Merge pull request #4133 from github/backport-v3.38.0-b96794f01

Merge releases/v4 into releases/v3
Rebuild
2026-10-15 15:22:05 +00:00 · 2026-09-09 15:51:52 +01:00 · 2026-09-09 14:37:28 +00:00 · 2026-09-09 14:37:15 +00:00 · 2026-09-09 14:37:15 +00:00 · 2026-09-09 14:37:15 +00:00
163 changed files with 15629 additions and 44168 deletions
--- a/.github/actions/check-sarif/action.yml
+++ b/.github/actions/check-sarif/action.yml
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node24
+  using: node20
  main: index.js
--- a/.github/actions/prepare-mergeback-branch/action.yml
+++ b/.github/actions/prepare-mergeback-branch/action.yml
@@ -92,7 +92,8 @@ runs:
          Please do the following:

          - [ ] Approve running the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".
+          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
+                selected rather than "Squash and merge" or "Rebase and merge".
        EOF
        )

--- a/.github/actions/verify-debug-artifact-scan-completed/action.yml
+++ b/.github/actions/verify-debug-artifact-scan-completed/action.yml
@@ -1,6 +1,6 @@
 name: Verify that the best-effort debug artifact scan completed
 description: Verifies that the best-effort debug artifact scan completed successfully during tests
 runs:
-  using: node24
+  using: node20
  main: index.js
  post: post.js
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -1,33 +1,14 @@
 # CodeQL Action - Copilot Instructions

-The CodeQL Action is used in GitHub Actions workflows to run CodeQL scans using the CodeQL CLI.
-
-## Overview
-
- The repository contains two TypeScript projects.
- The main TypeScript codebase is in the `src` directory, with accompanying unit tests in `.test.ts` files in the same directory.
- The main codebase is compiled to bundled JavaScript code, which is also contained in the repository in the `lib` directory.
- A secondary TypeScript codebase with scripts that are only used for development purposes or by CI is in the `pr-checks` directory. This codebase is not compiled to bundled JavaScript. It is executed directly with `tsx`, which handles compilation internally.
-
-## Review instructions
-
- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Word your comments constructively as suggestions for improvements. Do not word suggestions as commands.
- If you want to comment on a change that you believe will fail a CI check, do not present the CI failure you expect as a fact. Instead, write that you think a change "may" lead to a failure in CI. Suggest that, if such a failure manifests, the changes you are commenting on may be the place responsible for the failure and are worth looking at.
- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one.
- If a change is a net improvement, for example because it improves on an existing limitation of existing code, do not complain about pre-existing problems that remain. You may comment on them, but you should make it clear that the thing you are commenting on is not new by writing e.g. "Not new in this PR, but [..]" followed by your description of the issue and a suggestion that it could be improved at the same time with e.g. "Consider whether this is worth addressing as part of this PR as well."
-
 ## Generated code

-The main codebase of the CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from. The secondary TypeScript codebase has sources in the `pr-checks` directory, which are executed directly with `tsx` and not compiled to JavaScript in the `lib` folder.
+The CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from.

 GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that start with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.

 ## Release process

-Changes that are merged to the `main` branch are not used in production straight away. Instead, changes from `main` must first be released using the release process, which has to be manually triggered by a staff member. Therefore, it is possible for further changes to be made to the code after some changes have been merged to `main` but before they are released. Once the release process automation is started, a series of PRs are automatically generated:
-
 - A release-PR is a PR which matches all of the following patterns:
-
  - PR title starts with the exact prefix: `Merge main into releases/v`
    - Equivalent regex: `^Merge main into releases\/v`
  - AND head (source) branch matches the update-branch pattern:
@@ -36,5 +17,5 @@ Changes that are merged to the `main` branch are not used in production straight
    - Regex: `^releases\/v` (e.g. `releases/v3`)

 - Consider all files in release-PRs to have already been reviewed and do not review them, except for the following two files:
-  - `CHANGELOG.md`
-  - `package.json`
+    - `CHANGELOG.md`
+    - `package.json`
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,8 @@ updates:
      interval: weekly
    cooldown:
      default-days: 7
+      exclude:
+        - "@actions/*"
    labels:
      - Rebuild
    # Ignore incompatible dependency updates
@@ -31,6 +33,8 @@ updates:
      interval: weekly
    cooldown:
      default-days: 7
+      exclude:
+        - "actions/*"
    labels:
      - Rebuild
    groups:
--- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
+++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
@@ -63,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
--- a/.github/workflows/__build-mode-autobuild.yml
+++ b/.github/workflows/__build-mode-autobuild.yml
@@ -63,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
--- a/.github/workflows/__bundle-toolcache.yml
+++ b/.github/workflows/__bundle-toolcache.yml
@@ -80,8 +80,7 @@ jobs:
      - id: init
        uses: ./../action/init
        with:
-          # Request multiple languages so this check uses the combined bundle.
-          languages: javascript,python
+          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - uses: ./../action/analyze
        with:
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -51,8 +51,6 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__export-file-baseline-information.yml
+++ b/.github/workflows/__export-file-baseline-information.yml
@@ -124,5 +124,4 @@ jobs:
    env:
      CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
      CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
      CODEQL_ACTION_TEST_MODE: true
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -44,6 +44,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
@@ -54,8 +56,6 @@ jobs:
            version: stable-v2.23.9
          - os: ubuntu-latest
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -44,6 +44,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
@@ -54,8 +56,6 @@ jobs:
            version: stable-v2.23.9
          - os: ubuntu-latest
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -44,6 +44,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
@@ -54,8 +56,6 @@ jobs:
            version: stable-v2.23.9
          - os: ubuntu-latest
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -54,6 +54,10 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-15-xlarge
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: macos-15-xlarge
@@ -74,10 +78,6 @@ jobs:
            version: stable-v2.24.3
          - os: macos-latest-xlarge
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
-          - os: macos-latest-xlarge
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: macos-latest-xlarge
@@ -116,14 +116,13 @@ jobs:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
-      - name: Install Python 3.13.15 for older CLI versions
-        # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
-        # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
+      - name: Install Python 3.13 for older CLI versions
+        # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
        # See https://github.com/github/codeql-action/pull/3212
        if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
-          python-version: '3.13.15'
+          python-version: '3.13'

      - name: Use Xcode 16
        # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -84,8 +84,6 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -84,8 +84,6 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -84,8 +84,6 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -84,8 +84,6 @@ jobs:
        with:
          node-version: 20.x
          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
      - name: Install dependencies
        run: npm ci
      - name: Prepare test
--- a/.github/workflows/__per-language-bundle-validation.yml
+++ b/.github/workflows/__per-language-bundle-validation.yml
@@ -1,164 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Per-language bundles
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}
-jobs:
-  per-language-bundle-validation:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            os: ubuntu-latest
-            version: nightly-latest
-            expected-extractors: actions javascript
-          - language: cpp
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: manual
-            build-command: gcc -o main main.c
-          - language: csharp
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: none
-          - language: go
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: autobuild
-          - language: java
-            os: ubuntu-latest
-            version: nightly-latest
-            build-mode: none
-          - language: javascript
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: python
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: ruby
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: rust
-            os: ubuntu-latest
-            version: nightly-latest
-          - language: swift
-            os: macos-latest-xlarge
-            version: nightly-latest
-            build-mode: autobuild
-    name: Per-language bundles
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - uses: ./../action/init
-        id: init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix['build-mode'] }}
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - name: Check that the bundle contains only the expected extractors
-        env:
-          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-          LANGUAGE: ${{ matrix.language }}
-          EXPECTED_EXTRACTORS: ${{ matrix['expected-extractors'] || matrix.language }}
-        run: |
-          extractors="$("$CODEQL_PATH" resolve languages --format=json | jq -r 'keys[]')"
-          echo "Extractors in the bundle:"
-          echo "$extractors"
-          echo "Expected: $EXPECTED_EXTRACTORS"
-
-          for expected in $EXPECTED_EXTRACTORS; do
-            if ! echo "$extractors" | grep -qx "$expected"; then
-              echo "::error::The ${LANGUAGE} bundle does not contain the ${expected} extractor."
-              exit 1
-            fi
-          done
-
-          # If the bundle contained extractors beyond those the language needs, then it would not
-          # have been trimmed, and this job would be silently validating the combined bundle.
-          for other in actions cpp csharp go java javascript python ruby rust swift; do
-            if echo "$EXPECTED_EXTRACTORS" | grep -qw "$other"; then
-              continue
-            fi
-            if echo "$extractors" | grep -qx "$other"; then
-              echo "::error::The ${LANGUAGE} bundle also contains the ${other} extractor, so it is not trimmed."
-              exit 1
-            fi
-          done
-      - name: Check that the bundle was not added to the toolcache
-        env:
-          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-        run: |
-          # A bundle that is missing most of its extractors must never be left in the toolcache,
-          # where a later job analyzing a different language could pick it up. The runner image
-          # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-          # rather than whether the toolcache contains CodeQL at all.
-          echo "CodeQL is at $CODEQL_PATH"
-          if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
-            echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
-            exit 1
-          fi
-          if [[ "$CODEQL_PATH" != "$RUNNER_TEMP"/* ]]; then
-            echo "::error::Expected the per-language bundle to be extracted under $RUNNER_TEMP, but found it at $CODEQL_PATH."
-            exit 1
-          fi
-      - name: Build code
-        if: matrix['build-command']
-        run: ${{ matrix['build-command'] }}
-      - uses: ./../action/analyze
-        id: analysis
-        with:
-          upload-database: false
-      - name: Check that a database was created for the language
-        env:
-          DB_LOCATIONS: ${{ steps.analysis.outputs.db-locations }}
-          LANGUAGE: ${{ matrix.language }}
-        run: |
-          database="$(echo "$DB_LOCATIONS" | jq -r --arg lang "$LANGUAGE" '.[$lang] // empty')"
-          if [ -z "$database" ] || [ ! -d "$database" ]; then
-            echo "::error::No CodeQL database was created for ${LANGUAGE}."
-            echo "Databases: $DB_LOCATIONS"
-            exit 1
-          fi
-          echo "Created a ${LANGUAGE} database at ${database}."
-    env:
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
-      CODEQL_ACTION_TEST_MODE: true
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -54,7 +54,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
--- a/.github/workflows/__rust.yml
+++ b/.github/workflows/__rust.yml
@@ -35,7 +35,7 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
-            version: stable-v2.20.7
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.22.1
          - os: ubuntu-latest
--- a/.github/workflows/codescanning-config-cli.yml
+++ b/.github/workflows/codescanning-config-cli.yml
@@ -75,8 +75,7 @@ jobs:
      uses: ./../action/.github/actions/check-codescanning-config
      with:
        expected-config-file-contents: "{}"
-        # Request multiple languages so later checks can reuse the combined bundle.
-        languages: javascript,python
+        languages: javascript
        tools: ${{ steps.prepare-test.outputs.tools-url }}

    - name: Packs from input
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -30,7 +30,7 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
+        - stable-v2.20.3
        - default
        - linked
        - nightly-latest
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -29,7 +29,7 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
+        - stable-v2.20.3
        - default
        - linked
        - nightly-latest
@@ -85,7 +85,7 @@ jobs:
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      - name: Check expected artifacts exist
        run: |
-          VERSIONS="stable-v2.20.7 default linked nightly-latest"
+          VERSIONS="stable-v2.20.3 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            pushd "./my-debug-artifacts-${version//./}"
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -45,13 +45,7 @@ jobs:
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node-version }}
-          cache: "npm"
-
-      # Install a new enough version of `npm` to understand `min-release-age`
-      # that is still compatible with Node 20.
-      - name: Install newer npm
-        if: matrix.node-version == 20
-        run: npm install -g npm@11.19.1
+          cache: 'npm'

      - name: Install dependencies
        run: |
@@ -83,6 +77,33 @@ jobs:
          sarif_file: eslint.sarif
          category: eslint

+  changetool-tests:
+    name: changetool unit tests
+    permissions:
+      contents: read
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+
+    concurrency:
+      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+      group: pr-checks-changetool-tests-${{ github.ref }}-${{ github.event_name }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run changetool unit tests
+        run: npm --workspace changetool test
+
  # These checks do not need to be run as part of the same matrix that we use for the `unit-tests`
  # job.
  other-checks:
@@ -101,19 +122,11 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

-      - name: Check for incorrect addresses in package-lock.json
-        run: |
-          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
-              'package-lock.json'; then
-            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
-            exit 1
-          fi
-
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
-          cache: "npm"
+          cache: 'npm'

      - name: Install dependencies
        id: install-deps
@@ -128,10 +141,6 @@ jobs:
        working-directory: pr-checks
        run: npx tsx --test

-      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        run: npx tsx pr-checks/changenotes.ts validate
-
      - name: Verify all Actions use the same Node version
        id: head-version
        run: |
@@ -181,14 +190,14 @@ jobs:
          path: ${{ runner.temp }}/repo-size/
          if-no-files-found: error

-      - name: "Backport: Check out base ref"
+      - name: 'Backport: Check out base ref'
        id: checkout-base
        if: ${{ startsWith(github.head_ref, 'backport-') }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.base_ref }}

-      - name: "Backport: Verify Node versions unchanged"
+      - name: 'Backport: Verify Node versions unchanged'
        if: steps.checkout-base.outcome == 'success'
        env:
          HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -28,7 +28,7 @@ defaults:

 jobs:
  prepare:
-    name: "Release info"
+    name: "Prepare release"
    runs-on: ubuntu-latest
    if: github.repository == 'github/codeql-action'

--- a/.github/workflows/rebuild.yml
+++ b/.github/workflows/rebuild.yml
@@ -54,27 +54,32 @@ jobs:
        run: |
          git fetch origin "$BASE_BRANCH"

-          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
-          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
-          if git merge "origin/$BASE_BRANCH"; then
+          # Allow merge conflicts in `lib`, since rebuilding should resolve them.
+          git merge "origin/$BASE_BRANCH"
+          MERGE_RESULT=$?
+
+          if [ "$MERGE_RESULT" -eq 0 ]; then
            echo "Merge succeeded cleanly."
-          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
-            echo "Merge conflicts detected, continuing."
+          elif [ "$MERGE_RESULT" -eq 1 ]; then
+            echo "Merge conflicts detected (exit code $MERGE_RESULT), continuing."
+          else
+            echo "git merge failed with unexpected exit code $MERGE_RESULT."
+            exit 1
+          fi
+
+          if [ "$MERGE_RESULT" -ne 0 ]; then
            echo "merge-in-progress=true" >> $GITHUB_OUTPUT

-            # Check for merge conflicts outside of `lib`.
-            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
-            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
+            # Check for merge conflicts outside of `lib`. Disable git diff's trailing whitespace check
+            # since `node_modules/@types/semver/README.md` fails it.
+            if git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/'; then
              echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              echo "$CONFLICTS_OUTSIDE_LIB"
+              git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/' || true
              exit 1
            fi

            echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
              "these by rebuilding the Action."
-          else
-            echo "git merge failed for a reason other than merge conflicts."
-            exit 1
          fi

