndBar.qls
+
+paths:
+  - src/util.ts
+
+paths-ignore:
+  - src
+  - lib
+```
+
+## Troubleshooting
+
+### Trouble with Go dependencies
+
+#### If you use a vendor directory
+
+Try passing
+
+```yaml
+env:
+  GOFLAGS: "-mod=vendor"
+```
+
+to `github/codeql-action/analyze`.
+
+### If you do not use a vendor directory
+
+Dependencies on public repositories should just work. If you have dependencies on private repositories, one option is to use `git config` and a [personal access token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) to authenticate when downloading dependencies. Add a section like
+
+```yaml
+steps:
+  - name: Configure git private repo access
+    env:
+      TOKEN: ${{ secrets.GITHUB_PAT }}
+    run: |
+      git config --global url."https://${TOKEN}@github.com/foo/bar".insteadOf "https://github.com/foo/bar"
+      git config --global url."https://${TOKEN}@github.com/foo/baz".insteadOf "https://github.com/foo/baz"
+```
+
+before any codeql actions. A similar thing can also be done with an SSH key or deploy key.
+
+### C# using dotnet version 2 on linux
+
+This currently requires invoking `dotnet` with the `/p:UseSharedCompilation=false` flag. For example:
+
+```shell
+dotnet build /p:UseSharedCompilation=false
+```
+
+Version 3 does not require the additional flag.
 
 ## License
 
 This project is released under the [MIT License](LICENSE).
-
-The underlying CodeQL CLI, used in this action, is licensed under the [GitHub CodeQL Terms and Conditions](https://securitylab.github.com/tools/codeql/license). As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.
-
-## Usage
-
-We recommend using default setup to configure CodeQL analysis for your repository. For more information, see "[Configuring default setup for code scanning](https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning)."
-
-You can also configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration. For more information, see "[Configuring advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning)" and "[Customizing your advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning)."
-
-### Actions
-
-This repository contains several actions that enable you to analyze code in your repository using CodeQL and upload the analysis to GitHub Code Scanning. Actions in this repository also allow you to upload to GitHub analyses generated by any SARIF-producing SAST tool.
-
-Actions for CodeQL analyses:
-
-- `init`: Sets up CodeQL for analysis. For information about input parameters, see the [init action definition](https://github.com/github/codeql-action/blob/main/init/action.yml).
-- `analyze`: Finalizes the CodeQL database, runs the analysis, and uploads the results to Code Scanning. For information about input parameters, see the [analyze action definition](https://github.com/github/codeql-action/blob/main/analyze/action.yml).
-
-Actions for uploading analyses generated by third-party tools:
-
-- `upload-sarif`: Uploads a SARIF file to Code Scanning. If you are using the `analyze` action, there is no reason to use this action as well. For information about input parameters, see the [upload-sarif action definition](https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml).
-
-Actions with special purposes and unlikely to be used directly:
-
-- `autobuild`: Attempts to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead. For information about input parameters, see the [autobuild action definition](https://github.com/github/codeql-action/blob/main/autobuild/action.yml).
-- `resolve-environment`: [Experimental] Attempts to infer a build environment suitable for automatic builds. For information about input parameters, see the [resolve-environment action definition](https://github.com/github/codeql-action/blob/main/resolve-environment/action.yml).
-- `start-proxy`: [Experimental] Start the HTTP proxy server. Internal use only and will change without notice. For information about input parameters, see the [start-proxy action definition](https://github.com/github/codeql-action/blob/main/start-proxy/action.yml).
-- `setup-codeql`: [Experimental] Similar to `init`, except it only installs the CodeQL CLI and does not initialize a database.
-
-### Workflow Permissions
-
-All advanced setup code scanning workflows must have the `security-events: write` permission. Workflows in private repositories must additionally have the `contents: read` permission. For more information, see "[Assigning permissions to jobs](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs)."
-
-### Build Modes
-
-The CodeQL Action supports different build modes for analyzing the source code. The available build modes are:
-
-- `none`: The database will be created without building the source code. Available for all interpreted languages and some compiled languages.
-- `autobuild`: The database will be created by attempting to automatically build the source code. Available for all compiled languages.
-- `manual`: The database will be created by building the source code using a manually specified build command. To use this build mode, specify manual build steps in your workflow between the `init` and `analyze` steps. Available for all compiled languages.
-
-#### Which build mode should I use?
-
-Interpreted languages must use `none` for the build mode.
-
-For compiled languages:
-
-- `manual` build mode will typically produce the most precise results, but it is more difficult to set up and will cause the analysis to take slightly more time to run.
-- `autobuild` build mode is simpler to set up, but will only work for projects with generic build steps that can be guessed by the heuristics of the autobuild scripts. If `autobuild` fails, then you must switch to `manual` or `none`. If `autobuild` succeeds, then the results and run time will be the same as `manual` mode.
-- `none` build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to. `none` is not yet supported by Swift, Go, or Kotlin. It is in public preview for C/C++.
-
-
-## Supported versions of the CodeQL Action
-
-The following versions of the CodeQL Action are currently supported:
-
-- v4 (latest)
-- v3
-
-## Supported versions of the CodeQL Bundle on GitHub Enterprise Server
-
-We typically release new minor versions of the CodeQL Action and Bundle when a new minor version of GitHub Enterprise Server (GHES) is released. When a version of GHES is deprecated, the CodeQL Action and Bundle releases that shipped with it are deprecated as well.
-
-| Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
-|-----------------------|-------------------------------|--------------------|-------|
-| `v4.36.2` | `2.25.6` | Enterprise Server 3.22 | |
-| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
-| `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
-| `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
-
-See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
-
-## Keeping the CodeQL Action up to date in advanced setups
-
-If you are using an [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning), we recommend referencing the CodeQL Action using a major version tag (e.g. `v4`) in your workflow file. This ensures your workflow automatically picks up the latest release within that major version, including bug fixes, new features, and updated CodeQL CLI versions.
-
-If you pin to a specific commit SHA or patch version tag, ensure you keep it updated (e.g. via [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)). Some CodeQL Action features are enabled by server-side flags that may be removed over time, which can cause old versions to lose functionality.
-
-## Troubleshooting
-
-Read about [troubleshooting code scanning](https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning).
-
-## Contributing
-
-This project welcomes contributions. See [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to build, install, and contribute.

action.yml

@@ -1,11 +1,32 @@
-name: 'CodeQL: Stub'
-description: "Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead."
+name: 'CodeQL'
+description: 'CodeQL analysis'
 author: 'GitHub'
+inputs:
+  tools:
+    description: URL of CodeQL tools
+    required: false
+    default: https://github.com/github/codeql-action/releases/download/codeql-bundle-20200427/codeql-bundle.tar.gz
+  languages:
+    description: The languages to be analysed
+    required: false
+  token:
+    default: ${{ github.token }}
+  config-file:
+    description: Path of the config file to use
+    required: false
+  check_name:
+    description: The name of the check run to add text to.
+  output:
+    description: The path of the directory in which to save the SARIF results
+    required: false
+    default: '../results'
+  upload:
+    description: Upload the SARIF file
+    required: false
+    default: true
+  matrix:
+    default: ${{ toJson(matrix) }}
 runs:
-  using: 'composite'
-  steps:
-    - name: 'Stub'
-      run: |
-        echo 'This is a stub. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.'
-        exit 1
-      shell: bash
+  using: 'node12'
+  pre: './lib/setup-tracer.js'
+  main: './lib/finalize-db.js'

analyze/action.yml

@@ -1,99 +1,21 @@
-name: "CodeQL: Finish"
-description: "Finalize CodeQL database"
-author: "GitHub"
+name: 'CodeQL: Finish'
+description: 'Finalize CodeQL database'
+author: 'GitHub'
 inputs:
   check_name:
     description: The name of the check run to add text to.
-    required: false
   output:
-    description: The path of the directory in which to save the SARIF results from the CodeQL CLI.
+    description: The path of the directory in which to save the SARIF results
     required: false
-    default: "../results"
+    default: '../results'
   upload:
-    description: >-
-      Upload the SARIF file to Code Scanning.
-      Defaults to 'always' which uploads the SARIF file to Code Scanning for successful and failed runs.
-      'failure-only' only uploads debugging information to Code Scanning if the workflow run fails, for users post-processing the SARIF file before uploading it to Code Scanning.
-      'never' avoids uploading the SARIF file to Code Scanning, even if the code scanning run fails. This is not recommended for external users since it complicates debugging.
+    description: Upload the SARIF file
     required: false
-    # If changing this, make sure to update workflow.ts accordingly.
-    default: "always"
-  cleanup-level:
-    description: >-
-      DEPRECATED. This option is ignored since, for performance reasons, the CodeQL Action automatically
-      manages cleanup of intermediate results.
-    required: false
-  ram:
-    description: >-
-      The amount of memory in MB that can be used by CodeQL for database finalization and query execution.
-      By default, this action will use the same amount of memory as previously set in the "init" action.
-      If the "init" action also does not have an explicit "ram" input, this action will use most of the
-      memory available in the system (which for GitHub-hosted runners is 6GB for Linux, 5.5GB for Windows,
-      and 13GB for macOS).
-    required: false
-  add-snippets:
-    description: Does not have any effect.
-    required: false
-    deprecationMessage: >-
-      The input "add-snippets" has been removed and no longer has any effect.
-  skip-queries:
-    description: If this option is set, the CodeQL database will be built but no queries will be run on it. Thus, no results will be produced.
-    required: false
-    default: "false"
-  threads:
-    description: >-
-      The number of threads that can be used by CodeQL for database finalization and query execution.
-      By default, this action will use the same number of threads as previously set in the "init" action.
-      If the "init" action also does not have an explicit "threads" input, this action will use all the
-      hardware threads available in the system (which for GitHub-hosted runners is 2 for Linux and Windows
-      and 3 for macOS).
-    required: false
-  checkout_path:
-    description: "The path at which the analyzed repository was checked out. Used to relativize any absolute paths in the uploaded SARIF file."
-    required: false
-    # If changing this, make sure to update workflow.ts accordingly.
-    default: ${{ github.workspace }}
-  ref:
-    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks. Expected format: refs/heads/<branch name>, refs/tags/<tag>, refs/pull/<number>/merge, or refs/pull/<number>/head."
-    required: false
-  sha:
-    description: "The sha of the HEAD of the ref where results will be uploaded. If not provided, the Action will use the GITHUB_SHA environment variable. If provided, the ref input must be provided as well. This input is ignored for pull requests from forks."
-    required: false
-  category:
-    description: String used by Code Scanning for matching the analyses
-    required: false
-  upload-database:
-    description: Whether to upload the resulting CodeQL database
-    required: false
-    default: "true"
-  post-processed-sarif-path:
-    description: >-
-      Before uploading the SARIF files produced by the CodeQL CLI, the CodeQL Action may perform some post-processing
-      on them. Ordinarily, these post-processed SARIF files are not saved to disk. However, if a path is provided as an
-      argument for this input, they are written to the specified directory.
-    required: false
-  wait-for-processing:
-    description: If true, the Action will wait for the uploaded SARIF to be processed before completing.
-    required: true
-    default: "true"
+    default: true
   token:
-    description: "GitHub token to use for authenticating with this instance of GitHub. The token must be the built-in GitHub Actions token, and the workflow must have the `security-events: write` permission. Most of the time it is advisable to avoid specifying this input so that the workflow falls back to using the default value."
-    required: false
     default: ${{ github.token }}
   matrix:
     default: ${{ toJson(matrix) }}
-  expect-error:
-    description: "[Internal] It is an error to use this input outside of integration testing of the codeql-action."
-    required: false
-    default: "false"
-outputs:
-  db-locations:
-    description: A map from language to absolute path for each database created by CodeQL.
-  sarif-output:
-    description: Absolute, local path to the directory containing the generated SARIF file.
-  sarif-id:
-    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
-  main: "../lib/analyze-entry.js"
-  post: "../lib/analyze-post-entry.js"
+  using: 'node12'
+  main: '../lib/finalize-db.js'

autobuild/action.yml

@@ -1,19 +1,11 @@
 name: 'CodeQL: Autobuild'
-description: 'Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead.'
+description: 'Attempt to automatically build code'
 author: 'GitHub'
 inputs:
   token:
-    description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission."
-    required: false
     default: ${{ github.token }}
   matrix:
     default: ${{ toJson(matrix) }}
-  working-directory:
-    description: >-
-      Run the autobuilder using this path (relative to $GITHUB_WORKSPACE) as
-      working directory. If this input is not set, the autobuilder runs with
-      $GITHUB_WORKSPACE as its working directory.
-    required: false
 runs:
-  using: node24
-  main: '../lib/autobuild-entry.js'
+  using: 'node12'
+  main: '../lib/autobuild.js'

ava.config.mjs

@@ -1,9 +0,0 @@
-export default {
-  typescript: {
-    rewritePaths: {
-      "src/": "build/",
-    },
-    compile: false,
-  },
-  require: ["./ava.setup.mjs"],
-};

ava.setup.mjs

@@ -1,3 +0,0 @@
-import pkg from "./package.json" with { type: "json" };
-
-globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;

build.mjs

@@ -1,222 +0,0 @@
-import { copyFile, readFile, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import * as esbuild from "esbuild";
-import { globSync } from "glob";
-
-import pkg from "./package.json" with { type: "json" };
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const SRC_DIR = join(__dirname, "src");
-const OUT_DIR = join(__dirname, "lib");
-
-/**
- * Clean the output directory before building.
- *
- * @type {esbuild.Plugin}
- */
-const cleanPlugin = {
-  name: "clean",
-  setup(build) {
-    build.onStart(async () => {
-      await rm(OUT_DIR, { recursive: true, force: true });
-    });
-  },
-};
-
-/**
- * Copy defaults.json to the output directory since other projects depend on it.
- *
- * @type {esbuild.Plugin}
- */
-const copyDefaultsPlugin = {
-  name: "copy-defaults",
-  setup(build) {
-    build.onEnd(async () => {
-      await rm(join(OUT_DIR, "defaults.json"), {
-        force: true,
-      });
-      await copyFile(
-        join(SRC_DIR, "defaults.json"),
-        join(OUT_DIR, "defaults.json"),
-      );
-    });
-  },
-};
-
-/**
- * Log when the build ends.
- *
- * @type {esbuild.Plugin}
- */
-const onEndPlugin = {
-  name: "on-end",
-  setup(build) {
-    build.onEnd((result) => {
-      // eslint-disable-next-line no-console
-      console.log(`Build ended with ${result.errors.length} errors`);
-    });
-  },
-};
-
-/** The name of the virtual `entry-points` module. */
-const SHARED_ENTRYPOINT = "entry-points";
-
-/** The property name under which `upload-lib`'s namespace is exposed in `entry-points`. */
-const UPLOAD_LIB_EXPORT = "uploadLib";
-
-/** The relative source path of the `upload-lib` module that we re-export from `entry-points`. */
-const UPLOAD_LIB_SRC = "./src/upload-lib";
-
-/**
- * This plugin finds all source files that contain Action entry points. It then generates the
- * virtual `entry-points` module which imports all identified files, and re-exports their
- * `runWrapper` functions with suitable aliases.
- *
- * The virtual module additionally re-exports `upload-lib` under the `uploadLib` namespace so that
- * external consumers can access it via the small `lib/upload-lib.js` stub emitted below.
- * 
- * A tiny stub file is emitted for each Action entrypoint, and one for `upload-lib`. Each stub
- * imports the shared bundle and calls/re-exports from the respective entry point.
- *
- * @type {esbuild.Plugin}
- */
-const entryPointsPlugin = {
-  name: "entry-points",
-  setup(build) {
-    const namespace = "actions";
-    const actions = [];
-
-    const toPascal = (s) =>
-      s.replace(/(^|-)([a-z0-9])/gi, (_, __, c) => c.toUpperCase());
-
-    // Find the source files containing Action entry points.
-    build.onStart(() => {
-      const actionFiles = globSync("src/*-action{,-post}.ts");
-      for (const actionFile of actionFiles) {
-        const match = basename(actionFile).match(/(.*)-action(-post)?/);
-
-        if (match.length < 2) {
-          throw new Error(`'${actionFile}' didn't match expected pattern.`);
-        }
-
-        const actionName = match[1];
-        const isPost = match[2] !== undefined;
-
-        actions.push({
-          path: actionFile,
-          name: actionName,
-          isPost,
-          pascalCaseName: `${toPascal(actionName)}${isPost ? "Post" : ""}Action`,
-        });
-      }
-    });
-
-    // Resolve the virtual `entry-points` file and set the corresponding namespace.
-    // Ideally, we'd `RegExp.escape` the entrypoint here, but that API isn't supported in Node 20.
-    // Since we're dealing with a hardcoded string, this isn't too much of a problem.
-    build.onResolve({ filter: new RegExp(`^${SHARED_ENTRYPOINT}$`) }, () => {
-      return { path: SHARED_ENTRYPOINT, namespace };
-    });
-
-    // Generate the virtual `entry-points` file based on the Actions we discovered.
-    // Restrict using the namespace. The path filter does not need to discriminate any further.
-    build.onLoad({ filter: /.*/, namespace }, async () => {
-      const wrapperTemplatePath = "entry-wrapper.js.tpl";
-      const wrapperTemplate = await readFile(
-        join(SRC_DIR, wrapperTemplatePath),
-        "utf-8",
-      );
-
-      const actionsSorted = actions.sort((a, b) =>
-        a.name.localeCompare(b.name),
-      );
-      const imports = actionsSorted
-        .map(
-          (action) =>
-            `import * as ${action.pascalCaseName} from "./src/${basename(action.path)}";`,
-        )
-        .join("\n");
-      const wrappers = actionsSorted
-        .map((action) =>
-          wrapperTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        )
-        .join("\n\n");
-
-      // Also re-export the `upload-lib` namespace so that external consumers can reach it
-      // via the `lib/upload-lib.js` stub without us having to bundle a second copy.
-      const uploadLibReExport = `export * as ${UPLOAD_LIB_EXPORT} from "${UPLOAD_LIB_SRC}";`;
-
-      return {
-        contents: `"use strict";\n${imports}\n\n${uploadLibReExport}\n\n${wrappers}\n`,
-        resolveDir: ".",
-        loader: "ts",
-      };
-    });
-
-    // Emit entry point stubs for each Action using the entry template.
-    build.onEnd(async () => {
-      const makeHeader = (templatePath, sourceFile) =>
-        `// Automatically generated from '${templatePath}' for 'src/${basename(sourceFile)}'.\n\n`;
-
-      // Read the entry point template.
-      const actionTemplatePath = "action-entry.js.tpl";
-      const actionTemplate = await readFile(
-        join(SRC_DIR, actionTemplatePath),
-        "utf-8",
-      );
-
-      // Write entry point stubs for each Action.
-      for (const action of actions) {
-        await writeFile(
-          join(
-            OUT_DIR,
-            `${action.name}${action.isPost ? "-post" : ""}-entry.js`,
-          ),
-          makeHeader(actionTemplatePath, action.path) +
-            actionTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        );
-      }
-
-      // Write a small stub for `upload-lib` that re-exports it from the shared bundle.
-      // External callers (e.g. internal testing environments) `require("./lib/upload-lib")`
-      // and expect the same shape as before, so we expose the namespace as `module.exports`.
-      const uploadLibStubTemplatePath = "upload-lib-stub.js.tpl";
-      const uploadLibStubTemplate = await readFile(
-        join(SRC_DIR, uploadLibStubTemplatePath),
-        "utf-8",
-      );
-      await writeFile(
-        join(OUT_DIR, "upload-lib.js"),
-        makeHeader(uploadLibStubTemplatePath, `${UPLOAD_LIB_SRC}.ts`) +
-          uploadLibStubTemplate.replaceAll(
-            "__UPLOAD_LIB_EXPORT__",
-            UPLOAD_LIB_EXPORT,
-          ),
-      );
-    });
-  },
-};
-
-const context = await esbuild.context({
-  entryPoints: [{ in: SHARED_ENTRYPOINT, out: SHARED_ENTRYPOINT }],
-  bundle: true,
-  format: "cjs",
-  outdir: OUT_DIR,
-  platform: "node",
-  external: ["./entry-points"],
-  plugins: [cleanPlugin, copyDefaultsPlugin, entryPointsPlugin, onEndPlugin],
-  target: ["node20"],
-  define: {
-    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
-  },
-  metafile: true,
-});
-
-const result = await context.rebuild();
-await writeFile(join(__dirname, "meta.json"), JSON.stringify(result.metafile));
-
-await context.dispose();