      - name: Compile TypeScript
--- a/.github/workflows/rollback-release.yml
+++ b/.github/workflows/rollback-release.yml
@@ -10,7 +10,8 @@ on:
        required: true
  # Only for dry-runs of changes to the workflow.
  push:
-    # Don't run dry-run on release branches, since that's unnecessary.
+    # Don't run dry-run on release branches, to avoid an issue where the
+    # "new" tag determined by the "Prepare release" job already exists.
    branches-ignore:
      - releases/v*
    paths:
@@ -23,7 +24,7 @@ defaults:

 jobs:
  prepare:
-    name: "Prepare"
+    name: "Prepare release"
    if: github.repository == 'github/codeql-action'

    permissions:
@@ -106,10 +107,8 @@ jobs:
          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
          # but use `v0.0.0` for testing.
          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          # Use `needs.prepare.outputs.version` for actual runs and `v0.0.1` for testing.
-          RELEASE_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.version, 'v0.0.1') }}
-          # Use `needs.prepare.outputs.major_version` for actual runs and `v0` for testing.
-          MAJOR_VERSION_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.major_version, 'v0') }}
+          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
+          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
        run: |
          git checkout "refs/tags/${ROLLBACK_TAG}"
          git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
@@ -185,3 +184,4 @@ jobs:
          # Setting this to `true` for non-workflow_dispatch events will
          # still push the `branch`, but won't create a corresponding PR
          dry-run: "${{ github.event_name != 'workflow_dispatch' }}"
+
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -16,15 +16,15 @@ defaults:
    shell: bash

 jobs:
+
  prepare:
-    name: "Prepare"
+    name: "Prepare release"
    permissions:
      contents: read

    uses: ./.github/workflows/prepare-release.yml

  update:
-    name: "Update release branch"
    timeout-minutes: 45
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch'
@@ -77,7 +77,6 @@ jobs:
          --conductor ${GITHUB_ACTOR}

  backport:
-    name: "Create backport"
    timeout-minutes: 45
    runs-on: ubuntu-latest
    environment: Automation
--- a/.npmrc
+++ b/.npmrc
@@ -1,2 +1 @@
 lockfile-version=3
-min-release-age=7
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -7,10 +7,6 @@
    // transpiled JavaScript
    "build": true,
    "lib": true,
-
-    // exclude "tests" by default because it causes VSCode to start language-specific extensions
-    // that are not typically needed during development (or indeed may not work correctly)
-    "tests": true
  },
  "search.exclude": {
    "**/node_modules": true,
@@ -22,7 +18,7 @@
  "git.ignoreLimitWarning": true,
  // Use the vendored TypeScript version to have a consistent development experience across
  // machines.
-  "js/ts.tsdk.path": "node_modules/typescript/lib",
+  "typescript.tsdk": "node_modules/typescript/lib",
  "[typescript]": {
    "editor.defaultFormatter": "esbenp.prettier-vscode"
  },
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,106 +2,88 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## [UNRELEASED]
-
- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)
-
-## 4.38.3 - 08 Oct 2026
-
- _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
- Update default CodeQL bundle version to [2.27.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2). [#4203](https://github.com/github/codeql-action/pull/4203)
- Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. [#4184](https://github.com/github/codeql-action/pull/4184)
-
-## 4.38.2 - 24 Sept 2026
-
- Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)
-
-## 4.38.1 - 18 Sept 2026
-
- The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://github.com/github/codeql-action/pull/4146)
-
-## 4.38.0 - 09 Sept 2026
+## 3.38.0 - 09 Sept 2026

 - On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. [#4124](https://github.com/github/codeql-action/pull/4124)
 - The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 - Update default CodeQL bundle version to [2.27.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0). [#4129](https://github.com/github/codeql-action/pull/4129)

-## 4.37.9 - 26 Aug 2026
+## 3.37.9 - 26 Aug 2026

 - Update default CodeQL bundle version to [2.26.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4). [#4106](https://github.com/github/codeql-action/pull/4106)

-## 4.37.8 - 21 Aug 2026
+## 3.37.8 - 21 Aug 2026

 No user facing changes.

-## 4.37.7 - 13 Aug 2026
+## 3.37.7 - 13 Aug 2026

 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085)

-## 4.37.6 - 04 Aug 2026
+## 3.37.6 - 04 Aug 2026

 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)

-## 4.37.5 - 03 Aug 2026
+## 3.37.5 - 03 Aug 2026

 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)

-## 4.37.4 - 29 Jul 2026
+## 3.37.4 - 29 Jul 2026

 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)
 - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051)

-## 4.37.3 - 22 Jul 2026
+## 3.37.3 - 22 Jul 2026

 No user facing changes.

-## 4.37.2 - 21 Jul 2026
+## 3.37.2 - 21 Jul 2026

 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
 - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007)

-## 4.37.1 - 16 Jul 2026
+## 3.37.1 - 16 Jul 2026

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956)
 - Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019)

-## 4.37.0 - 08 Jul 2026
+## 3.37.0 - 08 Jul 2026

 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995)
 - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973)

-## 4.36.3 - 01 Jul 2026
+## 3.36.3 - 01 Jul 2026

 No user facing changes.

-## 4.36.2 - 04 Jun 2026
+## 3.36.2 - 04 Jun 2026

 - Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943)
 - Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937)
 - Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948)

-## 4.36.1 - 02 Jun 2026
+## 3.36.1 - 02 Jun 2026

 No user facing changes.

-## 4.36.0 - 22 May 2026
+## 3.36.0 - 22 May 2026

 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
 - Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
 - Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926)

-## 4.35.5 - 15 May 2026
+## 3.35.5 - 15 May 2026

 - We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
 - For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
 - If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
 - Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)

-## 4.35.4 - 07 May 2026
+## 3.35.4 - 07 May 2026

 - Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)

-## 4.35.3 - 01 May 2026
+## 3.35.3 - 01 May 2026

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
 - Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
@@ -109,7 +91,7 @@ No user facing changes.
 - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
 - Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)

-## 4.35.2 - 15 Apr 2026
+## 3.35.2 - 15 Apr 2026

 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
 - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
@@ -117,26 +99,26 @@ No user facing changes.
 - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
 - Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)

-## 4.35.1 - 27 Mar 2026
+## 3.35.1 - 27 Mar 2026

 - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)

-## 4.35.0 - 27 Mar 2026
+## 3.35.0 - 27 Mar 2026

 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
 - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)

-## 4.34.1 - 20 Mar 2026
+## 3.34.1 - 20 Mar 2026

 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)

-## 4.34.0 - 20 Mar 2026
+## 3.34.0 - 20 Mar 2026

 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
 - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
 - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)

-## 4.33.0 - 16 Mar 2026
+## 3.33.0 - 16 Mar 2026

 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)

@@ -150,11 +132,11 @@ No user facing changes.
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
 - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

-## 4.32.6 - 05 Mar 2026
+## 3.32.6 - 05 Mar 2026

 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)

-## 4.32.5 - 02 Mar 2026
+## 3.32.5 - 02 Mar 2026

 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
 - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
@@ -164,7 +146,7 @@ No user facing changes.
 - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
 - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)

-## 4.32.4 - 20 Feb 2026
+## 3.32.4 - 20 Feb 2026

 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
 - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
@@ -172,89 +154,89 @@ No user facing changes.
 - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
 - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)

-## 4.32.3 - 13 Feb 2026
+## 3.32.3 - 13 Feb 2026

 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

-## 4.32.2 - 05 Feb 2026
+## 3.32.2 - 05 Feb 2026

 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)

-## 4.32.1 - 02 Feb 2026
+## 3.32.1 - 02 Feb 2026

 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
 - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)

-## 4.32.0 - 26 Jan 2026
+## 3.32.0 - 26 Jan 2026

 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425)

-## 4.31.11 - 23 Jan 2026
+## 3.31.11 - 23 Jan 2026

 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409)
 - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415)
 - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318)
 - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403)

-## 4.31.10 - 12 Jan 2026
+## 3.31.10 - 12 Jan 2026

 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393)

-## 4.31.9 - 16 Dec 2025
+## 3.31.9 - 16 Dec 2025

 No user facing changes.

-## 4.31.8 - 11 Dec 2025
+## 3.31.8 - 11 Dec 2025

 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354)

-## 4.31.7 - 05 Dec 2025
+## 3.31.7 - 05 Dec 2025

 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343)

-## 4.31.6 - 01 Dec 2025
+## 3.31.6 - 01 Dec 2025

 No user facing changes.

-## 4.31.5 - 24 Nov 2025
+## 3.31.5 - 24 Nov 2025

 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321)

-## 4.31.4 - 18 Nov 2025
+## 3.31.4 - 18 Nov 2025

 No user facing changes.

-## 4.31.3 - 13 Nov 2025
+## 3.31.3 - 13 Nov 2025

 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
 - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)

-## 4.31.2 - 30 Oct 2025
+## 3.31.2 - 30 Oct 2025

 No user facing changes.

-## 4.31.1 - 30 Oct 2025
+## 3.31.1 - 30 Oct 2025

 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

-## 4.31.0 - 24 Oct 2025
+## 3.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 4.30.9 - 17 Oct 2025
+## 3.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 4.30.8 - 10 Oct 2025
+## 3.30.8 - 10 Oct 2025

 No user facing changes.

-## 4.30.7 - 06 Oct 2025
+## 3.30.7 - 06 Oct 2025

- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)

+No user facing changes.
 ## 3.30.6 - 02 Oct 2025

 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -53,7 +53,6 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Write tests.
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
- For user-facing changes, add a change-note file. See [unreleased-change-notes/README.md](unreleased-change-notes/README.md).

 ## Releasing (write access required)

--- a/README.md
+++ b/README.md
@@ -72,11 +72,12 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n

 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.36.2` | `2.25.6` | Enterprise Server 3.22 | |
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
+| `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
+| `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |

 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).

--- a/analyze/action.yml
+++ b/analyze/action.yml
@@ -94,6 +94,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
+  using: node20
  main: "../lib/analyze-entry.js"
  post: "../lib/analyze-post-entry.js"
--- a/autobuild/action.yml
+++ b/autobuild/action.yml
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node24
+  using: node20
  main: '../lib/autobuild-entry.js'
--- a/ava.setup.mjs
+++ b/ava.setup.mjs
@@ -1,4 +1,3 @@
 import pkg from "./package.json" with { type: "json" };

 globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;
-globalThis.__CODEQL_ACTION_TEST_ENV__ = "unit-test";
--- a/build.mjs
+++ b/build.mjs
@@ -78,7 +78,7 @@ const UPLOAD_LIB_SRC = "./src/upload-lib";
 *
 * The virtual module additionally re-exports `upload-lib` under the `uploadLib` namespace so that
 * external consumers can access it via the small `lib/upload-lib.js` stub emitted below.
- *
+ * 
 * A tiny stub file is emitted for each Action entrypoint, and one for `upload-lib`. Each stub
 * imports the shared bundle and calls/re-exports from the respective entry point.
 *
@@ -212,7 +212,6 @@ const context = await esbuild.context({
  target: ["node20"],
  define: {
    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
-    __CODEQL_ACTION_TEST_ENV__: JSON.stringify(""),
  },
  metafile: true,
 });
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -140,17 +140,6 @@ export default [
      "no-async-foreach/no-async-foreach": "error",
      "no-sequences": "error",
      "no-shadow": "off",
-
-      // A basic check that we don't use `exportVariable` from `@actions/core`.
-      "no-restricted-syntax": [
-        "error",
-        {
-          selector: "MemberExpression[property.name='exportVariable']",
-          message:
-            "Use the `export` method of an `Env` instance or `exportEnvVar` from `environment.ts` instead.",
-        },
-      ],
-
      // This is overly restrictive with unsetting `EnvVar`s
      "@typescript-eslint/no-dynamic-delete": "off",
      "@typescript-eslint/no-shadow": "error",
@@ -168,15 +157,6 @@ export default [
      ],
    },
  },
-  {
-    files: ["src/environment.ts"],
-
-    // We allow `exportVariable` from `@actions/core` to be used in this file
-    // since it defines the wrapper around it that other modules use.
-    rules: {
-      "no-restricted-syntax": "off",
-    },
-  },
  {
    files: ["**/*.ts", "**/*.js"],

@@ -229,4 +209,18 @@ export default [
      ],
    },
  },
+  {
+    files: ["scripts/changetool/**/*.ts"],
+
+    languageOptions: {
+      parserOptions: {
+        project: "./scripts/changetool/tsconfig.json",
+      },
+    },
+
+    rules: {
+      "no-console": "off",
+      "import/extensions": "off",
+    },
+  },
 ];
--- a/init/action.yml
+++ b/init/action.yml
@@ -177,6 +177,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
+  using: node20
  main: '../lib/init-entry.js'
  post: '../lib/init-post-entry.js'
--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.2",
-  "cliVersion": "2.27.2",
-  "priorBundleVersion": "codeql-bundle-v2.27.1",
-  "priorCliVersion": "2.27.1"
+  "bundleVersion": "codeql-bundle-v2.27.0",
+  "cliVersion": "2.27.0",
+  "priorBundleVersion": "codeql-bundle-v2.26.4",
+  "priorCliVersion": "2.26.4"
 }
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.39.0",
+  "version": "3.38.0",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -17,12 +17,13 @@
  },
  "license": "MIT",
  "workspaces": [
-    "pr-checks"
+    "pr-checks",
+    "scripts/changetool"
  ],
  "dependencies": {
    "@actions/artifact": "^5.0.3",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^5.3.0",
+    "@actions/cache": "^5.2.0",
    "@actions/core": "^2.0.3",
    "@actions/exec": "^2.0.0",
    "@actions/github": "^8.0.1",
@@ -30,27 +31,28 @@
    "@actions/http-client": "^3.0.0",
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
-    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": "^16.0.0",
+    "@octokit/core": "^7.0.7",
+    "@octokit/plugin-paginate-rest": "^15.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
    "@octokit/plugin-retry": "^8.1.1",
    "archiver": "^8.0.0",
-    "follow-redirects": "^1.16.1",
+    "fast-deep-equal": "^3.1.3",
+    "follow-redirects": "^1.16.0",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.3",
+    "js-yaml": "^5.4.0",
    "jsonschema": "1.5.0",
    "long": "^5.3.2",
    "node-forge": "^1.4.0",
    "semver": "^7.8.5",
-    "undici": "^6.28.0",
-    "uuid": "^14.0.2"
+    "uuid": "^14.0.2",
+    "undici": "^6.28.0"
  },
  "devDependencies": {
    "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^2.1.1",
+    "@eslint/compat": "^2.1.0",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
-    "@octokit/types": "^18.0.0",
+    "@octokit/types": "^17.0.0",
    "@types/archiver": "^8.0.0",
    "@types/follow-redirects": "^1.14.4",
    "@types/js-yaml": "^4.0.9",
@@ -65,14 +67,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^64.2.1",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
-    "globals": "^17.13.0",
+    "globals": "^17.11.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.68.0"
  },
  "overrides": {
    "@actions/tool-cache": {
--- a/pr-checks/.nvmrc
+++ b/pr-checks/.nvmrc
@@ -1 +0,0 @@
-24
--- a/pr-checks/bundle-changelog.test.ts
+++ b/pr-checks/bundle-changelog.test.ts
@@ -112,7 +112,7 @@ ${NO_CHANGES_STR}`;
 describe("updateChangelog", async () => {
  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
    const result = updateChangelog(EMPTY_CHANGELOG, "");
-    assert.ok(!result.includes(NO_CHANGES_STR));
+    assert.ok(!result.includes(NO_CHANGES_STR.trim()));
  });

  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
@@ -120,7 +120,7 @@ describe("updateChangelog", async () => {
      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
      "",
    );
-    assert.ok(result.includes(NO_CHANGES_STR));
+    assert.ok(result.includes(NO_CHANGES_STR.trim()));
  });

  await it("throws if there are no sections", async () => {
--- a/pr-checks/bundle-changelog.ts
+++ b/pr-checks/bundle-changelog.ts
@@ -122,6 +122,6 @@ function main() {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  process.exit(main());
 }
--- a/pr-checks/bundle-metadata.ts
+++ b/pr-checks/bundle-metadata.ts
@@ -43,6 +43,6 @@ async function main() {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  void main();
 }
--- a/pr-checks/changelog.test.ts
+++ b/pr-checks/changelog.test.ts
@@ -9,46 +9,17 @@ import * as fs from "node:fs";
 import { describe, it } from "node:test";

 import {
-  addBodyLinesToUnreleasedSection,
-  ChangelogSection,
  EMPTY_CHANGELOG,
-  getHeader,
  getReleaseDateString,
-  NO_CHANGES_STR,
  parseChangelog,
  processChangelogForBackports,
  renderChangelog,
  setVersionAndDate,
-  UNRELEASED_PLACEHOLDER,
 } from "./changelog";
 import { CHANGELOG_FILE } from "./config";

 const testDate = new Date(2026, 7, 14);

-describe("getHeader", async () => {
-  function Section(headerLine: string): ChangelogSection {
-    return {
-      headerLine,
-      bodyLines: [],
-    };
-  }
-  await it("returns non-headers unchanged", () => {
-    assert.equal("foo", getHeader(Section("foo")));
-    assert.equal("- bar", getHeader(Section("- bar")));
-  });
-  await it("strips octothorpes", async () => {
-    assert.equal("foo", getHeader(Section("# foo")));
-    assert.equal("foo", getHeader(Section("## foo")));
-    assert.equal("foo", getHeader(Section("### foo")));
-    assert.equal("foo", getHeader(Section("#### foo")));
-    assert.equal("foo", getHeader(Section("##### foo")));
-    assert.equal("foo", getHeader(Section("###### foo")));
-  });
-  await it("strips whitespace", async () => {
-    assert.equal("foo", getHeader(Section("# foo  ")));
-  });
-});
-
 describe("getReleaseDateString", async () => {
  await it("formats dates as expected", async () => {
    assert.equal(getReleaseDateString(testDate), "14 Aug 2026");
@@ -99,73 +70,3 @@ describe("processChangelogForBackports", async () => {
    assert.deepEqual(result.split("\n"), testChangelogResult.split("\n"));
  });
 });
-
-describe("addBodyLinesToUnreleasedSection", async () => {
-  function newChangelogWithSections(sections: ChangelogSection[]) {
-    return {
-      preamble: [],
-      sections,
-    };
-  }
-
-  await it("throws error if '[UNRELEASED]' section is not first", async () => {
-    const invalidChangelog = newChangelogWithSections([
-      {
-        headerLine: "## Release 1.0.0",
-        bodyLines: [],
-      },
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: [],
-      },
-    ]);
-    assert.throws(() =>
-      addBodyLinesToUnreleasedSection(invalidChangelog, ["foo"]),
-    );
-  });
-
-  await it("overwrites 'No user facing changes.'", async () => {
-    const changelog = newChangelogWithSections([
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: ["", NO_CHANGES_STR, ""],
-      },
-    ]);
-
-    addBodyLinesToUnreleasedSection(changelog, ["- foo"]);
-
-    assert.equal(changelog.sections[0].bodyLines.length, 3);
-    assert.deepEqual(changelog.sections[0].bodyLines, ["", "- foo", ""]);
-  });
-
-  await it("does nothing if lines is empty", async () => {
-    const changelog = newChangelogWithSections([
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: ["", NO_CHANGES_STR, ""],
-      },
-    ]);
-    const changelogClone = structuredClone(changelog);
-
-    addBodyLinesToUnreleasedSection(changelog, []);
-
-    assert.deepEqual(changelog, changelogClone);
-  });
-
-  await it("inserts a line", async () => {
-    const changelog = newChangelogWithSections([
-      {
-        headerLine: `## ${UNRELEASED_PLACEHOLDER}`,
-        bodyLines: ["", "- Added a new dependency.", ""],
-      },
-    ]);
-    const lineToInsert = "- foo";
-
-    addBodyLinesToUnreleasedSection(changelog, [lineToInsert]);
-
-    assert.equal(changelog.sections[0].bodyLines.length, 4);
-    assert.ok(
-      changelog.sections[0].bodyLines.some((line) => line === lineToInsert),
-    );
-  });
-});
--- a/pr-checks/changelog.ts
+++ b/pr-checks/changelog.ts
@@ -6,16 +6,14 @@ import { CHANGELOG_FILE, DryRunOption } from "./config";
 export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]";

 /** The default contents for a section in the changelog. */
-export const NO_CHANGES_STR = "No user facing changes.";
+export const NO_CHANGES_STR = "No user facing changes.\n\n";

 /** Placeholder changelog content for a new release. */
 export const EMPTY_CHANGELOG = `# CodeQL Action Changelog

 ## ${UNRELEASED_PLACEHOLDER}

-${NO_CHANGES_STR}
-
-`;
+${NO_CHANGES_STR}`;

 /**
 * Represents sections in a changelog.
@@ -33,13 +31,6 @@ export interface Changelog {
  sections: ChangelogSection[];
 }

-/**
- * Returns the text of the header (without the '## ' prefix) of the given section.
- * */
-export function getHeader(section: ChangelogSection): string {
-  return section.headerLine.replace(/^#+\s+/, "").trimEnd();
-}
-
 /** Returns `date` formatted as `DD Mon YYYY`. */
 export function getReleaseDateString(today: Date = new Date()): string {
  return today.toLocaleDateString("en-GB", {
@@ -134,42 +125,6 @@ export function parseChangelog(content: string): Changelog {
  return { preamble, sections };
 }

-/**
- * Inserts the changenotes `lines` in the `[UNRELEASED]` section of `changelog`.
- * If the section contains the stock message {@link NO_CHANGES_STR}, then
- * `lines` will be inserted in place and the stock message will be deleted.
- *
- * @throws Error -- if the [UNRELEASED] section does not exist.
- *
- * @param changelog The CHANGELOG object to modify.
- * @param lines The changenotes to insert.
- */
-export function addBodyLinesToUnreleasedSection(
-  changelog: Changelog,
-  lines: string[],
-) {
-  // Do nothing if there is nothing to insert.
-  if (lines.length === 0) return;
-
-  const unreleasedSection = changelog.sections[0];
-  if (getHeader(unreleasedSection) !== UNRELEASED_PLACEHOLDER) {
-    throw Error(
-      `'${UNRELEASED_PLACEHOLDER}' is not the first section of 'CHANGELOG.md'`,
-    );
-  }
-
-  if (unreleasedSection.bodyLines.includes(NO_CHANGES_STR)) {
-    unreleasedSection.bodyLines = ["", ...lines, ""];
-    return;
-  }
-
-  // The last body line should be a blank line (for spacing).
-  // Remove it so that we can add `lines` and then add the blank line back.
-  unreleasedSection.bodyLines.pop();
-  unreleasedSection.bodyLines.push(...lines);
-  unreleasedSection.bodyLines.push("");
-}
-
 /**
 * Combines an array of lines into a single string by adding line breaks.
 */
@@ -249,7 +204,7 @@ export function processChangelogForBackports(

    // Add an entry if we didn't keep any.
    if (!foundContent) {
-      section.bodyLines.push(NO_CHANGES_STR);
+      section.bodyLines.push(NO_CHANGES_STR.trim());
    }
  }

--- a/pr-checks/changenotes.ts
+++ b/pr-checks/changenotes.ts
@@ -1,134 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs";
-import { pathToFileURL } from "node:url";
-import { parseArgs } from "node:util";
-import path from "path";
-
-import { ExitCode } from "@actions/core";
-import { matter } from "lite-matter";
-
-import {
-  addBodyLinesToUnreleasedSection,
-  parseChangelog,
-  renderChangelog,
-  withChangelog,
-} from "./changelog";
-import { isValidChangenoteFile } from "./changelog/validate";
-import { CHANGENOTES_DIR } from "./config";
-
-/**
- * Describes a changenote file, including its file path, frontmatter, and content.
- */
-interface ChangenoteFile {
-  absolutePath: string;
-  data: Record<string, any>;
-  content: string;
-}
-
-/**
- * Returns the absolute file paths of all files in
- * {@link CHANGENOTES_DIR} (except ".gitkeep" and "README.md").
- * */
-function listUnreleasedChangenoteDir(): string[] {
-  return fs
-    .readdirSync(CHANGENOTES_DIR)
-    .filter((name) => ![".gitkeep", "README.md"].includes(name))
-    .map((name) => path.join(CHANGENOTES_DIR, name));
-}
-
-/**
- * Scans the {@link CHANGENOTES_DIR} directory for changenote files
- * and returns a parsed listing of those changenote files.
- */
-function getChangenotes(): ChangenoteFile[] {
-  return listUnreleasedChangenoteDir().map((absolutePath) => {
-    return {
-      absolutePath,
-      ...matter(fs.readFileSync(absolutePath, "utf-8")),
-    };
-  });
-}
-
-const entryPoint = process.argv[1];
-if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) {
-  try {
-    process.exit(main());
-  } catch (error) {
-    console.error(error);
-    process.exit(ExitCode.Failure);
-  }
-}
-
-function main(): ExitCode {
-  const { positionals } = parseArgs({
-    allowPositionals: true,
-    strict: true,
-  });
-  const [command] = positionals;
-  switch (command) {
-    case undefined:
-    case "help":
-      return usage();
-    case "assemble":
-      return assemble();
-    case "validate":
-      return validate();
-    default:
-      console.error(`Unknown command: ${command}`);
-      return ExitCode.Failure;
-  }
-}
-
-function usage(): ExitCode {
-  const message =
-    "Usage: changenotes.ts assemble\n" +
-    "       changenotes.ts validate\n" +
-    "       changenotes.ts help";
-  console.log(message);
-  return ExitCode.Success;
-}
-
-function assemble(): ExitCode {
-  try {
-    const changenotes = getChangenotes();
-    const changenoteBodies = changenotes.map((c) => c.content);
-    const changenotePaths = changenotes.map((c) => c.absolutePath);
-
-    withChangelog((contents) => {
-      const changelog = parseChangelog(contents);
-      addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
-      return renderChangelog(changelog);
-    }, {});
-
-    // Delete changenotes only after successful processing.
-    for (const p of changenotePaths) {
-      fs.unlinkSync(p);
-    }
-
-    return ExitCode.Success;
-  } catch (e) {
-    console.error("Failed to assemble changenotes to 'CHANGELOG.md'", e);
-  }
-
-  return ExitCode.Failure;
-}
-
-function validate(): ExitCode {
-  try {
-    const allChangenotesValid = getChangenotes().reduce(
-      (r, changenote) => r && isValidChangenoteFile(changenote.absolutePath),
-      true,
-    );
-    if (allChangenotesValid) {
-      console.log(`All changenotes in '${CHANGENOTES_DIR}' are valid.`);
-      return ExitCode.Success;
-    }
-  } catch (error) {
-    console.error(
-      `Failed to read changenotes directory '${CHANGENOTES_DIR}'`,
-      error,
-    );
-  }
-  return ExitCode.Failure;
-}
--- a/pr-checks/check-repo-size.ts
+++ b/pr-checks/check-repo-size.ts
@@ -218,6 +218,6 @@ async function run(): Promise<void> {
  }
 }

-if (import.meta.main) {
+if (require.main === module) {
  void run();
 }
--- a/pr-checks/checks/bundle-toolcache.yml
+++ b/pr-checks/checks/bundle-toolcache.yml
@@ -30,8 +30,7 @@ steps:
  - id: init
    uses: ./../action/init
    with:
-      # Request multiple languages so this check uses the combined bundle.
-      languages: javascript,python
+      languages: javascript
      tools: ${{ steps.prepare-test.outputs.tools-url }}
  - uses: ./../action/analyze
    with:
--- a/pr-checks/checks/export-file-baseline-information.yml
+++ b/pr-checks/checks/export-file-baseline-information.yml
@@ -11,10 +11,6 @@ installDotNet: true
 env:
  CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
  CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-  # To balance speed and coverage, we analyze only a single language (JavaScript), but use the
-  # combined bundle so we can test that baseline information is reported for each language in the
-  # multi-language source directory.
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
 steps:
  - uses: ./../action/init
    id: init
--- a/pr-checks/checks/multi-language-autodetect.yml
+++ b/pr-checks/checks/multi-language-autodetect.yml
@@ -10,6 +10,7 @@ operatingSystems:
  - os: macos
    runner-image: macos-15-xlarge
    codeql-versions:
+      - stable-v2.19.4
      - stable-v2.20.7
      - stable-v2.21.4
      - stable-v2.22.4
@@ -19,14 +20,13 @@ env:
 installGo: true
 installDotNet: true
 steps:
-  - name: Install Python 3.13.15 for older CLI versions
-    # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
-    # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
+  - name: Install Python 3.13 for older CLI versions
+    # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
    # See https://github.com/github/codeql-action/pull/3212
    if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
    uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
    with:
-      python-version: "3.13.15"
+      python-version: "3.13"