eslint.config.mjs

@@ -1,212 +0,0 @@
-import { fixupPluginRules } from "@eslint/compat";
-import js from "@eslint/js";
-import github from "eslint-plugin-github";
-import { importX, createNodeResolver } from "eslint-plugin-import-x";
-import { createTypeScriptImportResolver } from "eslint-import-resolver-typescript";
-import noAsyncForeach from "eslint-plugin-no-async-foreach";
-import jsdoc from "eslint-plugin-jsdoc";
-import tseslint from "typescript-eslint";
-import globals from "globals";
-import path from "path";
-import { fileURLToPath } from "url";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const githubFlatConfigs = github.getFlatConfigs();
-
-export default [
-  {
-    ignores: [
-      "**/webpack.config.js",
-      "build/**/*",
-      "lib/**/*",
-      "src/testdata/**/*",
-      "tests/**/*",
-      "build.mjs",
-      "ava.config.mjs",
-      "ava.setup.mjs",
-      "eslint.config.mjs",
-      ".github/**/*",
-    ],
-  },
-  // eslint recommended config
-  js.configs.recommended,
-  // Type-checked rules from typescript-eslint
-  ...tseslint.configs.recommendedTypeChecked,
-  ...tseslint.configs.strict,
-  // eslint-plugin-github recommended config
-  githubFlatConfigs.recommended,
-  // eslint-plugin-github typescript config
-  ...githubFlatConfigs.typescript,
-  // import-x TypeScript settings
-  // This is needed for import-x rules to properly parse TypeScript files.
-  {
-    settings: importX.flatConfigs.typescript.settings,
-  },
-  {
-    plugins: {
-      "import-x": importX,
-      "no-async-foreach": fixupPluginRules(noAsyncForeach),
-      jsdoc: jsdoc,
-    },
-
-    languageOptions: {
-      ecmaVersion: "latest",
-      sourceType: "module",
-
-      globals: {
-        ...globals.node,
-      },
-
-      parserOptions: {
-        project: "./tsconfig.json",
-      },
-    },
-
-    settings: {
-      "import/resolver": {
-        node: {
-          moduleDirectory: ["node_modules", "src"],
-        },
-
-        typescript: {},
-      },
-      "import/ignore": [
-        "sinon",
-        "uuid",
-        "@octokit/plugin-retry",
-        "del",
-        "get-folder-size",
-      ],
-      "import-x/resolver-next": [
-        createTypeScriptImportResolver(),
-        createNodeResolver({
-          extensions: [".ts", ".js", ".json"],
-        }),
-      ],
-    },
-
-    rules: {
-      "github/filenames-match-regex": ["error", "^[a-z0-9-]+(\\.test)?$"],
-      "i18n-text/no-en": "off",
-
-      "import/extensions": [
-        "error",
-        {
-          json: {},
-        },
-      ],
-
-      "import/no-amd": "error",
-      "import/no-commonjs": "error",
-      // import/no-cycle does not seem to work with ESLint 9.
-      // Use import-x/no-cycle from eslint-plugin-import-x instead.
-      "import/no-cycle": "off",
-      "import-x/no-cycle": "error",
-      "import/no-dynamic-require": "error",
-
-      "import/no-extraneous-dependencies": [
-        "error",
-        {
-          devDependencies: true,
-        },
-      ],
-
-      "import/no-namespace": "off",
-      "import/no-unresolved": "error",
-      "import/no-webpack-loader-syntax": "error",
-
-      "import/order": [
-        "error",
-        {
-          alphabetize: {
-            order: "asc",
-          },
-
-          "newlines-between": "always",
-        },
-      ],
-
-      "max-len": [
-        "error",
-        {
-          code: 120,
-          ignoreUrls: true,
-          ignoreStrings: true,
-          ignoreTemplateLiterals: true,
-        },
-      ],
-
-      "no-async-foreach/no-async-foreach": "error",
-      "no-sequences": "error",
-      "no-shadow": "off",
-      // This is overly restrictive with unsetting `EnvVar`s
-      "@typescript-eslint/no-dynamic-delete": "off",
-      "@typescript-eslint/no-shadow": "error",
-      "@typescript-eslint/prefer-optional-chain": "error",
-      "one-var": ["error", "never"],
-
-      // Check param names to ensure that we don't have outdated JSDocs.
-      "jsdoc/check-param-names": [
-        "error",
-        {
-          // We don't currently require full JSDoc coverage, so this rule
-          // should not error on missing @param annotations.
-          disableMissingParamChecks: true,
-        },
-      ],
-    },
-  },
-  {
-    files: ["**/*.ts", "**/*.js"],
-
-    rules: {
-      "@typescript-eslint/no-explicit-any": "off",
-      "@typescript-eslint/no-unsafe-assignment": "off",
-      "@typescript-eslint/no-unsafe-enum-comparison": "off",
-      "@typescript-eslint/no-unsafe-member-access": "off",
-      "@typescript-eslint/no-var-requires": "off",
-      "@typescript-eslint/prefer-regexp-exec": "off",
-      "@typescript-eslint/require-await": "off",
-      "@typescript-eslint/restrict-template-expressions": "off",
-      "@typescript-eslint/no-unused-vars": [
-        "error",
-        {
-          args: "all",
-          argsIgnorePattern: "^_",
-        },
-      ],
-      "func-style": "off",
-    },
-  },
-  {
-    files: ["pr-checks/**/*.ts"],
-
-    languageOptions: {
-      parserOptions: {
-        // Use the correct `tsconfig.json` for `pr-checks`.
-        project: "./pr-checks/tsconfig.json",
-      },
-    },
-
-    rules: {
-      // The scripts in `pr-checks` are expected to output to the console.
-      "no-console": "off",
-
-      "import/no-extraneous-dependencies": [
-        "error",
-        { packageDir: [__dirname, path.resolve(__dirname, "pr-checks")] },
-      ],
-
-      "@typescript-eslint/no-floating-promises": [
-        "error",
-        {
-          allowForKnownSafeCalls: [
-            // Avoid needing explicit `void` in front of `describe` calls in test files.
-            { from: "package", name: ["describe"], package: "node:test" },
-          ],
-        },
-      ],
-    },
-  },
-];

init/action.yml

@@ -1,182 +1,19 @@
 name: 'CodeQL: Init'
-description: 'Set up CodeQL'
+description: 'Setup the CodeQL tracer'
 author: 'GitHub'
 inputs:
   tools:
-    description: >-
-      By default, the Action will use the recommended version of the CodeQL
-      Bundle to analyze your project. You can override this choice using this
-      input. One of:
-
-      - A local path to a CodeQL Bundle tarball, or
-      - The URL of a CodeQL Bundle tarball GitHub release asset, or
-      - A special value `linked` which uses the version of the CodeQL tools
-        that the Action has been bundled with.
-      - A special value `nightly` which uses the latest nightly version of the
-        CodeQL tools. Note that this is unstable and not recommended for
-        production use.
-
-      If not specified, the Action will check in several places until it finds
-      the CodeQL tools.
+    description: URL of CodeQL tools
     required: false
+    default: https://github.com/github/codeql-action/releases/download/codeql-bundle-20200427/codeql-bundle.tar.gz
   languages:
-    description: >-
-      A comma-separated list of CodeQL languages to analyze.
-
-      Due to the performance benefit of parallelizing builds, we recommend specifying languages to
-      analyze using a matrix and providing `\$\{{ matrix.language }}` as this input.
-
-      For more information, see
-      https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#changing-the-languages-that-are-analyzed.
+    description: The languages to be analysed
     required: false
-  build-mode:
-    description: >-
-      The build mode that will be used to analyze the language. This input is only available when
-      analyzing a single CodeQL language per job, for example using a matrix.
-
-      Available build modes will differ based on the language being analyzed. One of:
-
-      - `none`:      The database will be created without building the source code.
-                     Available for all interpreted languages and some compiled languages.
-      - `autobuild`: The database will be created by attempting to automatically build the source
-                     code. Available for all compiled languages.
-      - `manual`:   The database will be created by building the source code using a manually
-                     specified build command. To use this build mode, specify manual build steps in
-                     your workflow between the `init` and `analyze` steps. Available for all
-                     compiled languages.
-    required: false
-  analysis-kinds:
-    description: >-
-      [Internal] A comma-separated list of analysis kinds to enable. This input is intended for
-      internal-use only at this time and the behaviour is subject to changes. Some features may
-      not be available depending on which analysis kinds are enabled.
-
-      Available options are:
-
-      - `code-scanning`: The default, security-focused analysis.
-      - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
-                        with `code-scanning`.
-    default: 'code-scanning'
-    required: true
   token:
-    description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
     default: ${{ github.token }}
-    required: false
-  registries:
-    description: |
-      Use this input only when you need to download CodeQL packages from another instance of GitHub. If you only need to download packages from this GitHub instance, use the token input instead.
-
-      A YAML string that defines the list of GitHub container registries to use for downloading packs. The string is in the following form (the | is required on the first line):
-
-      registries: |
-          - url: https://containers.GHEHOSTNAME1/v2/
-            packages:
-              - my-company/*
-              - my-company2/*
-            token: \$\{{ secrets.GHEHOSTNAME1_TOKEN }}
-
-          - url: https://ghcr.io/v2/
-            packages: */*
-            token: \$\{{ secrets.GHCR_TOKEN }}
-
-      The `url` property contains the URL to the container registry you want to connect to.
-
-      The `packages` property contains a single glob string or a list of glob strings, specifying which packages should be retrieved from this particular container registry. Order is important. Earlier entries will match before later entries.
-
-      The `token` property contains a connection token for this registry.    required: false
-  matrix:
-    default: ${{ toJson(matrix) }}
-    required: false
   config-file:
     description: Path of the config file to use
     required: false
-  db-location:
-    description: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
-    required: false
-  config:
-    description: Configuration passed as a YAML string in the same format as the config-file input. This takes precedence over the config-file input.
-    required: false
-  queries:
-    description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
-    required: false
-  quality-queries:
-    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
-    required: false
-  packs:
-    description: >-
-      Comma-separated list of packs to run. Reference a pack in the format `scope/name[@version]`. If `version` is not
-      specified, then the latest version of the pack is used. By default, this overrides the same setting in a
-      configuration file; prefix with "+" to use both sets of packs.
-
-      This input is only available in single-language analyses. To use packs in multi-language
-      analyses, you must specify packs in the codeql-config.yml file.
-    required: false
-  external-repository-token:
-    description: A token for fetching external config files and queries if they reside in a private repository in the same GitHub instance that is running this action.
-    required: false
-  setup-python-dependencies:
-    description: DEPRECATED. This option is ignored since CodeQL Action no longer installs Python dependencies as of versions 3.25.0 and 2.25.0.
-    required: false
-  source-root:
-    description: Path of the root source code directory, relative to $GITHUB_WORKSPACE.
-    required: false
-  ram:
-    description: >-
-      The amount of memory in MB that can be used by CodeQL extractors.
-      By default, CodeQL extractors will use most of the memory available in the system
-      (which for GitHub-hosted runners is 6GB for Linux, 5.5GB for Windows, and 13GB for macOS).
-      This input also sets the amount of memory that can later be used by the "analyze" action.
-    required: false
-  threads:
-    description: >-
-      The number of threads that can be used by CodeQL extractors.
-      By default, CodeQL extractors will use all the hardware threads available in the system
-      (which for GitHub-hosted runners is 2 for Linux and Windows and 3 for macOS).
-      This input also sets the number of threads that can later be used by the "analyze" action.
-    required: false
-  debug:
-    description: >-
-      Enable debugging mode.
-      This will result in more output being produced which may be useful when debugging certain issues.
-      Debugging mode is enabled automatically when step debug logging is turned on.
-    required: false
-    default: 'false'
-  debug-artifact-name:
-    description: >-
-      The name of the artifact to store debugging information in.
-      This is only used when debug mode is enabled.
-    required: false
-  debug-database-name:
-    description: >-
-      The name of the database uploaded to the debugging artifact.
-      This is only used when debug mode is enabled.
-    required: false
-  trap-caching:
-    description: >-
-      Explicitly enable or disable TRAP caching rather than respecting the feature flag for it.
-    required: false
-  dependency-caching:
-    description: >-
-      Explicitly enable or disable caching of project build dependencies.
-    required: false
-  check-run-id:
-    description: >-
-      [Internal] The ID of the check run, as provided by the Actions runtime environment. Do not set this value manually.
-    default: ${{ job.check_run_id }}
-    required: false
-  job-status:
-    description: >-
-      [Internal] The status of the job, as provided by the Actions runtime environment. This is how the
-      post step learns whether the job as a whole succeeded, failed, or was cancelled. Do not set this
-      value manually.
-    default: ${{ job.status }}
-    required: false
-outputs:
-  codeql-path:
-    description: The path of the CodeQL binary used for analysis
-  codeql-version:
-    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
-  main: '../lib/init-entry.js'
-  post: '../lib/init-post-entry.js'
+  using: 'node12'
+  main: '../lib/setup-tracer.js'