  - name: Use Xcode 16
    # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
--- a/pr-checks/checks/per-language-bundle-validation.yml
+++ b/pr-checks/checks/per-language-bundle-validation.yml
@@ -1,117 +0,0 @@
-name: Per-language bundles
-description: Validates extraction and analysis using each per-language CodeQL bundle.
-# TODO: Use a released bundle once releases include per-language bundles.
-matrix:
-  include:
-    - language: actions
-      os: ubuntu-latest
-      version: nightly-latest
-      # Actions also needs the JavaScript extractor.
-      expected-extractors: actions javascript
-    - language: cpp
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: manual
-      build-command: gcc -o main main.c
-    - language: csharp
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: none
-    - language: go
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: autobuild
-    - language: java
-      os: ubuntu-latest
-      version: nightly-latest
-      build-mode: none
-    - language: javascript
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: python
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: ruby
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: rust
-      os: ubuntu-latest
-      version: nightly-latest
-    - language: swift
-      os: macos-latest-xlarge
-      version: nightly-latest
-      build-mode: autobuild
-env:
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
-steps:
-  - uses: ./../action/init
-    id: init
-    with:
-      languages: ${{ matrix.language }}
-      build-mode: ${{ matrix['build-mode'] }}
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - name: Check that the bundle contains only the expected extractors
-    env:
-      CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-      LANGUAGE: ${{ matrix.language }}
-      EXPECTED_EXTRACTORS: ${{ matrix['expected-extractors'] || matrix.language }}
-    run: |
-      extractors="$("$CODEQL_PATH" resolve languages --format=json | jq -r 'keys[]')"
-      echo "Extractors in the bundle:"
-      echo "$extractors"
-      echo "Expected: $EXPECTED_EXTRACTORS"
-
-      for expected in $EXPECTED_EXTRACTORS; do
-        if ! echo "$extractors" | grep -qx "$expected"; then
-          echo "::error::The ${LANGUAGE} bundle does not contain the ${expected} extractor."
-          exit 1
-        fi
-      done
-
-      # If the bundle contained extractors beyond those the language needs, then it would not
-      # have been trimmed, and this job would be silently validating the combined bundle.
-      for other in actions cpp csharp go java javascript python ruby rust swift; do
-        if echo "$EXPECTED_EXTRACTORS" | grep -qw "$other"; then
-          continue
-        fi
-        if echo "$extractors" | grep -qx "$other"; then
-          echo "::error::The ${LANGUAGE} bundle also contains the ${other} extractor, so it is not trimmed."
-          exit 1
-        fi
-      done
-  - name: Check that the bundle was not added to the toolcache
-    env:
-      CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
-    run: |
-      # A bundle that is missing most of its extractors must never be left in the toolcache,
-      # where a later job analyzing a different language could pick it up. The runner image
-      # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-      # rather than whether the toolcache contains CodeQL at all.
-      echo "CodeQL is at $CODEQL_PATH"
-      if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
-        echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
-        exit 1
-      fi
-      if [[ "$CODEQL_PATH" != "$RUNNER_TEMP"/* ]]; then
-        echo "::error::Expected the per-language bundle to be extracted under $RUNNER_TEMP, but found it at $CODEQL_PATH."
-        exit 1
-      fi
-  - name: Build code
-    if: matrix['build-command']
-    run: ${{ matrix['build-command'] }}
-  - uses: ./../action/analyze
-    id: analysis
-    with:
-      upload-database: false
-  - name: Check that a database was created for the language
-    env:
-      DB_LOCATIONS: ${{ steps.analysis.outputs.db-locations }}
-      LANGUAGE: ${{ matrix.language }}
-    run: |
-      database="$(echo "$DB_LOCATIONS" | jq -r --arg lang "$LANGUAGE" '.[$lang] // empty')"
-      if [ -z "$database" ] || [ ! -d "$database" ]; then
-        echo "::error::No CodeQL database was created for ${LANGUAGE}."
-        echo "Databases: $DB_LOCATIONS"
-        exit 1
-      fi
-      echo "Created a ${LANGUAGE} database at ${database}."
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+    uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
--- a/pr-checks/checks/rust.yml
+++ b/pr-checks/checks/rust.yml
@@ -1,8 +1,8 @@
 name: "Rust analysis"
 description: "Tests creation of a Rust database"
 versions:
-  # oldest CodeQL version supported by the Action, where Rust support is experimental and requires the Action to set `CODEQL_ENABLE_EXPERIMENTAL_FEATURES`
-  - stable-v2.20.7
+  # experimental rust support introduced, requires action to set `CODEQL_ENABLE_EXPERIMENTAL_FEATURES`
+  - stable-v2.19.4
  # first public preview version
  - stable-v2.22.1
  - linked
--- a/pr-checks/config.ts
+++ b/pr-checks/config.ts
@@ -1,9 +1,4 @@
 import path from "path";
-import { fileURLToPath } from "url";
-
-// For backwards-compatibility.
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);

 /** The oldest supported major version of the CodeQL Action. */
 export const OLDEST_SUPPORTED_MAJOR_VERSION = 3;
@@ -23,9 +18,6 @@ export const PACKAGE_JSON = path.join(REPO_ROOT, "package.json");
 /** The path of the changelog. */
 export const CHANGELOG_FILE = path.join(REPO_ROOT, "CHANGELOG.md");

-/** The path to the unreleased change-notes directory. */
-export const CHANGENOTES_DIR = path.join(REPO_ROOT, "unreleased-change-notes");
-
 /** The path to the esbuild metadata file. */
 export const BUNDLE_METADATA_FILE = path.join(REPO_ROOT, "meta.json");

--- a/pr-checks/excluded.yml
+++ b/pr-checks/excluded.yml
@@ -5,8 +5,6 @@ contains:
  - "test-setup-python-scripts"
  - "update"
  - "Update"
-  # Matrix-ed job; the name starts with this
-  - "Create backport"
 is:
  - "Agent"
  - "check-expected-release-files"
@@ -17,6 +15,4 @@ is:
  - "Label PR with size"
  - "Post repo size comment"
  - "Prepare"
-  - "Release info"
  - "Upload results"
-  - "Update release branch"
--- a/pr-checks/package.json
+++ b/pr-checks/package.json
@@ -1,20 +1,17 @@
 {
  "private": true,
-  "description": "Dependencies for codeql-action scripts",
-  "type": "module",
+  "description": "Dependencies for the sync.ts",
  "dependencies": {
    "@actions/core": "^2.0.3",
    "@actions/github": "^8.0.1",
-    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": ">=16.0.0",
+    "@octokit/core": "^7.0.7",
+    "@octokit/plugin-paginate-rest": ">=15.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-    "lite-matter": "^0.1.2",
-    "mdast-util-from-markdown": "^2.1.0",
    "semver": "^7.8.5",
-    "yaml": "^2.9.1"
+    "yaml": "^2.9.0"
  },
  "devDependencies": {
-    "@types/node": "^24.19.0",
-    "tsx": "^4.23.15"
+    "@types/node": "^20.19.43",
+    "tsx": "^4.23.12"
  }
 }
--- a/pr-checks/prepare-changelog.ts
+++ b/pr-checks/prepare-changelog.ts
@@ -77,6 +77,6 @@ function main() {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  process.exit(main());
 }
--- a/pr-checks/release-branches.ts
+++ b/pr-checks/release-branches.ts
@@ -116,6 +116,6 @@ async function main() {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  void main();
 }
--- a/pr-checks/rollback-changelog.ts
+++ b/pr-checks/rollback-changelog.ts
@@ -79,6 +79,6 @@ function main() {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  process.exit(main());
 }
--- a/pr-checks/sync-back.ts
+++ b/pr-checks/sync-back.ts
@@ -21,11 +21,10 @@ import * as fs from "fs";
 import { parseArgs } from "node:util";
 import * as path from "path";

-import { PR_CHECKS_DIR, REPO_ROOT } from "./config";
-
-const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
-const WORKFLOW_DIR = path.join(REPO_ROOT, ".github", "workflows");
-const SYNC_TS_PATH = path.join(PR_CHECKS_DIR, "sync.ts");
+const THIS_DIR = __dirname;
+const CHECKS_DIR = path.join(THIS_DIR, "checks");
+const WORKFLOW_DIR = path.join(THIS_DIR, "..", ".github", "workflows");
+const SYNC_TS_PATH = path.join(THIS_DIR, "sync.ts");

 /**
 * Scan generated workflow files to extract the latest action versions.
@@ -233,6 +232,6 @@ function main(): number {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  process.exit(main());
 }
--- a/pr-checks/sync-checks.ts
+++ b/pr-checks/sync-checks.ts
@@ -342,6 +342,6 @@ async function main(): Promise<void> {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  void main();
 }
--- a/pr-checks/sync.sh
+++ b/pr-checks/sync.sh
@@ -4,19 +4,12 @@ set -e
 cd "$(dirname "$0")"

 # Run `npm ci` in CI or `npm install` otherwise.
-#
-# `pr-checks` is an npm workspace of the repository root and the two share a single hoisted
-# `node_modules` directory. Running npm from this directory puts it in workspace mode, where it
-# ignores the root project's own dependencies by default. `npm ci` would then rebuild the shared
-# `node_modules` with only this workspace's dependencies, removing the root's ones, which breaks
-# anything that imports from `src` (such as `sync.ts` itself). `--include-workspace-root` keeps the
-# root project's dependencies in the installed tree.
 if [ "$GITHUB_ACTIONS" = "true" ]; then
  echo "In Actions, running 'npm ci' for 'sync.ts'..."
-  npm ci --include-workspace-root
+  npm ci
 else
  echo "Running 'npm install' for 'sync.ts'..."
-  npm install --no-audit --no-fund --include-workspace-root
+  npm install --no-audit --no-fund
 fi

 npx tsx sync.ts
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -7,8 +7,6 @@ import * as yaml from "yaml";

 import { BuiltInLanguage } from "../src/languages";

-import { PR_CHECKS_DIR, REPO_ROOT } from "./config";
-
 /**
 * Returns a `uses` value for `action` pinned to a commit SHA, with the
 * human-readable version recorded in a trailing comment.
@@ -81,8 +79,6 @@ interface Specification extends JobSpecification {
  useAllPlatformBundle?: string;
  /** Values for the `analysis-kinds` matrix dimension. */
  analysisKinds?: string[];
-  /** Overrides the generated job matrix using GitHub Actions matrix syntax. */
-  matrix?: Record<string, unknown>;

  /** Container image configuration for the job. */
  container?: any;
@@ -136,6 +132,8 @@ type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
  // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
+  "stable-v2.19.4",
+  // The last CodeQL release in the 2.20 series.
  "stable-v2.20.7",
  // The last CodeQL release in the 2.21 series.
  "stable-v2.21.4",
@@ -145,8 +143,6 @@ const defaultTestVersions = [
  "stable-v2.23.9",
  // The last CodeQL release in the 2.24 series.
  "stable-v2.24.3",
-  // The last CodeQL release in the 2.25 series.
-  "stable-v2.25.6",
  // The default version of CodeQL for Dotcom, as determined by feature flags.
  "default",
  // The version of CodeQL shipped with the Action in `defaults.json`. During the release process
@@ -223,12 +219,6 @@ const languageSetups: LanguageSetups = {
          cache: "npm",
        },
      },
-      // Install a new enough version of `npm` to understand `min-release-age`
-      // that is still compatible with Node 20.
-      {
-        name: "Install newer npm",
-        run: "npm install -g npm@11.19.1",
-      },
      {
        name: "Install dependencies",
        run: "npm ci",
@@ -263,8 +253,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Java",
        uses: pinnedUses(
          "actions/setup-java",
-          "de7274f081f381c8f8158605e0321c36c376e2e6",
-          "v6.0.1",
+          "dd06d9cba3e5552c54d9f8ea23572deb30010f7c",
+          "v6.0.0",
        ),
        with: {
          "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -314,8 +304,9 @@ const languageSetups: LanguageSetups = {
 // See https://github.com/github/codeql-action/pull/3423
 const YQ_VERSION = "v4.50.1";

-const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
-const OUTPUT_DIR = path.join(REPO_ROOT, ".github", "workflows");
+const THIS_DIR = __dirname;
+const CHECKS_DIR = path.join(THIS_DIR, "checks");
+const OUTPUT_DIR = path.join(THIS_DIR, "..", ".github", "workflows");

 /**
 * Loads and parses a YAML file.
@@ -521,6 +512,9 @@ function generateJob(
  specDocument: yaml.Document,
  checkSpecification: Specification,
 ) {
+  const matrix: Array<Record<string, any>> =
+    generateJobMatrix(checkSpecification);
+
  const useAllPlatformBundle = checkSpecification.useAllPlatformBundle
    ? checkSpecification.useAllPlatformBundle
    : "false";
@@ -573,8 +567,8 @@ function generateJob(
  const checkJob: Record<string, any> = {
    strategy: {
      "fail-fast": false,
-      matrix: checkSpecification.matrix ?? {
-        include: generateJobMatrix(checkSpecification),
+      matrix: {
+        include: matrix,
      },
    },
    name: checkSpecification.name,
--- a/pr-checks/tsconfig.json
+++ b/pr-checks/tsconfig.json
@@ -6,8 +6,8 @@
    "module": "preserve",
    "rootDir": "..",
    "sourceMap": false,
-    "noEmit": true
+    "noEmit": true,
  },
-  "include": ["./**/*.ts", "../src/**/*.ts"],
+  "include": ["./*.ts", "../src/**/*.ts"],
  "exclude": ["node_modules"]
 }
--- a/pr-checks/update-ghes-versions.ts
+++ b/pr-checks/update-ghes-versions.ts
@@ -238,6 +238,6 @@ function main() {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  main();
 }
--- a/pr-checks/update-release-branch.ts
+++ b/pr-checks/update-release-branch.ts
@@ -835,6 +835,6 @@ async function main(): Promise<void> {
 }

 // Only call `main` if this script was run directly.
-if (import.meta.main) {
+if (require.main === module) {
  void main();
 }
--- a/queries/default-setup-environment-variables.ql
+++ b/queries/default-setup-environment-variables.ql
@@ -23,8 +23,7 @@ predicate isSafeForDefaultSetup(string envVar) {
      "GITHUB_BASE_REF", "GITHUB_EVENT_NAME", "GITHUB_JOB", "GITHUB_RUN_ATTEMPT", "GITHUB_RUN_ID",
      "GITHUB_SHA", "GITHUB_REPOSITORY", "GITHUB_SERVER_URL", "GITHUB_TOKEN", "GITHUB_WORKFLOW",
      "GITHUB_WORKSPACE", "GOFLAGS", "ImageVersion", "JAVA_TOOL_OPTIONS", "RUNNER_ARCH",
-      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE",
-      "NODE_ENV"
+      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE"
    ]
 }

--- a/resolve-environment/action.yml
+++ b/resolve-environment/action.yml
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node24
+  using: node20
  main: '../lib/resolve-environment-entry.js'
--- a/scripts/changetool/cli/validate.test.ts
+++ b/scripts/changetool/cli/validate.test.ts
@@ -1,18 +1,36 @@
 import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
 import { describe, it } from "node:test";

-import { withTmpFile } from "../../src/util";
-
 import {
-  hasValidChangenoteCategory,
  isValidChangenoteContent,
  isValidChangenoteFile,
  isValidChangenoteFilename,
+  hasValidChangenoteCategory,
  VALID_CHANGE_NOTE_CATEGORIES,
-} from "./validate";
+} from "./validate.ts";
+
+async function withTmpFile<T>(
+  baseFileName: string,
+  contents: string,
+  body: (filePath: string) => Promise<T>,
+): Promise<T> {
+  const tmpDir = fs.mkdtempSync(
+    path.join(os.tmpdir(), "changetool-validate-test-"),
+  );
+  try {
+    const filePath = path.join(tmpDir, baseFileName);
+    fs.writeFileSync(filePath, contents);
+    return await body(filePath);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}

 await describe("isValidChangenoteContent", async () => {
-  await it("recognizes an unordered Markdown list", () => {
+  await it("recognizes an unordered Markdown list", async () => {
    const inputs = [
      "- One changenote entry",
      "- First item\n- Second item",
@@ -24,7 +42,7 @@ await describe("isValidChangenoteContent", async () => {
    }
  });

-  await it("does not recognize non-Markdown text", () => {
+  await it("does not recognize non-Markdown text", async () => {
    const inputs = [
      "This is not a list.",
      '["this", "is", "JSON"]',
@@ -39,7 +57,7 @@ await describe("isValidChangenoteContent", async () => {
    }
  });

-  await it("does not recognize ordered Markdown lists", () => {
+  await it("does not recognize ordered Markdown lists", async () => {
    const inputs = [
      "1. First item\n2. Second item",
      "\n\n\n1. First item\n1. Second item",
@@ -50,7 +68,7 @@ await describe("isValidChangenoteContent", async () => {
    }
  });

-  await it("requires all list items to use a hyphen bullet", () => {
+  await it("requires all list items to use a hyphen bullet", async () => {
    const inputs = [
      "* Fixed a bug\n* Added feature",
      "+ Fixed a bug\n+ Added feature",
@@ -67,7 +85,7 @@ await describe("isValidChangenoteContent", async () => {
    }
  });