jest.config.js

@@ -0,0 +1,11 @@
+module.exports = {
+  clearMocks: true,
+  moduleFileExtensions: ['js', 'ts'],
+  testEnvironment: 'node',
+  testMatch: ['**/*.test.ts'],
+  testRunner: 'jest-circus/runner',
+  transform: {
+    '^.+\\.ts$': 'ts-jest'
+  },
+  verbose: true
+}

justfile

@@ -1,30 +0,0 @@
-# Perform all working copy cleanup operations
-all: lint sync
-
-# Lint source typescript
-lint:
-    npm run lint-fix
-
-# Sync generated files (javascript and PR checks)
-sync: build update-pr-checks
-
-# Perform all necessary steps to update the PR checks
-update-pr-checks:
-    pr-checks/sync.sh
-
-# Transpile typescript code into javascript
-build:
-    npm run build
-
-# Build then run all the tests
-test: build
-    npm run test
-
-# Run the tests for a single file
-test_file filename: build
-    npm run ava {{filename}}
-
-[doc("Refresh the .js build artefacts in the lib directory")]
-[confirm]
-refresh-lib:
-    rm -rf lib && npm run build

lib/analysis-paths.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+function includeAndExcludeAnalysisPaths(config, languages) {
+    if (config.paths.length !== 0) {
+        core.exportVariable('LGTM_INDEX_INCLUDE', config.paths.join('\n'));
+    }
+    if (config.pathsIgnore.length !== 0) {
+        core.exportVariable('LGTM_INDEX_EXCLUDE', config.pathsIgnore.join('\n'));
+    }
+    function isInterpretedLanguage(language) {
+        return language === 'javascript' && language === 'python';
+    }
+    // Index include/exclude only work in javascript and python
+    // If some other language is detected/configured show a warning
+    if ((config.paths.length !== 0 || config.pathsIgnore.length !== 0) && !languages.every(isInterpretedLanguage)) {
+        core.warning('The "paths"/"paths-ignore" fields of the config only have effect for Javascript and Python');
+    }
+}
+exports.includeAndExcludeAnalysisPaths = includeAndExcludeAnalysisPaths;

lib/analyze-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzeAction)();

lib/analyze-post-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzePostAction)();

lib/autobuild-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/autobuild-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAutobuildAction)();

lib/autobuild.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const path = __importStar(require("path"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util = __importStar(require("./util"));
+async function run() {
+    var _a;
+    try {
+        if (util.should_abort('autobuild', true) || !await util.reportActionStarting('autobuild')) {
+            return;
+        }
+        // Attempt to find a language to autobuild
+        // We want pick the dominant language in the repo from the ones we're able to build
+        // The languages are sorted in order specified by user or by lines of code if we got
+        // them from the GitHub API, so try to build the first language on the list.
+        const language = (_a = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]) === null || _a === void 0 ? void 0 : _a.split(',')[0];
+        if (!language) {
+            core.info("None of the languages in this project require extra build steps");
+            return;
+        }
+        core.debug(`Detected dominant traced language: ${language}`);
+        core.startGroup(`Attempting to automatically build ${language} code`);
+        // TODO: share config accross actions better via env variables
+        const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
+        const cmdName = process.platform === 'win32' ? 'autobuild.cmd' : 'autobuild.sh';
+        const autobuildCmd = path.join(path.dirname(codeqlCmd), language, 'tools', cmdName);
+        // Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'
+        // This is because of an issue with Azure pipelines timing out connections after 4 minutes
+        // and Maven not properly handling closed connections
+        // Otherwise long build processes will timeout when pulling down Java packages
+        // https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
+        let javaToolOptions = process.env['JAVA_TOOL_OPTIONS'] || "";
+        process.env['JAVA_TOOL_OPTIONS'] = [...javaToolOptions.split(/\s+/), '-Dhttp.keepAlive=false', '-Dmaven.wagon.http.pool=false'].join(' ');
+        await exec.exec(autobuildCmd);
+        core.endGroup();
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('autobuild', error.message, error.stack);
+        return;
+    }
+    await util.reportActionSucceeded('autobuild');
+}
+run().catch(e => {
+    core.setFailed("autobuild action failed: " + e);
+    console.log(e);
+});

lib/config-utils.js

@@ -0,0 +1,135 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const io = __importStar(require("@actions/io"));
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const path = __importStar(require("path"));
+class ExternalQuery {
+    constructor(repository, ref) {
+        this.path = '';
+        this.repository = repository;
+        this.ref = ref;
+    }
+}
+exports.ExternalQuery = ExternalQuery;
+class Config {
+    constructor() {
+        this.name = "";
+        this.disableDefaultQueries = false;
+        this.additionalQueries = [];
+        this.externalQueries = [];
+        this.pathsIgnore = [];
+        this.paths = [];
+    }
+    addQuery(queryUses) {
+        // The logic for parsing the string is based on what actions does for
+        // parsing the 'uses' actions in the workflow file
+        if (queryUses === "") {
+            throw '"uses" value for queries cannot be blank';
+        }
+        if (queryUses.startsWith("./")) {
+            this.additionalQueries.push(queryUses.slice(2));
+            return;
+        }
+        let tok = queryUses.split('@');
+        if (tok.length !== 2) {
+            throw '"uses" value for queries must be a path, or owner/repo@ref \n Found: ' + queryUses;
+        }
+        const ref = tok[1];
+        tok = tok[0].split('/');
+        // The first token is the owner
+        // The second token is the repo
+        // The rest is a path, if there is more than one token combine them to form the full path
+        if (tok.length > 3) {
+            tok = [tok[0], tok[1], tok.slice(2).join('/')];
+        }
+        if (tok.length < 2) {
+            throw '"uses" value for queries must be a path, or owner/repo@ref \n Found: ' + queryUses;
+        }
+        let external = new ExternalQuery(tok[0] + '/' + tok[1], ref);
+        if (tok.length === 3) {
+            external.path = tok[2];
+        }
+        this.externalQueries.push(external);
+    }
+}
+exports.Config = Config;
+const configFolder = process.env['RUNNER_WORKSPACE'] || '/tmp/codeql-action';
+function initConfig() {
+    const configFile = core.getInput('config-file');
+    const config = new Config();
+    // If no config file was provided create an empty one
+    if (configFile === '') {
+        core.debug('No configuration file was provided');
+        return config;
+    }
+    try {
+        const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
+        if (parsedYAML.name && typeof parsedYAML.name === "string") {
+            config.name = parsedYAML.name;
+        }
+        if (parsedYAML['disable-default-queries'] && typeof parsedYAML['disable-default-queries'] === "boolean") {
+            config.disableDefaultQueries = parsedYAML['disable-default-queries'];
+        }
+        const queries = parsedYAML.queries;
+        if (queries && queries instanceof Array) {
+            queries.forEach(query => {
+                if (query.uses && typeof query.uses === "string") {
+                    config.addQuery(query.uses);
+                }
+            });
+        }
+        const pathsIgnore = parsedYAML['paths-ignore'];
+        if (pathsIgnore && pathsIgnore instanceof Array) {
+            pathsIgnore.forEach(path => {
+                if (typeof path === "string") {
+                    config.pathsIgnore.push(path);
+                }
+            });
+        }
+        const paths = parsedYAML.paths;
+        if (paths && paths instanceof Array) {
+            paths.forEach(path => {
+                if (typeof path === "string") {
+                    config.paths.push(path);
+                }
+            });
+        }
+    }
+    catch (err) {
+        core.setFailed(err);
+    }
+    return config;
+}
+async function saveConfig(config) {
+    const configString = JSON.stringify(config);
+    await io.mkdirP(configFolder);
+    fs.writeFileSync(path.join(configFolder, 'config'), configString, 'utf8');
+    core.debug('Saved config:');
+    core.debug(configString);
+}
+async function loadConfig() {
+    const configFile = path.join(configFolder, 'config');
+    if (fs.existsSync(configFile)) {
+        const configString = fs.readFileSync(configFile, 'utf8');
+        core.debug('Loaded config:');
+        core.debug(configString);
+        return JSON.parse(configString);
+    }
+    else {
+        const config = initConfig();
+        core.debug('Initialized config:');
+        core.debug(JSON.stringify(config));
+        await saveConfig(config);
+        return config;
+    }
+}
+exports.loadConfig = loadConfig;

lib/defaults.json

@@ -1,6 +0,0 @@
-{
-  "bundleVersion": "codeql-bundle-v2.27.2",
-  "cliVersion": "2.27.2",
-  "priorBundleVersion": "codeql-bundle-v2.27.1",
-  "priorCliVersion": "2.27.1"
-}

lib/external-queries.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+async function checkoutExternalQueries(config) {
+    const folder = process.env['RUNNER_WORKSPACE'] || '/tmp/codeql-action';
+    for (const externalQuery of config.externalQueries) {
+        core.info('Checking out ' + externalQuery.repository);
+        const checkoutLocation = path.join(folder, externalQuery.repository);
+        if (!fs.existsSync(checkoutLocation)) {
+            const repoURL = 'https://github.com/' + externalQuery.repository + '.git';
+            await exec.exec('git', ['clone', repoURL, checkoutLocation]);
+            await exec.exec('git', [
+                '--work-tree=' + checkoutLocation,
+                '--git-dir=' + checkoutLocation + '/.git',
+                'checkout', externalQuery.ref,
+            ]);
+        }
+        config.additionalQueries.push(path.join(checkoutLocation, externalQuery.path));
+    }
+}
+exports.checkoutExternalQueries = checkoutExternalQueries;