-  await it("does not contain other Markdown elements", () => {
+  await it("does not contain other Markdown elements", async () => {
    const inputs = [
      "- Fixed a bug\n\nParagraph of text",
      "- Fixed a bug\n\n* Added a feature",
@@ -82,7 +100,7 @@ await describe("isValidChangenoteContent", async () => {
 });

 await describe("isValidChangenoteFilename", async () => {
-  await it("accepts valid filenames", () => {
+  await it("accepts valid filenames", async () => {
    const inputs = [
      "2023-01-01-fix-bug.md",
      "2023-12-31-add-feature.md",
@@ -94,7 +112,7 @@ await describe("isValidChangenoteFilename", async () => {
    }
  });

-  await it("rejects invalid filenames", () => {
+  await it("rejects invalid filenames", async () => {
    const inputs = [
      "missing-date-from-filename.md",
      "2021-01-01.md",
@@ -108,14 +126,14 @@ await describe("isValidChangenoteFilename", async () => {
 });

 await describe("hasValidChangenoteCategory", async () => {
-  await it("accepts valid categories", () => {
+  await it("accepts valid categories", async () => {
    for (const category of Object.keys(VALID_CHANGE_NOTE_CATEGORIES)) {
      const frontmatter = { category };
      assert.equal(hasValidChangenoteCategory(frontmatter), true);
    }
  });

-  await it("rejects invalid categories", () => {
+  await it("rejects invalid categories", async () => {
    const inputs = [
      "",
      "invalid-category",
@@ -132,7 +150,7 @@ await describe("hasValidChangenoteCategory", async () => {
    }
  });

-  await it("reject missing category", () => {
+  await it("reject missing category", async () => {
    assert.equal(hasValidChangenoteCategory({}), false);
    assert.equal(hasValidChangenoteCategory({ category: null }), false);
    assert.equal(hasValidChangenoteCategory({ category: undefined }), false);
@@ -144,21 +162,37 @@ await describe("isValidChangenoteFile", async () => {
    await withTmpFile(
      "2026-01-01-fix-bug.md",
      "---\ncategory: fix\n---\n- Fixed a bug\n",
-      (filePath) => {
+      async (filePath) => {
        assert.equal(isValidChangenoteFile(filePath), true);
      },
    );
  });

-  await it("rejects a non-existent path", async () => {
-    assert.equal(isValidChangenoteFile("non-existent-file.md"), false);
+  await it("rejects invalid filename", async () => {
+    await withTmpFile(
+      "fix-bug.md",
+      "---\ncategory: fix\n---\n- Fixed a bug\n",
+      async (filePath) => {
+        assert.equal(isValidChangenoteFile(filePath), false);
+      },
+    );
+  });
+
+  await it("rejects missing frontmatter", async () => {
+    await withTmpFile(
+      "2026-01-01-fix-bug.md",
+      "- Fixed a bug\n",
+      async (filePath) => {
+        assert.equal(isValidChangenoteFile(filePath), false);
+      },
+    );
  });

  await it("rejects invalid Markdown", async () => {
    await withTmpFile(
      "2026-01-01-fix-bug.md",
      "---\ncategory: fix\n---\n* Fixed a bug\n",
-      (filePath) => {
+      async (filePath) => {
        assert.equal(isValidChangenoteFile(filePath), false);
      },
    );
--- a/scripts/changetool/cli/validate.ts
+++ b/scripts/changetool/cli/validate.ts
@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import * as path from "node:path";

 import { matter } from "lite-matter";
 import type { List, ListItem } from "mdast";
@@ -94,7 +95,21 @@ export function isValidChangenoteFile(filename: string): boolean {
    return false;
  }

-  const { content } = matter(fileData);
+  const { data: frontmatter, content } = matter(fileData);
+
+  if (!isValidChangenoteFilename(path.basename(filename))) {
+    isValid = false;
+    console.error(
+      `${filename}: invalid filename; must match pattern YYYY-MM-DD-id.md`,
+    );
+  }
+  if (!hasValidChangenoteCategory(frontmatter)) {
+    isValid = false;
+    const categories = Object.keys(VALID_CHANGE_NOTE_CATEGORIES).join(", ");
+    console.error(
+      `${filename}: invalid category; must be one of: ${categories}`,
+    );
+  }
  if (!isValidChangenoteContent(content)) {
    isValid = false;
    console.error(
--- a/scripts/changetool/index.ts
+++ b/scripts/changetool/index.ts
@@ -0,0 +1,51 @@
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+
+import { isValidChangenoteFile } from "./cli/validate.ts";
+
+const entryPoint = process.argv[1];
+if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) {
+  try {
+    process.exit(main());
+  } catch (error) {
+    console.error(error);
+    process.exit(1);
+  }
+}
+
+function main(): number {
+  const { positionals } = parseArgs({
+    allowPositionals: true,
+    strict: true,
+  });
+  const [command, ...paths] = positionals;
+  switch (command) {
+    case undefined:
+    case "help":
+      return usage();
+    case "validate":
+      return validate(paths);
+    default:
+      console.error(`Unknown command: ${command}`);
+      return 1;
+  }
+}
+
+function usage(): number {
+  console.log("Usage: changetool validate <path> [<path> ...]");
+  return 0;
+}
+
+function validate(paths: string[]): number {
+  let valid = true;
+  if (paths.length === 0) {
+    console.error("error: no paths provided (see 'help' command for usage)");
+    return 1;
+  }
+  for (const path of paths) {
+    if (!isValidChangenoteFile(path)) {
+      valid = false;
+    }
+  }
+  return valid ? 0 : 1;
+}
--- a/scripts/changetool/package.json
+++ b/scripts/changetool/package.json
@@ -0,0 +1,21 @@
+{
+  "name": "changetool",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Validates change-notes and merges them into CHANGELOG.md",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "start": "tsx index.ts",
+    "test": "node --test --experimental-strip-types cli/*.test.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "tsx": "^4.23.12",
+    "typescript": "^7.0.2"
+  },
+  "dependencies": {
+    "lite-matter": "^0.1.2",
+    "mdast-util-from-markdown": "^2.0.3"
+  }
+}
--- a/scripts/changetool/tsconfig.json
+++ b/scripts/changetool/tsconfig.json
@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "module": "preserve",
+    "allowImportingTsExtensions": true,
+    "rootDir": ".",
+    "sourceMap": false
+  },
+  "include": ["./**/*.ts"],
+  "exclude": ["node_modules"]
+}
--- a/setup-codeql/action.yml
+++ b/setup-codeql/action.yml
@@ -21,16 +21,19 @@ inputs:
    required: false
  languages:
    description: >-
-      A comma-separated list of CodeQL languages that the installed CodeQL CLI will be used to
-      analyze. If specified, the Action may use this list to select a CodeQL CLI version that is
-      best suited to analyzing those languages, for example by preferring a version that has a
-      cached overlay-base database for the specified languages.
+      A comma-separated list of CodeQL languages that will be analyzed in subsequent
+      `github/codeql-action/init` and `github/codeql-action/analyze` invocations. If specified, the
+      Action may use this list to select a CodeQL CLI version that is best suited to analyzing those
+      languages, for example by preferring a version that has a cached overlay-base database for the
+      specified languages. This input is not remembered and must also be passed to
+      `github/codeql-action/init`.
    required: false
  analysis-kinds:
    description: >-
-      [Internal] A comma-separated list of analysis kinds that the installed CodeQL CLI will be used
-      for. If specified, the Action may use this list to select a CodeQL CLI version that is best
-      suited to those analysis kinds.
+      [Internal] A comma-separated list of analysis kinds that subsequent
+      `github/codeql-action/init` invocations will enable. If specified, the Action may use this
+      list to select a CodeQL CLI version that is best suited to those analysis kinds. This input is
+      not remembered and must also be passed to `github/codeql-action/init`.

      Available options are the same as for the `analysis-kinds` input on the `init` Action.
    default: 'code-scanning'
@@ -51,5 +54,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node24
+  using: node20
  main: '../lib/setup-codeql-entry.js'
--- a/src/action-common.test.ts
+++ b/src/action-common.test.ts
@@ -19,24 +19,6 @@ import { getErrorMessage } from "./util";

 setupTests(test);

-for (const [key, displayName] of Object.entries(
-  statusReport.ACTION_DISPLAY_NAMES,
-)) {
-  test(`getDisplayActionName - '${displayName}' instead of '${key}'`, (t) => {
-    t.is(statusReport.getDisplayActionName(key as ActionName), displayName);
-  });
-}
-
-test("getDisplayActionName - returns action name", (t) => {
-  for (const actionName of Object.values(ActionName)) {
-    if (statusReport.ACTION_DISPLAY_NAMES[actionName]) {
-      continue;
-    }
-
-    t.is(statusReport.getDisplayActionName(actionName), actionName);
-  }
-});
-
 interface RunInActionsTestOpts {
  runFn?: () => Promise<any>;
  expectedErrorMessage?: string;
--- a/src/action-common.ts
+++ b/src/action-common.ts
@@ -19,10 +19,6 @@ export interface BaseState {
  name: ActionName;
  /** When the Action was started. */
  startedAt: Date;
-  /** The platform the Action is running on. */
-  platform: NodeJS.Platform;
-  /** The architecture of the host. */
-  arch: NodeJS.Architecture;
 }

 /** Describes different state features that an Action may have. */
@@ -56,29 +52,6 @@ export interface FeatureState {
 /** Identifies a type of state an Action may have. */
 export type StateFeature = keyof FeatureState;

-/**
- * The `Env` feature implies the availability of the `ReadOnlyEnv` feature.
- *
- * If `T` is `Env`, this returns `Env | ReadOnlyEnv`.
- * Otherwise, it is the identity and returns T.
- */
-type ImpliedFeatures<T extends StateFeature> = T extends "Env"
-  ? "Env" | "ReadOnlyEnv"
-  : T;
-
-/**
- * Given an object type `Obj`, this tries to lookup a corresponding `StateFeature`
- * to which the object type belongs in `FeatureState`. Resolves to `never` if there
- * is no match.
- */
-type FeatureNameFor<Obj extends object> = {
-  [K in StateFeature]: [Obj] extends [FeatureState[K]]
-    ? [FeatureState[K]] extends [Obj]
-      ? K
-      : never
-    : never;
-}[StateFeature];
-
 /** Constructs the intersection of all state types identifies by `Fs`. */
 export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
  ? Record<never, never>
@@ -89,54 +62,8 @@ export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
    ? FeatureState[Head] & FieldsOf<Tail>
    : never;

-/**
- * Symbol used for a field in `ActionState` that carries the type array of state features.
- * This is a Symbol so that it doesn't clash with any property names we might want to have.
- */
-const stateFeatures = Symbol();
-
 /** Describes the state of an Action that has access to the state corresponding to `Fs`. */
-export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs> & {
-  /**
-   * When given a chance, TypeScript will simplify an `ActionState<Fs>` type as much as possible,
-   * which results in a concrete object type that doesn't mention `Fs`.
-   *
-   * That causes problems for functions which accept `ActionState<Fs>` values, but need to know the
-   * feature keys `Fs`. This property here explicitly captures `Fs` in the concrete object type
-   * that results from simplifying `ActionState<Fs>`.
-   *
-   * This is a function rather than a field, because we want to be able to provide values of type
-   * `ActionState<Fs>` to functions expecting `ActionState<As>` where `As` is a subset of `Fs`.
-   *
-   * Since function types are contravariant in the types of their parameters, using a function
-   * type here allows that to happen.
-   *
-   * Because the field is optional, we don't have to explicitly provide a value
-   * for it anywhere while the type is still inferred.
-   *
-   * `Fs[number]` returns the union of all features in `Fs`. We wrap it in `ImpliedFeatures`
-   * so that `Env` is expanded into `Env | ReadOnlyEnv`, allowing functions that expect the
-   * `ReadOnlyEnv` feature to be provided with an `ActionState` that has the `Env` feature
-   * without requiring this to be made explicit.
-   */
-  readonly [stateFeatures]?: (ts: ImpliedFeatures<Fs[number]>) => void;
-};
-
-/** Extends `state` with an `extra` feature. */
-export function extendActionState<
-  // In first position, so that it can be explicitly provided if `FeatureNameFor`
-  // should not work on `extra`.
-  F extends StateFeature,
-  Fs extends readonly StateFeature[],
-  E extends FeatureState[F],
->(
-  state: ActionState<Fs>,
-  extra: E,
-): ActionState<[...Fs, FeatureNameFor<E> & F]> {
-  return { ...state, ...extra } as unknown as ActionState<
-    [...Fs, FeatureNameFor<E> & F]
-  >;
-}
+export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs>;

 /** The type of an Action's main entry point. This is a function that is provided
 * with a basic `ActionState` object with features that are always available.
@@ -171,8 +98,6 @@ export async function runInActions(action: Action) {
    const actionState = {
      name: action.name,
      startedAt,
-      platform: process.platform,
-      arch: process.arch,
      logger,
      env,
      actions: actionsEnv,
--- a/src/actions-util.test.ts
+++ b/src/actions-util.test.ts
@@ -7,13 +7,12 @@ import {
  isAnalyzingPullRequest,
  isDefaultSetup,
  isDynamicWorkflow,
-  printDebugLogs,
 } from "./actions-util";
 import { computeAutomationID } from "./api-client";
 import { EnvVar } from "./environment";
 import { getRunnerLogger } from "./logging";
-import { RecordingLogger, setupTests } from "./testing-utils";
-import { initializeEnvironment, withTmpDir } from "./util";
+import { setupTests } from "./testing-utils";
+import { initializeEnvironment } from "./util";

 setupTests(test);

@@ -101,21 +100,6 @@ test("computeAutomationID()", async (t) => {
  );
 });

-test("printDebugLogs - doesn't throw when config doesn't have needed properties", async (t) => {
-  const logger = new RecordingLogger();
-  await t.notThrowsAsync(printDebugLogs(logger, {}));
-  await t.notThrowsAsync(printDebugLogs(logger, { languages: [] }));
-  await t.notThrowsAsync(printDebugLogs(logger, { dbLocation: "nowhere" }));
-});
-
-test("printDebugLogs - doesn't throw when language db doesn't exist", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    await t.notThrowsAsync(
-      printDebugLogs(logger, { dbLocation: tmpDir, languages: ["javascript"] }),
-    );
-  }));
-
 test.serial("getPullRequestBranches() with pull request context", (t) => {
  withMockedContext(
    {
--- a/src/actions-util.ts
+++ b/src/actions-util.ts
@@ -6,15 +6,14 @@ import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";

-import { hasConfigKey, type Config } from "./config/action-config";
-import { Env, EnvVar, ActionsEnvVars, ReadOnlyEnv } from "./environment";
+import type { Config } from "./config-utils";
+import { Env, EnvVar, ActionsEnvVars } from "./environment";
 import { Logger } from "./logging";
 import {
  doesDirectoryExist,
  getCodeQLDatabasePath,
  ConfigurationError,
  getEnv,
-  getErrorMessage,
 } from "./util";

 /**
@@ -30,6 +29,7 @@ declare const __CODEQL_ACTION_VERSION__: string;
 export interface ActionsEnv {
  getRequiredInput: (name: string) => string;
  getOptionalInput: (name: string) => string | undefined;
+  exportVariable: (name: string, value: string) => void;
 }

 /**
@@ -39,6 +39,7 @@ export function getActionsEnv(): ActionsEnv {
  return {
    getRequiredInput,
    getOptionalInput,
+    exportVariable: core.exportVariable,
  };
 }

@@ -93,7 +94,7 @@ export function getActionVersion(): string {
 *
 * This will be "dynamic" for default setup workflow runs.
 */
-export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
+export function getWorkflowEventName(env: Env = getEnv()) {
  return env.getRequired(ActionsEnvVars.GITHUB_EVENT_NAME);
 }

@@ -101,7 +102,7 @@ export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
 * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
 * a workflow on the codeql-action repo itself.
 */
-export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
+export function isRunningLocalAction(env: Env = getEnv()): boolean {
  const relativeScriptPath = getRelativeScriptPath(env);
  return (
    relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath)
@@ -113,14 +114,14 @@ export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
 *
 * This can be used to get the Action's name or tell if we're running a local Action.
 */
-function getRelativeScriptPath(env: ReadOnlyEnv): string {
+function getRelativeScriptPath(env: Env): string {
  const runnerTemp = env.getRequired(ActionsEnvVars.RUNNER_TEMP);
  const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
  return path.relative(actionsDirectory, __filename);
 }

 /** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
-export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any {
+export function getWorkflowEvent(env: Env = getEnv()): any {
  const eventJsonFile = env.getRequired(ActionsEnvVars.GITHUB_EVENT_PATH);
  try {
    return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
@@ -131,38 +132,28 @@ export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any {
  }
 }

-export async function printDebugLogs(logger: Logger, config: Partial<Config>) {
-  if (
-    !hasConfigKey(config, "languages") ||
-    !hasConfigKey(config, "dbLocation")
-  ) {
-    logger.debug(
-      `Not printing debug logs, because the configuration does not include the 'languages' or 'dbLocation' fields.`,
-    );
-    return;
-  }
-
+export async function printDebugLogs(config: Config) {
  for (const language of config.languages) {
    const databaseDirectory = getCodeQLDatabasePath(config, language);
    const logsDirectory = path.join(databaseDirectory, "log");
    if (!doesDirectoryExist(logsDirectory)) {
-      logger.info(`Directory ${logsDirectory} does not exist.`);
+      core.info(`Directory ${logsDirectory} does not exist.`);
      continue; // Skip this language database.
    }

    const walkLogFiles = (dir: string) => {
      const entries = fs.readdirSync(dir, { withFileTypes: true });
      if (entries.length === 0) {
-        logger.info(`No debug logs found at directory ${logsDirectory}.`);
+        core.info(`No debug logs found at directory ${logsDirectory}.`);
      }
      for (const entry of entries) {
        if (entry.isFile()) {
          const absolutePath = path.resolve(dir, entry.name);
-          logger.startGroup(
+          core.startGroup(
            `CodeQL Debug Logs - ${language} - ${entry.name} from file at path ${absolutePath}`,
          );
-          logger.info(fs.readFileSync(absolutePath, "utf-8"));
-          logger.endGroup();
+          process.stdout.write(fs.readFileSync(absolutePath));
+          core.endGroup();
        } else if (entry.isDirectory()) {
          walkLogFiles(path.resolve(dir, entry.name));
        }
@@ -301,7 +292,7 @@ export function isSelfHostedRunner(env: Env = getEnv()) {
 * that are configured to resemble hosted ones, such as those that mount a persistent volume at
 * `/opt/hostedtoolcache`.
 */
-export function isGitHubHostedRunner(env: ReadOnlyEnv = getEnv()) {
+export function isGitHubHostedRunner(env: Env = getEnv()) {
  return env.getOptional(ActionsEnvVars.RUNNER_ENVIRONMENT) === "github-hosted";
 }

@@ -421,23 +412,14 @@ export const persistInputs = function (env: Env = getEnv()) {
 /**
 * Restores all inputs to the action from the persisted state.
 */
-export function restoreInputs(logger: Logger) {
-  try {
-    const persistedInputsValue = core.getState(persistedInputsKey);
-    if (persistedInputsValue) {
-      const persistedInputs = JSON.parse(persistedInputsValue);
-
-      for (const [name, value] of persistedInputs) {
-        process.env[name] = value;
-      }
+export const restoreInputs = function () {
+  const persistedInputs = core.getState(persistedInputsKey);
+  if (persistedInputs) {
+    for (const [name, value] of JSON.parse(persistedInputs)) {
+      process.env[name] = value;
    }
-  } catch (err) {
-    logger.error(`Unable to restore inputs: ${getErrorMessage(err)}`);
-    throw new Error(
-      "Failed to restore inputs from the state set by this action's main execution.",
-    );
  }
-}
+};

 export interface PullRequestBranches {
  base: string;
--- a/src/analyze-action-post.ts
+++ b/src/analyze-action-post.ts
@@ -9,6 +9,7 @@ import * as core from "@actions/core";

 import * as actionsUtil from "./actions-util";
 import { getGitHubVersion } from "./api-client";
+import { getCodeQL } from "./codeql";
 import { getConfig } from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
 import {
@@ -24,8 +25,8 @@ export async function runWrapper() {
  // possible, and only use safe functions outside.

  try {
+    actionsUtil.restoreInputs();
    const logger = getActionsLogger();
-    actionsUtil.restoreInputs(logger);
    const gitHubVersion = await getGitHubVersion();
    checkGitHubVersionInRange(gitHubVersion, logger);

@@ -37,9 +38,12 @@ export async function runWrapper() {
        logger,
      );
      if (config !== undefined) {
+        const codeql = await getCodeQL(logger, config.codeQLCmd);
+        const version = await codeql.getVersion();
        await debugArtifacts.uploadCombinedSarifArtifacts(
          logger,
          config.gitHubVersion.type,
+          version.version,
        );
      }
    }
--- a/src/analyze-action.test.ts
+++ b/src/analyze-action.test.ts
@@ -45,7 +45,6 @@ test.serial(
      requiredInputStub.withArgs("token").returns("fake-token");
      requiredInputStub.withArgs("upload-database").returns("false");
      requiredInputStub.withArgs("output").returns("out");
-      requiredInputStub.withArgs("checkout_path").returns("");
      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
      optionalInputStub.withArgs("expect-error").returns("false");
      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
@@ -105,7 +104,6 @@ test.serial(
      requiredInputStub.withArgs("token").returns("fake-token");
      requiredInputStub.withArgs("upload-database").returns("false");
      requiredInputStub.withArgs("output").returns("out");
-      requiredInputStub.withArgs("checkout_path").returns("");
      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
      optionalInputStub.withArgs("expect-error").returns("false");
      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
--- a/src/analyze-action.ts
+++ b/src/analyze-action.ts
@@ -4,18 +4,12 @@ import { performance } from "perf_hooks";

 import * as core from "@actions/core";

-import {
-  Action,
-  ActionState,
-  extendActionState,
-  runInActions,
-} from "./action-common";
+import { Action, ActionState, runInActions } from "./action-common";
 import * as actionsUtil from "./actions-util";
 import * as analyses from "./analyses";
 import {
  CodeQLAnalysisError,
  dbIsFinalized,
-  determineCheckoutPath,
  QueriesStatusReport,
  runFinalize,
  runQueries,
@@ -218,11 +212,9 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  await runAutobuild(config, BuiltInLanguage.go, logger);
 }

-async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.
-  const startedAt = action.startedAt;
-  const logger = action.logger;

  let uploadResults:
    | Partial<Record<analyses.AnalysisKind, UploadResult>>
@@ -271,6 +263,17 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      );
    }

+    // Unset the CODEQL_PROXY_* environment variables when using older CodeQL
+    // CLIs, as they are not needed and can cause issues.
+    if (
+      process.env.CODEQL_PROXY_HOST === "" &&
+      !(await util.codeQlVersionAtLeast(codeql, "2.20.7"))
+    ) {
+      delete process.env.CODEQL_PROXY_HOST;
+      delete process.env.CODEQL_PROXY_PORT;
+      delete process.env.CODEQL_PROXY_CA_CERTIFICATE;
+    }
+
    if (actionsUtil.getOptionalInput("cleanup-level")) {
      logger.info(
        "The 'cleanup-level' input is ignored since the CodeQL Action now automatically " +
@@ -280,7 +283,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {

    const apiDetails = getApiDetails();
    const outputDir = actionsUtil.getRequiredInput("output");
-    action.env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
+    core.exportVariable(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
    const threads = util.getThreadsFlag(
      actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"],
      logger,
@@ -304,13 +307,8 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      logger,
    );

-    const checkoutPath = await determineCheckoutPath(action, config);
-
    // Setup diff informed analysis if needed (based on whether init created the file)
-    const diffRangePackDir = await setupDiffInformedQueryRun(
-      logger,
-      checkoutPath,
-    );
+    const diffRangePackDir = await setupDiffInformedQueryRun(logger);

    await warnIfGoInstalledAfterInit(config, logger);
    await runAutobuildIfLegacyGoWorkflow(config, logger);
@@ -356,6 +354,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      actionsUtil.getOptionalInput("upload"),
    );
    if (runStats) {
+      const checkoutPath = actionsUtil.getRequiredInput("checkout_path");
      const category = actionsUtil.getOptionalInput("category");

      uploadResults = await postProcessAndUploadSarif(
@@ -389,25 +388,18 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    // Possibly upload the overlay-base database to actions cache.
    // Note: Take care with the ordering of this call since databases may be cleaned up
    // at the `overlay` level.
-    await cleanupAndUploadOverlayBaseDatabaseToCache(
-      codeql,
-      config,
-      logger,
-      checkoutPath,
-    );
-
-    const actionWithFeatures = extendActionState(action, { features });
+    await cleanupAndUploadOverlayBaseDatabaseToCache(codeql, config, logger);

    // Possibly upload the database bundles for remote queries.
    // Note: Take care with the ordering of this call since databases may be cleaned up
    // at the `overlay` or `clear` level.
    databaseUploadResults = await cleanupAndUploadDatabases(
-      actionWithFeatures,
      repositoryNwo,
      codeql,
      config,
      apiDetails,
-      checkoutPath,
+      features,
+      logger,
    );

    // Possibly upload the TRAP caches for later re-use
@@ -451,7 +443,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
        `expect-error input was set to true but no error was thrown.`,
      );
    }
-    action.env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+    core.exportVariable(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
  } catch (unwrappedError) {
    const error = util.wrapError(unwrappedError);
    if (
--- a/src/analyze.test.ts
+++ b/src/analyze.test.ts
@@ -7,15 +7,13 @@ import * as sinon from "sinon";
 import { CodeQuality, CodeScanning, RiskAssessment } from "./analyses";
 import {
  runQueries,
+  defaultSuites,
  resolveQuerySuiteAlias,
  addSarifExtension,
  diffRangeExtensionPackContents,
-  determineCheckoutPath,
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
-import { defaultSuites } from "./config/db-config";
 import { Feature } from "./feature-flags";
-import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
@@ -23,98 +21,12 @@ import {
  setupActionsVars,
  createFeatures,
  createTestConfig,
-  callee,
 } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
 import * as util from "./util";

 setupTests(test);

-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not in a work tree",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({}));
-    sinon.stub(gitUtils, "getGitRoot").resolves(undefined);
-
-    await target
-      .logs(t, "is not in the work tree of a git repository")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not a repo root",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({}));
-    sinon.stub(gitUtils, "getGitRoot").resolves("/checkout");
-
-    await target
-      .logs(t, "is not the root of the repository")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not the same as repo root in config",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({ repositoryRoot: "/some/other/path" }));
-    sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
-
-    await target
-      .logs(t, "does not match that found by the 'codeql-action/init' step")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - doesn't log any of the messages when all is as expected",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({ repositoryRoot: expectedPath }));
-    sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
-
-    await target
-      .notLogs(
-        t,
-        "is not in the work tree of a git repository",
-        "is not the root of the repository",
-        "does not match that found by the 'codeql-action/init' step",
-      )
-      .passes(t.is, expectedPath);
-  },
-);
-
 /**
 * Checks the status report produced by the analyze Action.
 *
--- a/src/analyze.ts
+++ b/src/analyze.ts
@@ -5,13 +5,10 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";

-import type { ActionState } from "./action-common";
-import { getTemporaryDirectory } from "./actions-util";
+import { getTemporaryDirectory, getRequiredInput } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
-import type { ActionConfig } from "./config/action-config";
-import { defaultSuites } from "./config/db-config";
 import * as configUtils from "./config-utils";
 import {
  getCsharpTempDependencyDir,
@@ -24,7 +21,6 @@ import {
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { getGitRoot } from "./git-utils";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -89,58 +85,6 @@ export interface QueriesStatusReport
  event_reports?: EventReport[];
 }

-/**
- * Determines the path at which the repository being analysed is checked out at.
- * Returns the value of the required `checkout_path` input and validates that it
- * refers to the root of a repository.
- *
- * @param action The action state.
- * @param config The CodeQL Action configuration state.
- */
-export async function determineCheckoutPath(
-  action: ActionState<["Logger", "Actions"]>,
-  config: configUtils.Config,
-) {
-  const checkoutPathInput = action.actions.getRequiredInput("checkout_path");
-
-  // Try to obtain the root path of the repository and validate that it matches the input.
-  const absCheckoutPathInput = path.resolve(checkoutPathInput);
-  const repositoryRoot = await getGitRoot(absCheckoutPathInput);
-
-  if (repositoryRoot === undefined) {
-    action.logger.warning(
-      [
-        `The directory at '${absCheckoutPathInput}' is not in the work tree of a git repository.`,
-        "If the repository being analyzed is checked out elsewhere,",
-        "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to",
-        "the checkout path.",
-      ].join(" "),
-    );
-  } else if (repositoryRoot !== absCheckoutPathInput) {
-    action.logger.warning(
-      [
-        `The directory at '${absCheckoutPathInput}' is not the root of the repository ('${repositoryRoot}').`,
-        "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.",
-      ].join(" "),
-    );
-  } else if (
-    config.repositoryRoot !== undefined &&
-    repositoryRoot !== config.repositoryRoot
-  ) {
-    // The repository root that was persisted by the `init` step doesn't match the one we have found here.
-    action.logger.warning(
-      [
-        `The repository path at '${repositoryRoot}' does not match that found by the 'codeql-action/init' step: '${config.repositoryRoot}'.`,
-        "Ensure that the 'checkout_path' input for the 'codeql-action/analyze' step is set to the path of the same repository that",
-        "the 'codeql-action/init' step determined. This is either the GitHub Actions workspace or the repository root corresponding to",
-        "the 'source-root' input if that was provided.",
-      ].join(" "),
-    );
-  }
-
-  return absCheckoutPathInput;
-}
-
 async function setupPythonExtractor(logger: Logger) {
  const codeqlPython = process.env["CODEQL_PYTHON"];
  if (codeqlPython === undefined || codeqlPython.length === 0) {
@@ -179,7 +123,7 @@ export async function runExtraction(
          language === BuiltInLanguage.cpp &&
          config.buildMode === BuildMode.Autobuild
        ) {
-          await setupCppAutobuild(logger);
+          await setupCppAutobuild(codeql, logger);
        }

        // The Java and C# `build-mode: none` extractors place dependencies in the
@@ -226,7 +170,7 @@ async function shouldExtractLanguage(
 }

 export function dbIsFinalized(
-  config: ActionConfig<"dbLocation">,
+  config: configUtils.Config,
  language: Language,
  logger: Logger,
 ) {
@@ -289,7 +233,6 @@ async function finalizeDatabaseCreation(
 */
 export async function setupDiffInformedQueryRun(
  logger: Logger,
-  checkoutPath: string,
 ): Promise<string | undefined> {
  return await withGroupAsync(
    "Generating diff range extension pack",
@@ -302,6 +245,7 @@ export async function setupDiffInformedQueryRun(
        return undefined;
      }