lib/finalize-db.js

@@ -0,0 +1,141 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const io = __importStar(require("@actions/io"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const configUtils = __importStar(require("./config-utils"));
+const externalQueries = __importStar(require("./external-queries"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const upload_lib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+async function createdDBForScannedLanguages(codeqlCmd, databaseFolder) {
+    const scannedLanguages = process.env[sharedEnv.CODEQL_ACTION_SCANNED_LANGUAGES];
+    if (scannedLanguages) {
+        for (const language of scannedLanguages.split(',')) {
+            core.startGroup('Extracting ' + language);
+            // Get extractor location
+            let extractorPath = '';
+            await exec.exec(codeqlCmd, ['resolve', 'extractor', '--format=json', '--language=' + language], {
+                silent: true,
+                listeners: {
+                    stdout: (data) => { extractorPath += data.toString(); },
+                    stderr: (data) => { process.stderr.write(data); }
+                }
+            });
+            // Set trace command
+            const ext = process.platform === 'win32' ? '.cmd' : '.sh';
+            const traceCommand = path.resolve(JSON.parse(extractorPath), 'tools', 'autobuild' + ext);
+            // Run trace command
+            await exec.exec(codeqlCmd, ['database', 'trace-command', path.join(databaseFolder, language), '--', traceCommand]);
+            core.endGroup();
+        }
+    }
+}
+async function finalizeDatabaseCreation(codeqlCmd, databaseFolder) {
+    await createdDBForScannedLanguages(codeqlCmd, databaseFolder);
+    const languages = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES] || '';
+    for (const language of languages.split(',')) {
+        core.startGroup('Finalizing ' + language);
+        await exec.exec(codeqlCmd, ['database', 'finalize', path.join(databaseFolder, language)]);
+        core.endGroup();
+    }
+}
+async function resolveQueryLanguages(codeqlCmd, config) {
+    let res = new Map();
+    if (config.additionalQueries.length !== 0) {
+        let resolveQueriesOutput = '';
+        const options = {
+            listeners: {
+                stdout: (data) => {
+                    resolveQueriesOutput += data.toString();
+                }
+            }
+        };
+        await exec.exec(codeqlCmd, [
+            'resolve',
+            'queries',
+            ...config.additionalQueries,
+            '--format=bylanguage'
+        ], options);
+        const resolveQueriesOutputObject = JSON.parse(resolveQueriesOutput);
+        for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
+            res[language] = Object.keys(queries);
+        }
+        const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
+        const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
+        if (noDeclaredLanguageQueries.length !== 0) {
+            throw new Error('Some queries do not declare a language, their qlpack.yml file is missing or is invalid');
+        }
+        const multipleDeclaredLanguages = resolveQueriesOutputObject.multipleDeclaredLanguages;
+        const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
+        if (multipleDeclaredLanguagesQueries.length !== 0) {
+            throw new Error('Some queries declare multiple languages, their qlpack.yml file is missing or is invalid');
+        }
+    }
+    return res;
+}
+// Runs queries and creates sarif files in the given folder
+async function runQueries(codeqlCmd, databaseFolder, sarifFolder, config) {
+    const queriesPerLanguage = await resolveQueryLanguages(codeqlCmd, config);
+    for (let database of fs.readdirSync(databaseFolder)) {
+        core.startGroup('Analyzing ' + database);
+        const queries = [];
+        if (!config.disableDefaultQueries) {
+            queries.push(database + '-code-scanning.qls');
+        }
+        queries.push(...(queriesPerLanguage[database] || []));
+        const sarifFile = path.join(sarifFolder, database + '.sarif');
+        await exec.exec(codeqlCmd, [
+            'database',
+            'analyze',
+            path.join(databaseFolder, database),
+            '--format=sarif-latest',
+            '--output=' + sarifFile,
+            '--no-sarif-add-snippets',
+            ...queries
+        ]);
+        core.debug('SARIF results for database ' + database + ' created at "' + sarifFile + '"');
+        core.endGroup();
+    }
+}
+async function run() {
+    try {
+        if (util.should_abort('finish', true) || !await util.reportActionStarting('finish')) {
+            return;
+        }
+        const config = await configUtils.loadConfig();
+        core.exportVariable(sharedEnv.ODASA_TRACER_CONFIGURATION, '');
+        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+        const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
+        const databaseFolder = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_DATABASE_DIR);
+        const sarifFolder = core.getInput('output');
+        await io.mkdirP(sarifFolder);
+        core.info('Finalizing database creation');
+        await finalizeDatabaseCreation(codeqlCmd, databaseFolder);
+        await externalQueries.checkoutExternalQueries(config);
+        core.info('Analyzing database');
+        await runQueries(codeqlCmd, databaseFolder, sarifFolder, config);
+        if ('true' === core.getInput('upload')) {
+            await upload_lib.upload(sarifFolder);
+        }
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('finish', error.message, error.stack);
+        return;
+    }
+    await util.reportActionSucceeded('finish');
+}
+run().catch(e => {
+    core.setFailed("analyze action failed: " + e);
+    console.log(e);
+});

lib/fingerprints.js

@@ -0,0 +1,247 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const fs = __importStar(require("fs"));
+const long_1 = __importDefault(require("long"));
+const tab = '\t'.charCodeAt(0);
+const space = ' '.charCodeAt(0);
+const lf = '\n'.charCodeAt(0);
+const cr = '\r'.charCodeAt(0);
+const BLOCK_SIZE = 100;
+const MOD = long_1.default.fromInt(37); // L
+// Compute the starting point for the hash mod
+function computeFirstMod() {
+    let firstMod = long_1.default.ONE; // L
+    for (let i = 0; i < BLOCK_SIZE; i++) {
+        firstMod = firstMod.multiply(MOD);
+    }
+    return firstMod;
+}
+/**
+ * Hash the contents of a file
+ *
+ * The hash method computes a rolling hash for every line in the input. The hash is computed using the first
+ * BLOCK_SIZE non-space/tab characters counted from the start of the line. For the computation of the hash all
+ * line endings (i.e. \r, \n, and \r\n) are normalized to '\n'. A special value (-1) is added at the end of the
+ * file followed by enough '\0' characters to ensure that there are BLOCK_SIZE characters available for computing
+ * the hashes of the lines near the end of the file.
+ *
+ * @param callback function that is called with the line number (1-based) and hash for every line
+ * @param input The file's contents
+ */
+function hash(callback, input) {
+    // A rolling view in to the input
+    const window = Array(BLOCK_SIZE).fill(0);
+    // If the character in the window is the start of a new line
+    // then records the line number, otherwise will be -1.
+    // Indexes match up with those from the window variable.
+    const lineNumbers = Array(BLOCK_SIZE).fill(-1);
+    // The current hash value, updated as we read each character
+    let hash = long_1.default.ZERO;
+    let firstMod = computeFirstMod();
+    // The current index in the window, will wrap around to zero when we reach BLOCK_SIZE
+    let index = 0;
+    // The line number of the character we are currently processing from the input
+    let lineNumber = 0;
+    // Is the next character to be read the start of a new line
+    let lineStart = true;
+    // Was the previous character a CR (carriage return)
+    let prevCR = false;
+    // A map of hashes we've seen before and how many times,
+    // so we can disambiguate identical hashes
+    const hashCounts = {};
+    // Output the current hash and line number to the callback function
+    const outputHash = function () {
+        let hashValue = hash.toUnsigned().toString(16);
+        if (!hashCounts[hashValue]) {
+            hashCounts[hashValue] = 0;
+        }
+        hashCounts[hashValue]++;
+        callback(lineNumbers[index], hashValue + ":" + hashCounts[hashValue]);
+        lineNumbers[index] = -1;
+    };
+    // Update the current hash value and increment the index in the window
+    const updateHash = function (current) {
+        const begin = window[index];
+        window[index] = current;
+        hash = MOD.multiply(hash)
+            .add(long_1.default.fromInt(current))
+            .subtract(firstMod.multiply(long_1.default.fromInt(begin)));
+        index = (index + 1) % BLOCK_SIZE;
+    };
+    // First process every character in the input, updating the hash and lineNumbers
+    // as we go. Once we reach a point in the window again then we've processed
+    // BLOCK_SIZE characters and if the last character at this point in the window
+    // was the start of a line then we should output the hash for that line.
+    for (let i = 0, len = input.length; i <= len; i++) {
+        let current = i === len ? 65535 : input.charCodeAt(i);
+        // skip tabs, spaces, and line feeds that come directly after a carriage return
+        if (current === space || current === tab || (prevCR && current === lf)) {
+            prevCR = false;
+            continue;
+        }
+        // replace CR with LF
+        if (current === cr) {
+            current = lf;
+            prevCR = true;
+        }
+        else {
+            prevCR = false;
+        }
+        if (lineNumbers[index] !== -1) {
+            outputHash();
+        }
+        if (lineStart) {
+            lineStart = false;
+            lineNumber++;
+            lineNumbers[index] = lineNumber;
+        }
+        if (current === lf) {
+            lineStart = true;
+        }
+        updateHash(current);
+    }
+    // Flush the remaining lines
+    for (let i = 0; i < BLOCK_SIZE; i++) {
+        if (lineNumbers[index] !== -1) {
+            outputHash();
+        }
+        updateHash(0);
+    }
+}
+exports.hash = hash;
+// Generate a hash callback function that updates the given result in-place
+// when it recieves a hash for the correct line number. Ignores hashes for other lines.
+function locationUpdateCallback(result, location) {
+    var _a, _b;
+    let locationStartLine = (_b = (_a = location.physicalLocation) === null || _a === void 0 ? void 0 : _a.region) === null || _b === void 0 ? void 0 : _b.startLine;
+    if (locationStartLine === undefined) {
+        // We expect the region section to be present, but it can be absent if the
+        // alert pertains to the entire file. In this case, we compute the fingerprint
+        // using the hash of the first line of the file.
+        locationStartLine = 1;
+    }
+    return function (lineNumber, hash) {
+        // Ignore hashes for lines that don't concern us
+        if (locationStartLine !== lineNumber) {
+            return;
+        }
+        if (!result.partialFingerprints) {
+            result.partialFingerprints = {};
+        }
+        const existingFingerprint = result.partialFingerprints.primaryLocationLineHash;
+        // If the hash doesn't match the existing fingerprint then
+        // output a warning and don't overwrite it.
+        if (!existingFingerprint) {
+            result.partialFingerprints.primaryLocationLineHash = hash;
+        }
+        else if (existingFingerprint !== hash) {
+            core.warning("Calculated fingerprint of " + hash +
+                " for file " + location.physicalLocation.artifactLocation.uri +
+                " line " + lineNumber +
+                ", but found existing inconsistent fingerprint value " + existingFingerprint);
+        }
+    };
+}
+// Can we fingerprint the given location. This requires access to
+// the source file so we can hash it.
+// If possible returns a absolute file path for the source file,
+// or if not possible then returns undefined.
+function resolveUriToFile(location, artifacts) {
+    // This may be referencing an artifact
+    if (!location.uri && location.index !== undefined) {
+        if (typeof location.index !== 'number' ||
+            location.index < 0 ||
+            location.index >= artifacts.length ||
+            typeof artifacts[location.index].location !== 'object') {
+            core.debug('Ignoring location as index "' + location.index + '" is invalid');
+            return undefined;
+        }
+        location = artifacts[location.index].location;
+    }
+    // Get the URI and decode
+    if (typeof location.uri !== 'string') {
+        core.debug('Ignoring location as uri "' + location.uri + '" is invalid');
+        return undefined;
+    }
+    let uri = decodeURIComponent(location.uri);
+    // Remove a file scheme, and abort if the scheme is anything else
+    const fileUriPrefix = 'file://';
+    if (uri.startsWith(fileUriPrefix)) {
+        uri = uri.substring(fileUriPrefix.length);
+    }
+    if (uri.indexOf('://') !== -1) {
+        core.debug('Ignoring location URI "' + uri + "' as the scheme is not recognised");
+        return undefined;
+    }
+    // Discard any absolute paths that aren't in the src root
+    const srcRootPrefix = process.env['GITHUB_WORKSPACE'] + '/';
+    if (uri.startsWith('/') && !uri.startsWith(srcRootPrefix)) {
+        core.debug('Ignoring location URI "' + uri + "' as it is outside of the src root");
+        return undefined;
+    }
+    // Just assume a relative path is relative to the src root.
+    // This is not necessarily true but should be a good approximation
+    // and here we likely want to err on the side of handling more cases.
+    if (!uri.startsWith('/')) {
+        uri = srcRootPrefix + uri;
+    }
+    // Check the file exists
+    if (!fs.existsSync(uri)) {
+        core.debug("Unable to compute fingerprint for non-existent file: " + uri);
+        return undefined;
+    }
+    return uri;
+}
+exports.resolveUriToFile = resolveUriToFile;
+// Compute fingerprints for results in the given sarif file
+// and return an updated sarif file contents.
+function addFingerprints(sarifContents) {
+    let sarif = JSON.parse(sarifContents);
+    // Gather together results for the same file and construct
+    // callbacks to accept hashes for that file and update the location
+    const callbacksByFile = {};
+    for (const run of sarif.runs || []) {
+        // We may need the list of artifacts to resolve against
+        let artifacts = run.artifacts || [];
+        for (const result of run.results || []) {
+            // Check the primary location is defined correctly and is in the src root
+            const primaryLocation = (result.locations || [])[0];
+            if (!primaryLocation ||
+                !primaryLocation.physicalLocation ||
+                !primaryLocation.physicalLocation.artifactLocation) {
+                core.debug("Unable to compute fingerprint for invalid location: " + JSON.stringify(primaryLocation));
+                continue;
+            }
+            const filepath = resolveUriToFile(primaryLocation.physicalLocation.artifactLocation, artifacts);
+            if (!filepath) {
+                continue;
+            }
+            if (!callbacksByFile[filepath]) {
+                callbacksByFile[filepath] = [];
+            }
+            callbacksByFile[filepath].push(locationUpdateCallback(result, primaryLocation));
+        }
+    }
+    // Now hash each file that was found
+    Object.entries(callbacksByFile).forEach(([filepath, callbacks]) => {
+        // A callback that forwards the hash to all other callbacks for that file
+        const teeCallback = function (lineNumber, hash) {
+            Object.values(callbacks).forEach(c => c(lineNumber, hash));
+        };
+        const fileContents = fs.readFileSync(filepath).toString();
+        hash(teeCallback, fileContents);
+    });
+    return JSON.stringify(sarif);
+}
+exports.addFingerprints = addFingerprints;