+      const checkoutPath = getRequiredInput("checkout_path");
      const packDir = writeDiffRangeDataExtensionPack(
        logger,
        diffRanges,
@@ -413,6 +357,15 @@ dataExtensions:
  return diffRangeDir;
 }

+// A set of default query suite names that are understood by the CLI.
+export const defaultSuites: Set<string> = new Set([
+  "security-experimental",
+  "security-extended",
+  "security-and-quality",
+  "code-quality",
+  "code-scanning",
+]);
+
 /**
 * If `maybeSuite` is the name of a default query suite, it is resolved into the corresponding
 * query suite name for the given `language`. Otherwise, `maybeSuite` is returned as is.
--- a/src/api-client.test.ts
+++ b/src/api-client.test.ts
@@ -8,14 +8,7 @@ import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
 import { DO_NOT_RETRY_STATUSES } from "./api-client";
 import { ActionsEnvVars, RegistryProxyVars } from "./environment";
-import { GITHUB_DOTCOM_API_URL, GITHUB_DOTCOM_URL } from "./github";
-import {
-  callee,
-  getTestEnv,
-  RecordingLogger,
-  SAMPLE_DOTCOM_API_DETAILS,
-  setupTests,
-} from "./testing-utils";
+import { callee, getTestEnv, setupTests } from "./testing-utils";
 import * as util from "./util";

 setupTests(test);
@@ -118,115 +111,103 @@ test.serial("getGitHubVersion for GHEC-DR", async (t) => {
  t.deepEqual({ type: util.GitHubVariant.GHEC_DR }, gheDotcom);
 });

-test("wrapApiConfigurationError doesn't wrap errors it isn't supposed to", (t) => {
-  const unwrappedErrors = [
+test.serial(
+  "wrapApiConfigurationError correctly wraps specific configuration errors",
+  (t) => {
    // We don't reclassify arbitrary errors
-    new Error("arbitrary error"),
-    // Same goes for arbitrary strings
-    "arbitrary error",
-    // If an HTTP error doesn't contain a specific error message, we don't wrap it.
-    new util.HTTPError("arbitrary HTTP error", 456),
-  ];
+    const arbitraryError = new Error("arbitrary error");
+    let res = api.wrapApiConfigurationError(arbitraryError);
+    t.is(res, arbitraryError);

-  for (const unwrappedError of unwrappedErrors) {
-    const res = api.wrapApiConfigurationError(unwrappedError);
-    t.is(
-      res,
-      unwrappedError,
-      `${util.getErrorMessage(unwrappedError)} should not be wrapped by wrapApiConfigurationError`,
+    // Same goes for arbitrary errors
+    const configError = new util.ConfigurationError("arbitrary error");
+    res = api.wrapApiConfigurationError(configError);
+    t.is(res, configError);
+
+    // If an HTTP error doesn't contain a specific error message, we don't
+    // wrap is an an API error.
+    const httpError = new util.HTTPError("arbitrary HTTP error", 456);
+    res = api.wrapApiConfigurationError(httpError);
+    t.is(res, httpError);
+
+    // For other HTTP errors, we wrap them as Configuration errors if they contain
+    // specific error messages.
+    const httpNotFoundError = new util.HTTPError("commit not found", 404);
+    res = api.wrapApiConfigurationError(httpNotFoundError);
+    t.deepEqual(res, new util.ConfigurationError("commit not found"));
+
+    const refNotFoundError = new util.HTTPError(
+      "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
+      404,
+    );
+    res = api.wrapApiConfigurationError(refNotFoundError);
+    t.deepEqual(
+      res,
+      new util.ConfigurationError(
+        "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
+      ),
    );
-  }
-});

-test("wrapApiConfigurationError correctly wraps specific configuration errors", (t) => {
-  // For other HTTP errors, we wrap them as Configuration errors if they contain
-  // specific error messages.
-  const httpNotFoundError = new util.HTTPError("commit not found", 404);
-  const refNotFoundError = new util.HTTPError(
-    "ref 'refs/heads/jitsi' not found in this repository - https://docs.github.com/rest",
-    404,
-  );
-  const apiRateLimitError = new util.HTTPError(
-    "API rate limit exceeded for installation",
-    403,
-  );
-  const resourceNotAccessibleError = new util.HTTPError(
-    "Resource not accessible by integration",
-    403,
-  );
-  const errorsToWrap = [
-    httpNotFoundError,
-    refNotFoundError,
-    apiRateLimitError,
-    resourceNotAccessibleError,
-  ];
+    const apiRateLimitError = new util.HTTPError(
+      "API rate limit exceeded for installation",
+      403,
+    );
+    res = api.wrapApiConfigurationError(apiRateLimitError);
+    t.deepEqual(
+      res,
+      new util.ConfigurationError("API rate limit exceeded for installation"),
+    );

-  for (const errorToWrap of errorsToWrap) {
-    const res = api.wrapApiConfigurationError(errorToWrap);
-    t.deepEqual(res, new util.ConfigurationError(errorToWrap.message));
-  }
-});
-
-test("wrapApiConfigurationError wraps token errors", async (t) => {
-  const tokenSuggestionMessage =
-    "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
-  const badCredentialsError = new util.HTTPError("Bad credentials", 401);
-  const notFoundError = new util.HTTPError("Not Found", 404);
-  const errorsToWrap = [badCredentialsError, notFoundError];
-
-  for (const errorToWrap of errorsToWrap) {
-    const res = api.wrapApiConfigurationError(errorToWrap);
+    const tokenSuggestionMessage =
+      "Please check that your token is valid and has the required permissions: contents: read, security-events: write";
+    const badCredentialsError = new util.HTTPError("Bad credentials", 401);
+    res = api.wrapApiConfigurationError(badCredentialsError);
    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));
-  }
-});

-test("wrapApiConfigurationError wraps enablement errors", async (t) => {
-  // Enablement errors.
-  const enablementErrorMessages = [
-    "Code Security must be enabled for this repository to use code scanning",
-    "Advanced Security must be enabled for this repository to use code scanning",
-    "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
-    "Code quality is not enabled for this repository. Please enable code quality in the repository settings.",
-  ];
-  const transforms = [
-    (msg: string) => msg,
-    (msg: string) => msg.toLowerCase(),
-    (msg: string) => msg.toLocaleUpperCase(),
-  ];
+    const notFoundError = new util.HTTPError("Not Found", 404);
+    res = api.wrapApiConfigurationError(notFoundError);
+    t.deepEqual(res, new util.ConfigurationError(tokenSuggestionMessage));

-  for (const enablementErrorMessage of enablementErrorMessages) {
-    for (const transform of transforms) {
-      const enablementError = new util.HTTPError(
-        transform(enablementErrorMessage),
-        403,
-      );
-      const res = api.wrapApiConfigurationError(enablementError);
-      t.deepEqual(
-        res,
-        new util.ConfigurationError(
-          api.getFeatureEnablementError(enablementError.message),
-        ),
-      );
+    const resourceNotAccessibleError = new util.HTTPError(
+      "Resource not accessible by integration",
+      403,
+    );
+    res = api.wrapApiConfigurationError(resourceNotAccessibleError);
+    t.deepEqual(
+      res,
+      new util.ConfigurationError("Resource not accessible by integration"),
+    );
+
+    // Enablement errors.
+    const enablementErrorMessages = [
+      "Code Security must be enabled for this repository to use code scanning",
+      "Advanced Security must be enabled for this repository to use code scanning",
+      "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
+      "Code quality is not enabled for this repository. Please enable code quality in the repository settings.",
+    ];
+    const transforms = [
+      (msg: string) => msg,
+      (msg: string) => msg.toLowerCase(),
+      (msg: string) => msg.toLocaleUpperCase(),
+    ];
+
+    for (const enablementErrorMessage of enablementErrorMessages) {
+      for (const transform of transforms) {
+        const enablementError = new util.HTTPError(
+          transform(enablementErrorMessage),
+          403,
+        );
+        res = api.wrapApiConfigurationError(enablementError);
+        t.deepEqual(
+          res,
+          new util.ConfigurationError(
+            api.getFeatureEnablementError(enablementError.message),
+          ),
+        );
+      }
    }
-  }
-});
-
-test("wrapApiConfigurationError doesn't double-wrap errors", async (t) => {
-  // This test checks that errors don't get wrapped a second time if `wrapApiConfigurationError`
-  // is called on an error that was already wrapped by a previous call to `wrapApiConfigurationError`.
-  // Start by calling `wrapApiConfigurationError` on an unwrapped error that should be wrapped:
-  const unwrappedError = new util.HTTPError("commit not found", 404);
-  const wrappedError = api.wrapApiConfigurationError(unwrappedError);
-
-  // Sanity-check that it was wrapped, as expected.
-  t.deepEqual(
-    wrappedError,
-    new util.ConfigurationError(unwrappedError.message),
-  );
-
-  // The result of the second call should be exactly `wrappedError`:
-  t.is(api.wrapApiConfigurationError(wrappedError), wrappedError);
-});
+  },
+);

 test("getRegistryProxy - returns undefined if the proxy is not configured", async (t) => {
  const target = callee(api.getRegistryProxy).withArgs();
@@ -291,62 +272,3 @@ test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => {
    githubUtils.defaults.request,
  );
 });
-
-test.serial(
-  "getApiClientWithExternalAuth constructs clients with or without tokens",
-  (t) => {
-    t.notThrows(() => {
-      api.getApiClientWithExternalAuth(SAMPLE_DOTCOM_API_DETAILS);
-      api.getApiClientWithExternalAuth({
-        ...SAMPLE_DOTCOM_API_DETAILS,
-        auth: undefined,
-      });
-    });
-  },
-);
-
-test("getAuthorizationHeaderFor - returns undefined if there's no token", (t) => {
-  const logger = new RecordingLogger();
-
-  for (const authValue of [undefined, "", "    "]) {
-    const client = new api.InstanceApiClient({
-      ...SAMPLE_DOTCOM_API_DETAILS,
-      auth: authValue,
-    });
-    t.is(
-      client.getAuthorizationHeaderFor(logger, `${GITHUB_DOTCOM_URL}/github`),
-      undefined,
-    );
-  }
-});
-
-test("getAuthorizationHeaderFor - returns header value with token if url is allowed", (t) => {
-  const logger = new RecordingLogger();
-  const client = new api.InstanceApiClient({
-    ...SAMPLE_DOTCOM_API_DETAILS,
-  });
-
-  for (const url of [
-    `${GITHUB_DOTCOM_URL}/github`,
-    `${GITHUB_DOTCOM_API_URL}/github`,
-  ]) {
-    t.is(
-      client.getAuthorizationHeaderFor(logger, url),
-      `token ${SAMPLE_DOTCOM_API_DETAILS.auth}`,
-    );
-  }
-});
-
-test("getAuthorizationHeaderFor - returns undefined if url is not allowed", (t) => {
-  const logger = new RecordingLogger();
-  const client = new api.InstanceApiClient({
-    ...SAMPLE_DOTCOM_API_DETAILS,
-  });
-
-  for (const url of [
-    `https://localhost/github`,
-    `https://api.localhost/github`,
-  ]) {
-    t.is(client.getAuthorizationHeaderFor(logger, url), undefined);
-  }
-});
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -1,6 +1,5 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
-import type { OctokitOptions } from "@octokit/core";
 import * as retry from "@octokit/plugin-retry";
 import { RequestRequestOptions } from "@octokit/types";
 import {
@@ -13,34 +12,25 @@ import {
 import type { ActionState } from "./action-common";
 import { getActionVersion, getRequiredInput } from "./actions-util";
 import {
+  ActionsEnvVars,
  EnvVar,
  ReadOnlyEnv,
  RegistryProxyVars,
  getEnv,
-  exportEnvVar,
-  ActionsEnvVars,
 } from "./environment";
-import {
-  getCurrentInstance,
-  getDotcomInstance,
-  GITHUB_DOTCOM_URL,
-  parseGitHubUrl,
-  type GitHubApiCombinedDetails,
-  type GitHubApiDetails,
-} from "./github";
 import { Logger } from "./logging";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
 import {
  asHTTPError,
  ConfigurationError,
  getRequiredEnvParam,
+  GITHUB_DOTCOM_URL,
  GitHubVariant,
  GitHubVersion,
+  parseGitHubUrl,
  parseMatrixInput,
 } from "./util";

-export type { GitHubApiDetails, GitHubApiCombinedDetails } from "./github";
-
 const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";

 /**
@@ -52,6 +42,21 @@ const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
 */
 export const DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];

+export type GitHubApiCombinedDetails = GitHubApiDetails &
+  GitHubApiExternalRepoDetails;
+
+export interface GitHubApiDetails {
+  auth: string;
+  url: string;
+  apiURL: string | undefined;
+}
+
+export interface GitHubApiExternalRepoDetails {
+  externalRepoAuth?: string;
+  url: string;
+  apiURL: string | undefined;
+}
+
 /**
 * Gets the configuration for the private registry authentication proxy,
 * if it is available in the environment.
@@ -122,61 +127,6 @@ export function makeProxyRequestOptions(
 /** The type of GitHub API client we use. */
 export type ApiClient = InstanceType<typeof githubUtils.GitHub>;

-/**
- * Encapsulates a {@link GitHubApiCombinedDetails} along with operations which ensure that any credentials
- * are only used with the GitHub instance that is represented by the {@link GitHubApiCombinedDetails} value.
- */
-export class InstanceApiClient {
-  private readonly client: ApiClient;
-  private readonly apiDetails: GitHubApiCombinedDetails;
-  private readonly authorizationHeader: string | undefined;
-
-  constructor(
-    apiDetails: GitHubApiCombinedDetails,
-    clientOptions: CreateApiClientOptions = {},
-  ) {
-    this.apiDetails = apiDetails;
-    this.client = createApiClientWithDetails(apiDetails, clientOptions);
-
-    // Compute the Authorization header value if we have a token.
-    const token = this.apiDetails.auth?.trim();
-    if (token !== undefined && token !== "") {
-      this.authorizationHeader = `token ${token}`;
-    }
-  }
-
-  /**
-   * Gets a value for the `Authorization` header for a request to `url`; or `undefined` if the
-   * `Authorization` header should not be set for `url`.
-   *
-   * @param logger The logger to use for debugging messages.
-   * @param url The URL for which we want to add an `Authorization` header.
-   */
-  public getAuthorizationHeaderFor(
-    logger: Logger,
-    url: string,
-  ): string | undefined {
-    // We don't have to check the `url` if we don't have a token to begin with.
-    if (this.authorizationHeader === undefined) {
-      return undefined;
-    }
-
-    // We only want to provide an authorization header if we are downloading
-    // from the same GitHub instance the Action is running on.
-    // This avoids leaking Enterprise tokens to dotcom.
-    if (
-      url.startsWith(`${this.apiDetails.url}/`) ||
-      (this.apiDetails.apiURL && url.startsWith(`${this.apiDetails.apiURL}/`))
-    ) {
-      logger.debug(`Providing an authorization token.`);
-      return this.authorizationHeader;
-    }
-
-    logger.debug(`Not using an authorization token.`);
-    return undefined;
-  }
-}
-
 /** Options for `createApiClientWithDetails`. */
 interface CreateApiClientOptions {
  allowExternal?: boolean;
@@ -188,82 +138,37 @@ function createApiClientWithDetails(
  { allowExternal = false, proxy = undefined }: CreateApiClientOptions = {},
 ): ApiClient {
  const auth =
-    allowExternal && apiDetails.externalRepoAuth !== undefined
-      ? apiDetails.externalRepoAuth
-      : apiDetails.auth;
+    (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
  const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
  const requestOptions = makeProxyRequestOptions(proxy);
-
-  const opts: OctokitOptions = {
-    auth:
-      auth !== undefined && auth.trim() !== "" ? `token ${auth}` : undefined,
-    baseUrl: apiDetails.apiURL,
-    userAgent: `CodeQL-Action/${getActionVersion()}`,
-    log: {
-      debug: core.debug,
-      info: core.info,
-      warn: core.warning,
-      error: core.error,
-    },
-    request: requestOptions,
-    retry: {
-      doNotRetry: DO_NOT_RETRY_STATUSES,
-    },
-  };
-
-  return new retryingOctokit(opts);
+  return new retryingOctokit(
+    githubUtils.getOctokitOptions(auth, {
+      baseUrl: apiDetails.apiURL,
+      userAgent: `CodeQL-Action/${getActionVersion()}`,
+      log: {
+        debug: core.debug,
+        info: core.info,
+        warn: core.warning,
+        error: core.error,
+      },
+      request: requestOptions,
+      retry: {
+        doNotRetry: DO_NOT_RETRY_STATUSES,
+      },
+    }),
+  );
 }