lib/init-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/init-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runInitAction)();

lib/init-post-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/init-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runInitPostAction)();

lib/resolve-environment-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/resolve-environment-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runResolveEnvironmentAction)();

lib/setup-codeql-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/setup-codeql-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runSetupCodeqlAction)();

lib/setup-tools.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const toolcache = __importStar(require("@actions/tool-cache"));
+const path = __importStar(require("path"));
+class CodeQLSetup {
+    constructor(codeqlDist) {
+        this.dist = codeqlDist;
+        this.tools = path.join(this.dist, 'tools');
+        this.cmd = path.join(codeqlDist, 'codeql');
+        // TODO check process.arch ?
+        if (process.platform === 'win32') {
+            this.platform = 'win64';
+            if (this.cmd.endsWith('codeql')) {
+                this.cmd += ".cmd";
+            }
+        }
+        else if (process.platform === 'linux') {
+            this.platform = 'linux64';
+        }
+        else if (process.platform === 'darwin') {
+            this.platform = 'osx64';
+        }
+        else {
+            throw new Error("Unsupported plaform: " + process.platform);
+        }
+    }
+}
+exports.CodeQLSetup = CodeQLSetup;
+async function setupCodeQL() {
+    const version = '1.0.0';
+    const codeqlURL = core.getInput('tools', { required: true });
+    let codeqlFolder = toolcache.find('CodeQL', version);
+    if (codeqlFolder) {
+        core.debug(`CodeQL found in cache ${codeqlFolder}`);
+    }
+    else {
+        const codeqlPath = await toolcache.downloadTool(codeqlURL);
+        const codeqlExtracted = await toolcache.extractTar(codeqlPath);
+        codeqlFolder = await toolcache.cacheDir(codeqlExtracted, 'CodeQL', version);
+    }
+    return new CodeQLSetup(path.join(codeqlFolder, 'codeql'));
+}
+exports.setupCodeQL = setupCodeQL;

lib/setup-tracer.js

@@ -0,0 +1,214 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const io = __importStar(require("@actions/io"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const configUtils = __importStar(require("./config-utils"));
+const setuptools = __importStar(require("./setup-tools"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util = __importStar(require("./util"));
+const CRITICAL_TRACER_VARS = new Set(['SEMMLE_PRELOAD_libtrace',
+    ,
+    'SEMMLE_RUNNER',
+    ,
+    'SEMMLE_COPY_EXECUTABLES_ROOT',
+    ,
+    'SEMMLE_DEPTRACE_SOCKET',
+    ,
+    'SEMMLE_JAVA_TOOL_OPTIONS'
+]);
+async function tracerConfig(codeql, database, compilerSpec) {
+    const compilerSpecArg = compilerSpec ? ["--compiler-spec=" + compilerSpec] : [];
+    let envFile = path.resolve(database, 'working', 'env.tmp');
+    await exec.exec(codeql.cmd, ['database', 'trace-command', database,
+        ...compilerSpecArg,
+        process.execPath, path.resolve(__dirname, 'tracer-env.js'), envFile]);
+    const env = JSON.parse(fs.readFileSync(envFile, 'utf-8'));
+    const config = env['ODASA_TRACER_CONFIGURATION'];
+    const info = { spec: config, env: {} };
+    // Extract critical tracer variables from the environment
+    for (let entry of Object.entries(env)) {
+        const key = entry[0];
+        const value = entry[1];
+        // skip ODASA_TRACER_CONFIGURATION as it is handled separately
+        if (key === 'ODASA_TRACER_CONFIGURATION') {
+            continue;
+        }
+        // skip undefined values
+        if (typeof value === 'undefined') {
+            continue;
+        }
+        // Keep variables that do not exist in current environment. In addition always keep
+        // critical and CODEQL_ variables
+        if (typeof process.env[key] === 'undefined' || CRITICAL_TRACER_VARS.has(key) || key.startsWith('CODEQL_')) {
+            info.env[key] = value;
+        }
+    }
+    return info;
+}
+function concatTracerConfigs(configs) {
+    // A tracer config is a map containing additional environment variables and a tracer 'spec' file.
+    // A tracer 'spec' file has the following format [log_file, number_of_blocks, blocks_text]
+    // Merge the environments
+    const env = {};
+    let copyExecutables = false;
+    let envSize = 0;
+    for (let v of Object.values(configs)) {
+        for (let e of Object.entries(v.env)) {
+            const name = e[0];
+            const value = e[1];
+            // skip SEMMLE_COPY_EXECUTABLES_ROOT as it is handled separately
+            if (name === 'SEMMLE_COPY_EXECUTABLES_ROOT') {
+                copyExecutables = true;
+            }
+            else if (name in env) {
+                if (env[name] !== value) {
+                    throw Error('Incompatible values in environment parameter ' +
+                        name + ': ' + env[name] + ' and ' + value);
+                }
+            }
+            else {
+                env[name] = value;
+                envSize += 1;
+            }
+        }
+    }
+    // Concatenate spec files into a new spec file
+    let languages = Object.keys(configs);
+    const cppIndex = languages.indexOf('cpp');
+    // Make sure cpp is the last language, if it's present since it must be concatenated last
+    if (cppIndex !== -1) {
+        let lastLang = languages[languages.length - 1];
+        languages[languages.length - 1] = languages[cppIndex];
+        languages[cppIndex] = lastLang;
+    }
+    let totalLines = [];
+    let totalCount = 0;
+    for (let lang of languages) {
+        const lines = fs.readFileSync(configs[lang].spec, 'utf8').split(/\r?\n/);
+        const count = parseInt(lines[1], 10);
+        totalCount += count;
+        totalLines.push(...lines.slice(2));
+    }
+    const newLogFilePath = path.resolve(util.workspaceFolder(), 'compound-build-tracer.log');
+    const spec = path.resolve(util.workspaceFolder(), 'compound-spec');
+    const tempFolder = path.resolve(util.workspaceFolder(), 'compound-temp');
+    const newSpecContent = [newLogFilePath, totalCount.toString(10), ...totalLines];
+    if (copyExecutables) {
+        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = tempFolder;
+        envSize += 1;
+    }
+    fs.writeFileSync(spec, newSpecContent.join('\n'));
+    // Prepare the content of the compound environment file
+    let buffer = Buffer.alloc(4);
+    buffer.writeInt32LE(envSize, 0);
+    for (let e of Object.entries(env)) {
+        const key = e[0];
+        const value = e[1];
+        const lineBuffer = new Buffer(key + '=' + value + '\0', 'utf8');
+        const sizeBuffer = Buffer.alloc(4);
+        sizeBuffer.writeInt32LE(lineBuffer.length, 0);
+        buffer = Buffer.concat([buffer, sizeBuffer, lineBuffer]);
+    }
+    // Write the compound environment
+    const envPath = spec + '.environment';
+    fs.writeFileSync(envPath, buffer);
+    return { env, spec };
+}
+async function run() {
+    try {
+        if (util.should_abort('init', false) || !await util.reportActionStarting('init')) {
+            return;
+        }
+        // The config file MUST be parsed in the init action
+        const config = await configUtils.loadConfig();
+        core.startGroup('Load language configuration');
+        const languages = await util.getLanguages();
+        // If the languages parameter was not given and no languages were
+        // detected then fail here as this is a workflow configuration error.
+        if (languages.length === 0) {
+            core.setFailed("Did not detect any languages to analyze. Please update input in workflow.");
+            return;
+        }
+        core.endGroup();
+        analysisPaths.includeAndExcludeAnalysisPaths(config, languages);
+        const sourceRoot = path.resolve();
+        core.startGroup('Setup CodeQL tools');
+        const codeqlSetup = await setuptools.setupCodeQL();
+        await exec.exec(codeqlSetup.cmd, ['version', '--format=json']);
+        core.endGroup();
+        // Forward Go flags
+        const goFlags = process.env['GOFLAGS'];
+        if (goFlags) {
+            core.exportVariable('GOFLAGS', goFlags);
+            core.warning("Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.");
+        }
+        // Setup CODEQL_RAM flag (todo improve this https://github.com/github/dsp-code-scanning/issues/935)
+        const codeqlRam = process.env['CODEQL_RAM'] || '6500';
+        core.exportVariable('CODEQL_RAM', codeqlRam);
+        const databaseFolder = path.resolve(util.workspaceFolder(), 'codeql_databases');
+        await io.mkdirP(databaseFolder);
+        let tracedLanguages = {};
+        let scannedLanguages = [];
+        // TODO: replace this code once CodeQL supports multi-language tracing
+        for (let language of languages) {
+            const languageDatabase = path.join(databaseFolder, language);
+            // Init language database
+            await exec.exec(codeqlSetup.cmd, ['database', 'init', languageDatabase, '--language=' + language, '--source-root=' + sourceRoot]);
+            // TODO: add better detection of 'traced languages' instead of using a hard coded list
+            if (['cpp', 'java', 'csharp'].includes(language)) {
+                const config = await tracerConfig(codeqlSetup, languageDatabase);
+                tracedLanguages[language] = config;
+            }
+            else {
+                scannedLanguages.push(language);
+            }
+        }
+        const tracedLanguageKeys = Object.keys(tracedLanguages);
+        if (tracedLanguageKeys.length > 0) {
+            const mainTracerConfig = concatTracerConfigs(tracedLanguages);
+            if (mainTracerConfig.spec) {
+                for (let entry of Object.entries(mainTracerConfig.env)) {
+                    core.exportVariable(entry[0], entry[1]);
+                }
+                core.exportVariable('ODASA_TRACER_CONFIGURATION', mainTracerConfig.spec);
+                if (process.platform === 'darwin') {
+                    core.exportVariable('DYLD_INSERT_LIBRARIES', path.join(codeqlSetup.tools, 'osx64', 'libtrace.dylib'));
+                }
+                else if (process.platform === 'win32') {
+                    await exec.exec('powershell', [path.resolve(__dirname, '..', 'src', 'inject-tracer.ps1'),
+                        path.resolve(codeqlSetup.tools, 'win64', 'tracer.exe')], { env: { 'ODASA_TRACER_CONFIGURATION': mainTracerConfig.spec } });
+                }
+                else {
+                    core.exportVariable('LD_PRELOAD', path.join(codeqlSetup.tools, 'linux64', '${LIB}trace.so'));
+                }
+            }
+        }
+        core.exportVariable(sharedEnv.CODEQL_ACTION_SCANNED_LANGUAGES, scannedLanguages.join(','));
+        core.exportVariable(sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES, tracedLanguageKeys.join(','));
+        // TODO: make this a "private" environment variable of the action
+        core.exportVariable(sharedEnv.CODEQL_ACTION_DATABASE_DIR, databaseFolder);
+        core.exportVariable(sharedEnv.CODEQL_ACTION_CMD, codeqlSetup.cmd);
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('init', error.message, error.stack);
+        return;
+    }
+    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
+    await util.reportActionSucceeded('init');
+}
+run().catch(e => {
+    core.setFailed("init action failed: " + e);
+    console.log(e);
+});

lib/shared-environment.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEQL_ACTION_CMD = 'CODEQL_ACTION_CMD';
+exports.CODEQL_ACTION_DATABASE_DIR = 'CODEQL_ACTION_DATABASE_DIR';
+exports.CODEQL_ACTION_LANGUAGES = 'CODEQL_ACTION_LANGUAGES';
+exports.ODASA_TRACER_CONFIGURATION = 'ODASA_TRACER_CONFIGURATION';
+exports.CODEQL_ACTION_SCANNED_LANGUAGES = 'CODEQL_ACTION_SCANNED_LANGUAGES';
+exports.CODEQL_ACTION_TRACED_LANGUAGES = 'CODEQL_ACTION_TRACED_LANGUAGES';
+// The time at which the first action (normally init) started executing.
+// If a workflow invokes a different action without first invoking the init
+// action (i.e. the upload action is being used by a third-party integrator)
+// then this variable will be assigned the start time of the action invoked
+// rather that the init action.
+exports.CODEQL_ACTION_STARTED_AT = 'CODEQL_ACTION_STARTED_AT';
+// Populated when the init action completes successfully
+exports.CODEQL_ACTION_INIT_COMPLETED = 'CODEQL_ACTION_INIT_COMPLETED';

lib/start-proxy-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runStartProxyAction)();

lib/start-proxy-post-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runStartProxyPostAction)();

lib/tracer-env.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const env = {};
+for (let entry of Object.entries(process.env)) {
+    const key = entry[0];
+    const value = entry[1];
+    if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
+        env[key] = value;
+    }
+}
+process.stdout.write(process.argv[2]);
+fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');

lib/upload-lib.js

@@ -1,5 +1,142 @@
-// Automatically generated from 'upload-lib-stub.js.tpl' for 'src/upload-lib.ts'.
-
 "use strict";
-
-module.exports = require("./entry-points").uploadLib;
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const http = __importStar(require("@actions/http-client"));
+const auth = __importStar(require("@actions/http-client/auth"));
+const io = __importStar(require("@actions/io"));
+const file_url_1 = __importDefault(require("file-url"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const zlib_1 = __importDefault(require("zlib"));
+const fingerprints = __importStar(require("./fingerprints"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util = __importStar(require("./util"));
+// Construct the location of the sentinel file for detecting multiple uploads.
+// The returned location should be writable.
+async function getSentinelFilePath() {
+    // Use the temp dir instead of placing next to the sarif file because of
+    // issues with docker actions. The directory containing the sarif file
+    // may not be writable by us.
+    const uploadsTmpDir = path.join(process.env['RUNNER_TEMP'] || '/tmp/codeql-action', 'uploads');
+    await io.mkdirP(uploadsTmpDir);
+    // Hash the absolute path so we'll behave correctly in the unlikely
+    // scenario a file is referenced twice with different paths.
+    return path.join(uploadsTmpDir, 'codeql-action-upload-sentinel');
+}
+// Takes a list of paths to sarif files and combines them together,
+// returning the contents of the combined sarif file.
+function combineSarifFiles(sarifFiles) {
+    let combinedSarif = {
+        version: null,
+        runs: []
+    };
+    for (let sarifFile of sarifFiles) {
+        let sarifObject = JSON.parse(fs.readFileSync(sarifFile, 'utf8'));
+        // Check SARIF version
+        if (combinedSarif.version === null) {
+            combinedSarif.version = sarifObject.version;
+        }
+        else if (combinedSarif.version !== sarifObject.version) {
+            throw "Different SARIF versions encountered: " + combinedSarif.version + " and " + sarifObject.version;
+        }
+        combinedSarif.runs.push(...sarifObject.runs);
+    }
+    return JSON.stringify(combinedSarif);
+}
+exports.combineSarifFiles = combineSarifFiles;
+// Uploads a single sarif file or a directory of sarif files
+// depending on what the path happens to refer to.
+async function upload(input) {
+    if (fs.lstatSync(input).isDirectory()) {
+        const sarifFiles = fs.readdirSync(input)
+            .filter(f => f.endsWith(".sarif"))
+            .map(f => path.resolve(input, f));
+        await uploadFiles(sarifFiles);
+    }
+    else {
+        await uploadFiles([input]);
+    }
+}
+exports.upload = upload;
+// Uploads the given set of sarif files.
+async function uploadFiles(sarifFiles) {
+    core.startGroup("Uploading results");
+    try {
+        // Check if an upload has happened before. If so then abort.
+        // This is intended to catch when the finish and upload-sarif actions
+        // are used together, and then the upload-sarif action is invoked twice.
+        const sentinelFile = await getSentinelFilePath();
+        if (fs.existsSync(sentinelFile)) {
+            core.info("Aborting as an upload has already happened from this job");
+            return;
+        }
+        const commitOid = util.getRequiredEnvParam('GITHUB_SHA');
+        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+        const ref = util.getRequiredEnvParam('GITHUB_REF'); // it's in the form "refs/heads/master"
+        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+        core.debug("Uploading sarif files: " + JSON.stringify(sarifFiles));
+        let sarifPayload = combineSarifFiles(sarifFiles);
+        sarifPayload = fingerprints.addFingerprints(sarifPayload);
+        const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString('base64');
+        let checkoutPath = core.getInput('checkout_path');
+        let checkoutURI = file_url_1.default(checkoutPath);
+        const workflowRunID = parseInt(workflowRunIDStr, 10);
+        if (Number.isNaN(workflowRunID)) {
+            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+            return;
+        }
+        let matrix = core.getInput('matrix');
+        if (matrix === "null" || matrix === "") {
+            matrix = undefined;
+        }
+        const toolNames = util.getToolNames(sarifPayload);
+        const payload = JSON.stringify({
+            "commit_oid": commitOid,
+            "ref": ref,
+            "analysis_name": analysisName,
+            "sarif": zipped_sarif,
+            "workflow_run_id": workflowRunID,
+            "checkout_uri": checkoutURI,
+            "environment": matrix,
+            "started_at": startedAt,
+            "tool_names": toolNames,
+        });
+        core.info('Uploading results');
+        const githubToken = core.getInput('token');
+        const ph = new auth.BearerCredentialHandler(githubToken);
+        const client = new http.HttpClient('Code Scanning : Upload SARIF', [ph]);
+        const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY'] + '/code-scanning/analysis';
+        const res = await client.put(url, payload);
+        const requestID = res.message.headers["x-github-request-id"];
+        core.debug('response status: ' + res.message.statusCode);
+        if (res.message.statusCode === 500) {
+            // If the upload fails with 500 then we assume it is a temporary problem
+            // with turbo-scan and not an error that the user has caused or can fix.
+            // We avoid marking the job as failed to avoid breaking CI workflows.
+            core.error('Upload failed (' + requestID + '): ' + await res.readBody());
+        }
+        else if (res.message.statusCode !== 202) {
+            core.setFailed('Upload failed (' + requestID + '): ' + await res.readBody());
+        }
+        else {
+            core.info("Successfully uploaded results");
+        }
+        // Mark that we have made an upload
+        fs.writeFileSync(sentinelFile, '');
+    }
+    catch (error) {
+        core.setFailed(error.message);
+    }
+    core.endGroup();
+}

lib/upload-sarif-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runUploadSarifAction)();

lib/upload-sarif-post-entry.js

@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runUploadSarifPostAction)();

lib/upload-sarif.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const upload_lib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+async function run() {
+    if (util.should_abort('upload-sarif', false) || !await util.reportActionStarting('upload-sarif')) {
+        return;
+    }
+    try {
+        await upload_lib.upload(core.getInput('sarif_file'));
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('upload-sarif', error.message, error.stack);
+        return;
+    }
+    await util.reportActionSucceeded('upload-sarif');
+}
+run().catch(e => {
+    core.setFailed("upload-sarif action failed: " + e);
+    console.log(e);
+});

lib/util.js

@@ -0,0 +1,282 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const http = __importStar(require("@actions/http-client"));
+const auth = __importStar(require("@actions/http-client/auth"));
+const octokit = __importStar(require("@octokit/rest"));
+const console_log_level_1 = __importDefault(require("console-log-level"));
+const path = __importStar(require("path"));
+const sharedEnv = __importStar(require("./shared-environment"));
+/**
+ * Should the current action be aborted?
+ *
+ * This method should be called at the start of all CodeQL actions and they
+ * should abort cleanly if this returns true without failing the action.
+ * This method will call `core.setFailed` if necessary.
+ */
+function should_abort(actionName, requireInitActionHasRun) {
+    // Check that required aspects of the environment are present
+    const ref = process.env['GITHUB_REF'];
+    if (ref === undefined) {
+        core.setFailed('GITHUB_REF must be set.');
+        return true;
+    }
+    // Should abort if called on a merge commit for a pull request.
+    if (ref.startsWith('refs/pull/')) {
+        core.warning('The CodeQL ' + actionName + ' action is intended for workflows triggered on `push` events, '
+            + 'but the current workflow is running on a pull request. Aborting.');
+        return true;
+    }
+    // If the init action is required, then check the it completed successfully.
+    if (requireInitActionHasRun && process.env[sharedEnv.CODEQL_ACTION_INIT_COMPLETED] === undefined) {
+        core.setFailed('The CodeQL ' + actionName + ' action cannot be used unless the CodeQL init action is run first. Aborting.');
+        return true;
+    }
+    return false;
+}
+exports.should_abort = should_abort;
+/**
+ * Resolve the path to the workspace folder.
+ */
+function workspaceFolder() {
+    let workspaceFolder = process.env['RUNNER_WORKSPACE'];
+    if (!workspaceFolder)
+        workspaceFolder = path.resolve('..');
+    return workspaceFolder;
+}
+exports.workspaceFolder = workspaceFolder;
+/**
+ * Get an environment parameter, but throw an error if it is not set.
+ */
+function getRequiredEnvParam(paramName) {
+    const value = process.env[paramName];
+    if (value === undefined) {
+        throw new Error(paramName + ' environment variable must be set');
+    }
+    core.debug(paramName + '=' + value);
+    return value;
+}
+exports.getRequiredEnvParam = getRequiredEnvParam;
+/**
+ * Gets the set of languages in the current repository
+ */
+async function getLanguagesInRepo() {
+    var _a;
+    // Translate between GitHub's API names for languages and ours
+    const codeqlLanguages = {
+        'C': 'cpp',
+        'C++': 'cpp',
+        'C#': 'csharp',
+        'Go': 'go',
+        'Java': 'java',
+        'JavaScript': 'javascript',
+        'TypeScript': 'javascript',
+        'Python': 'python',
+    };
+    let repo_nwo = (_a = process.env['GITHUB_REPOSITORY']) === null || _a === void 0 ? void 0 : _a.split("/");
+    if (repo_nwo) {
+        let owner = repo_nwo[0];
+        let repo = repo_nwo[1];
+        core.debug(`GitHub repo ${owner} ${repo}`);
+        let ok = new octokit.Octokit({
+            auth: core.getInput('token'),
+            userAgent: "CodeQL Action",
+            log: console_log_level_1.default({ level: "debug" })
+        });
+        const response = await ok.request("GET /repos/:owner/:repo/languages", ({
+            owner,
+            repo
+        }));
+        core.debug("Languages API response: " + JSON.stringify(response));
+        // The GitHub API is going to return languages in order of popularity,
+        // When we pick a language to autobuild we want to pick the most popular traced language
+        // Since sets in javascript maintain insertion order, using a set here and then splatting it
+        // into an array gives us an array of languages ordered by popularity
+        let languages = new Set();
+        for (let lang in response.data) {
+            if (lang in codeqlLanguages) {
+                languages.add(codeqlLanguages[lang]);
+            }
+        }
+        return [...languages];
+    }
+    else {
+        return [];
+    }
+}
+/**
+ * Get the languages to analyse.
+ *
+ * The result is obtained from the environment parameter CODEQL_ACTION_LANGUAGES
+ * if that has been set, otherwise it is obtained from the action input parameter
+ * 'languages' if that has been set, otherwise it is deduced as all languages in the
+ * repo that can be analysed.
+ *
+ * If the languages are obtained from either of the second choices, the
+ * CODEQL_ACTION_LANGUAGES environment variable will be exported with the
+ * deduced list.
+ */
+async function getLanguages() {
+    // Obtain from CODEQL_ACTION_LANGUAGES if set
+    const langsVar = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES];
+    if (langsVar) {
+        return langsVar.split(',')
+            .map(x => x.trim())
+            .filter(x => x.length > 0);
+    }
+    // Obtain from action input 'languages' if set
+    let languages = core.getInput('languages', { required: false })
+        .split(',')
+        .map(x => x.trim())
+        .filter(x => x.length > 0);
+    core.info("Languages from configuration: " + JSON.stringify(languages));
+    if (languages.length === 0) {
+        // Obtain languages as all languages in the repo that can be analysed
+        languages = await getLanguagesInRepo();
+        core.info("Automatically detected languages: " + JSON.stringify(languages));
+    }
+    core.exportVariable(sharedEnv.CODEQL_ACTION_LANGUAGES, languages.join(','));
+    return languages;
+}
+exports.getLanguages = getLanguages;
+/**
+ * Compose a StatusReport.
+ *
+ * @param actionName The name of the action, e.g. 'init', 'finish', 'upload-sarif'
+ * @param status The status. Must be 'success', 'failure', or 'starting'
+ * @param cause  Cause of failure (only supply if status is 'failure')
+ * @param exception Exception (only supply if status is 'failure')
+ */
+async function createStatusReport(actionName, status, cause, exception) {
+    const commitOid = process.env['GITHUB_SHA'] || '';
+    const workflowRunIDStr = process.env['GITHUB_RUN_ID'];
+    let workflowRunID = -1;
+    if (workflowRunIDStr) {
+        workflowRunID = parseInt(workflowRunIDStr, 10);
+    }
+    const workflowName = process.env['GITHUB_WORKFLOW'] || '';
+    const jobName = process.env['GITHUB_JOB'] || '';
+    const languages = (await getLanguages()).sort().join(',');
+    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT] || new Date().toISOString();
+    core.exportVariable(sharedEnv.CODEQL_ACTION_STARTED_AT, startedAt);
+    let statusReport = {
+        workflow_run_id: workflowRunID,
+        workflow_name: workflowName,
+        job_name: jobName,
+        languages: languages,
+        commit_oid: commitOid,
+        action_name: actionName,
+        action_oid: "unknown",
+        started_at: startedAt,
+        status: status
+    };
+    // Add optional parameters
+    if (cause) {
+        statusReport.cause = cause;
+    }
+    if (exception) {
+        statusReport.exception = exception;
+    }
+    if (status === 'success' || status === 'failure') {
+        statusReport.completed_at = new Date().toISOString();
+    }
+    let matrix = core.getInput('matrix');
+    if (matrix) {
+        statusReport.matrix_vars = matrix;
+    }
+    return statusReport;
+}
+/**
+ * Send a status report to the code_scanning/analysis/status endpoint.
+ *
+ * Returns the status code of the response to the status request, or
+ * undefined if the given statusReport is undefined or no response was
+ * received.
+ */
+async function sendStatusReport(statusReport) {
+    var _a;
+    const statusReportJSON = JSON.stringify(statusReport);
+    core.debug('Sending status report: ' + statusReportJSON);
+    const githubToken = core.getInput('token');
+    const ph = new auth.BearerCredentialHandler(githubToken);
+    const client = new http.HttpClient('Code Scanning : Status Report', [ph]);
+    const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY']
+        + '/code-scanning/analysis/status';
+    const res = await client.put(url, statusReportJSON);
+    return (_a = res.message) === null || _a === void 0 ? void 0 : _a.statusCode;
+}
+/**
+ * Send a status report that an action is starting.
+ *
+ * If the action is `init` then this also records the start time in the environment,
+ * and ensures that the analysed languages are also recorded in the envirenment.
+ *
+ * Returns true unless a problem occurred and the action should abort.
+ */
+async function reportActionStarting(action) {
+    const statusCode = await sendStatusReport(await createStatusReport(action, 'starting'));
+    // If the status report request fails with a 403 or a 404, then this is a deliberate
+    // message from the endpoint that the SARIF upload can be expected to fail too,
+    // so the action should fail to avoid wasting actions minutes.
+    //
+    // Other failure responses (or lack thereof) could be transitory and should not
+    // cause the action to fail.
+    if (statusCode === 403) {
+        core.setFailed('The repo on which this action is running is not opted-in to CodeQL code scanning.');
+        return false;
+    }
+    if (statusCode === 404) {
+        core.setFailed('Not authorized to used the CodeQL code scanning feature on this repo.');
+        return false;
+    }
+    return true;
+}
+exports.reportActionStarting = reportActionStarting;
+/**
+ * Report that an action has failed.
+ *
+ * Note that the started_at date is always that of the `init` action, since
+ * this is likely to give a more useful duration when inspecting events.
+ */
+async function reportActionFailed(action, cause, exception) {
+    await sendStatusReport(await createStatusReport(action, 'failure', cause, exception));
+}
+exports.reportActionFailed = reportActionFailed;
+/**
+ * Report that an action has succeeded.
+ *
+ * Note that the started_at date is always that of the `init` action, since
+ * this is likely to give a more useful duration when inspecting events.
+ */
+async function reportActionSucceeded(action) {
+    await sendStatusReport(await createStatusReport(action, 'success'));
+}
+exports.reportActionSucceeded = reportActionSucceeded;
+/**
+ * Get the array of all the tool names contained in the given sarif contents.
+ *
+ * Returns an array of unique string tool names.
+ */
+function getToolNames(sarifContents) {
+    const sarif = JSON.parse(sarifContents);
+    const toolNames = {};
+    for (const run of sarif.runs || []) {
+        const tool = run.tool || {};
+        const driver = tool.driver || {};
+        if (typeof driver.name === "string" && driver.name.length > 0) {
+            toolNames[driver.name] = true;
+        }
+    }
+    return Object.keys(toolNames);
+}
+exports.getToolNames = getToolNames;

node_modules/.bin/acorn

@@ -0,0 +1 @@
+../acorn/bin/acorn