-/**
- * Gets a `GitHubApiDetails` object describing the GitHub instance we are currently running on.
- *
- * @param env The environment variables to read.
- */
 export function getApiDetails(env: ReadOnlyEnv = getEnv()): GitHubApiDetails {
  return {
    auth: getRequiredInput("token"),
-    ...getCurrentInstance(env),
+    url: env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+    apiURL: env.getRequired(ActionsEnvVars.GITHUB_API_URL),
  };
 }

-/**
- * Constructs an {@link ApiClient} using {@link apiDetails}.
- *
- * If {@link apiDetails} is not specified, then the GitHub instance URLs and auth token
- * are taken from {@link env}.
- *
- * If {@link env} is not specified, then the process environment is used.
- *
- * @param env The environment to obtain the GitHub instance URLs from.
- * @param apiDetails The {@link GitHubApiDetails} to construct the {@link ApiClient} for.
- */
-export function getApiClient(
-  env: ReadOnlyEnv = getEnv(),
-  apiDetails?: GitHubApiDetails,
-) {
-  return createApiClientWithDetails(apiDetails ?? getApiDetails(env));
-}
-
-/*
- * Gets a `GitHubApiDetails` object describing the GitHub Dotcom instance.
- *
- * @param env The environment variables to read.
- */
-export function getDotcomApiDetails(env: ReadOnlyEnv): GitHubApiDetails {
-  // If we are currently running on dotcom, then just call `getApiDetails` which will
-  // construct the appropriate `GitHubApiDetails` from the environment and include the
-  // value of the `token` input. The `token` input relates to the GitHub instance that
-  // we are running on only. Therefore, if we are not currently running on dotcom,
-  // then we construct `GitHubApiDetails` without the `token` value and using the
-  // hard-coded instance and API URLs.
-  if (env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL) === GITHUB_DOTCOM_URL) {
-    return getApiDetails(env);
-  } else {
-    return {
-      auth: undefined,
-      ...getDotcomInstance(),
-    };
-  }
+export function getApiClient(env: ReadOnlyEnv = getEnv()) {
+  return createApiClientWithDetails(getApiDetails(env));
 }

 export function getApiClientWithExternalAuth(
@@ -273,6 +178,36 @@ export function getApiClientWithExternalAuth(
  return createApiClientWithDetails(apiDetails, { allowExternal: true, proxy });
 }

+/**
+ * Gets a value for the `Authorization` header for a request to `url`; or `undefined` if the
+ * `Authorization` header should not be set for `url`.
+ *
+ * @param logger The logger to use for debugging messages.
+ * @param apiDetails Details of the GitHub API we are using.
+ * @param url The URL for which we want to add an `Authorization` header.
+ *
+ * @returns The value for the `Authorization` header or `undefined` if it shouldn't be populated.
+ */
+export function getAuthorizationHeaderFor(
+  logger: Logger,
+  apiDetails: GitHubApiDetails,
+  url: string,
+): string | undefined {
+  // We only want to provide an authorization header if we are downloading
+  // from the same GitHub instance the Action is running on.
+  // This avoids leaking Enterprise tokens to dotcom.
+  if (
+    url.startsWith(`${apiDetails.url}/`) ||
+    (apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`))
+  ) {
+    logger.debug(`Providing an authorization token.`);
+    return `token ${apiDetails.auth}`;
+  }
+
+  logger.debug(`Not using an authorization token.`);
+  return undefined;
+}
+
 let cachedGitHubVersion: GitHubVersion | undefined = undefined;

 export async function getGitHubVersionFromApi(
@@ -284,31 +219,25 @@ export async function getGitHubVersionFromApi(
    return { type: GitHubVariant.DOTCOM };
  }

-  try {
-    // Doesn't strictly have to be the meta endpoint as we're only
-    // using the response headers which are available on every request.
-    //
-    // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
-    const response = await apiClient.rest.meta.get();
+  // Doesn't strictly have to be the meta endpoint as we're only
+  // using the response headers which are available on every request.
+  //
+  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+  const response = await apiClient.rest.meta.get();

-    // This happens on dotcom, although we expect to have already returned in that
-    // case. This can also serve as a fallback in cases we haven't foreseen.
-    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
-      return { type: GitHubVariant.DOTCOM };
-    }
-
-    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
-      return { type: GitHubVariant.GHEC_DR };
-    }
-
-    const version = response.headers[
-      GITHUB_ENTERPRISE_VERSION_HEADER
-    ] as string;
-    return { type: GitHubVariant.GHES, version };
-  } catch (err) {
-    throw wrapApiConfigurationError(err);
+  // This happens on dotcom, although we expect to have already returned in that
+  // case. This can also serve as a fallback in cases we haven't foreseen.
+  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
+    return { type: GitHubVariant.DOTCOM };
  }
+
+  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === "ghe.com") {
+    return { type: GitHubVariant.GHEC_DR };
+  }
+
+  const version = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] as string;
+  return { type: GitHubVariant.GHES, version };
 }

 /**
@@ -320,10 +249,9 @@ export async function getGitHubVersionFromApi(
 */
 export async function getGitHubVersion(): Promise<GitHubVersion> {
  if (cachedGitHubVersion === undefined) {
-    const apiDetails = getApiDetails();
    cachedGitHubVersion = await getGitHubVersionFromApi(
-      createApiClientWithDetails(apiDetails),
-      apiDetails,
+      getApiClient(),
+      getApiDetails(),
    );
  }
  return cachedGitHubVersion;
@@ -381,7 +309,7 @@ export async function getAnalysisKey(): Promise<string> {
  const jobName = getRequiredEnvParam("GITHUB_JOB");

  analysisKey = `${workflowPath}:${jobName}`;
-  exportEnvVar(EnvVar.ANALYSIS_KEY, analysisKey);
+  core.exportVariable(EnvVar.ANALYSIS_KEY, analysisKey);
  return analysisKey;
 }

@@ -486,14 +414,7 @@ export function getFeatureEnablementError(message: string): string {
  return `Please verify that the necessary features are enabled: ${message}`;
 }

-/**
- * Decides whether `e` is a known error returned by the GitHub API that we should
- * classify as a `ConfigurationError`.
- *
- * @param e The error to classify.
- * @returns Either `e` or a corresponding `ConfigurationError`.
- */
-export function wrapApiConfigurationError<T>(e: T): T | ConfigurationError {
+export function wrapApiConfigurationError(e: unknown) {
  const httpError = asHTTPError(e);
  if (httpError !== undefined) {
    if (
--- a/src/api-compatibility.json
+++ b/src/api-compatibility.json
@@ -1 +1 @@
-{"maximumVersion":"3.23","minimumVersion":"3.18"}
+{"maximumVersion":"3.23","minimumVersion":"3.17"}
--- a/src/autobuild-action.ts
+++ b/src/autobuild-action.ts
@@ -68,11 +68,7 @@ async function sendCompletedStatusReport(
  }
 }

-async function run({
-  startedAt,
-  env,
-  logger,
-}: ActionState<["Base", "Env", "Logger"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -139,7 +135,7 @@ async function run({
    return;
  }

-  env.export(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
+  core.exportVariable(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");

  await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
 }
--- a/src/autobuild.ts
+++ b/src/autobuild.ts
@@ -1,9 +1,11 @@
+import * as core from "@actions/core";
+
 import { getTemporaryDirectory, getWorkflowEventName } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -110,7 +112,7 @@ export async function determineAutobuildLanguages(
  return languages;
 }

-export async function setupCppAutobuild(logger: Logger) {
+export async function setupCppAutobuild(codeql: CodeQL, logger: Logger) {
  const envVar = featureConfig[Feature.CppDependencyInstallation].envVar;
  const featureName = "C++ automatic installation of dependencies";
  const gitHubVersion = await getGitHubVersion();
@@ -121,7 +123,7 @@ export async function setupCppAutobuild(logger: Logger) {
    getTemporaryDirectory(),
    logger,
  );
-  if (await features.getValue(Feature.CppDependencyInstallation)) {
+  if (await features.getValue(Feature.CppDependencyInstallation, codeql)) {
    // disable autoinstall on self-hosted runners unless explicitly requested
    if (
      process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] === "self-hosted" &&
@@ -134,16 +136,16 @@ export async function setupCppAutobuild(logger: Logger) {
            : ""
        }`,
      );
-      exportEnvVar(envVar, "false");
+      core.exportVariable(envVar, "false");
    } else {
      logger.info(
        `Enabling ${featureName}. This can be disabled by setting the ${envVar} environment variable to 'false'. See ${DocUrl.DEFINE_ENV_VARIABLES} for more information.`,
      );
-      exportEnvVar(envVar, "true");
+      core.exportVariable(envVar, "true");
    }
  } else {
    logger.info(`Disabling ${featureName}.`);
-    exportEnvVar(envVar, "false");
+    core.exportVariable(envVar, "false");
  }
 }

@@ -155,7 +157,7 @@ export async function runAutobuild(
  logger.startGroup(`Attempting to automatically build ${language} code`);
  const codeQL = await getCodeQL(logger, config.codeQLCmd);
  if (language === BuiltInLanguage.cpp) {
-    await setupCppAutobuild(logger);
+    await setupCppAutobuild(codeQL, logger);
  }
  if (config.buildMode) {
    await codeQL.extractUsingBuildMode(config, language);
@@ -163,7 +165,7 @@ export async function runAutobuild(
    await codeQL.runAutobuild(config, language);
  }
  if (language === BuiltInLanguage.go) {
-    exportEnvVar(EnvVar.DID_AUTOBUILD_GOLANG, "true");
+    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
  }
  logger.endGroup();
 }
--- a/src/codeql-bundle.test.ts
+++ b/src/codeql-bundle.test.ts
@@ -1,75 +0,0 @@
-import test from "ava";
-
-import { getCodeQLBundleFromUrl, getCodeQLBundleName } from "./codeql-bundle";
-import { BuiltInLanguage } from "./languages";
-import { BundlePlatform } from "./platform";
-
-test("getCodeQLBundleName returns a per-language bundle name only when a language is specified", (t) => {
-  t.is(
-    getCodeQLBundleName("zstd", BundlePlatform.Linux64, BuiltInLanguage.java),
-    "codeql-bundle-java-linux64.tar.zst",
-  );
-  t.is(
-    getCodeQLBundleName("zstd", BundlePlatform.Linux64),
-    "codeql-bundle-linux64.tar.zst",
-  );
-});
-
-test("getCodeQLBundleName names the Swift bundle for macOS", (t) => {
-  t.is(
-    getCodeQLBundleName("zstd", BundlePlatform.Osx64, BuiltInLanguage.swift),
-    "codeql-bundle-swift-osx64.tar.zst",
-  );
-});
-
-for (const [assetName, language] of [
-  ["codeql-bundle-java-linux64.tar.zst", BuiltInLanguage.java],
-  ["codeql-bundle-swift-osx64.tar.zst", BuiltInLanguage.swift],
-  // Recognize unpublished language/platform combinations to keep them out of the toolcache.
-  ["codeql-bundle-csharp-win64.tar.gz", BuiltInLanguage.csharp],
-  ["codeql-bundle-java-kotlin-linux64.tar.zst", BuiltInLanguage.java],
-  ["codeql-bundle-%70ython-linux64.tar.zst", BuiltInLanguage.python],
-] as const) {
-  test(`getCodeQLBundleFromUrl identifies ${assetName} without adding a fallback`, (t) => {
-    const url = `https://github.com/github/codeql-action/releases/download/codeql-bundle-v1.2.3/${assetName}`;
-    t.deepEqual(getCodeQLBundleFromUrl(url), {
-      kind: "per-language",
-      url,
-      language,
-    });
-  });
-}
-
-test("getCodeQLBundleFromUrl preserves encoding, query parameters and fragments", (t) => {
-  const url =
-    "https://github.com/github/codeql-action/releases/download/codeql-bundle-v1.2.3/codeql-bundle-%70ython-linux64.tar.zst?download=1#asset";
-  t.deepEqual(getCodeQLBundleFromUrl(url), {
-    kind: "per-language",
-    url,
-    language: BuiltInLanguage.python,
-  });
-});
-
-test("getCodeQLBundleFromUrl treats unrecognized assets as combined bundles", (t) => {
-  for (const name of [
-    "codeql-bundle-linux64.tar.zst",
-    "codeql-bundle-osx64.tar.gz",
-    "codeql-bundle-win64.tar.zst",
-    // The all-platform bundle.
-    "codeql-bundle.tar.gz",
-    // A platform we do not publish per-language bundles for, whose name also contains a hyphen.
-    "codeql-bundle-linux-arm64.tar.zst",
-    // Not a language we know about.
-    "codeql-bundle-cobol-linux64.tar.zst",
-    // A name we cannot decode must not be mistaken for a language either.
-    "codeql-bundle-%zz-linux64.tar.zst",
-  ]) {
-    const url = `https://github.com/github/codeql-action/releases/download/codeql-bundle-v1.2.3/${name}`;
-    t.deepEqual(getCodeQLBundleFromUrl(url), { kind: "combined", url });
-  }
-});
-
-test("getCodeQLBundleFromUrl preserves URLs it cannot parse", (t) => {
-  const url = "not a url";
-  t.deepEqual(getCodeQLBundleFromUrl(url), { kind: "combined", url });
-});
--- a/src/codeql-bundle.ts
+++ b/src/codeql-bundle.ts
@@ -1,74 +0,0 @@
-import type { GitHubApiDetails } from "./github";
-import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
-import { BundlePlatform } from "./platform";
-import type { CompressionMethod } from "./tar";
-
-/** Describes the contents and location of a downloadable CodeQL bundle. */
-export type CodeQLBundle =
-  | { kind: "combined"; url: string }
-  | {
-      kind: "per-language";
-      url: string;
-      language: BuiltInLanguage;
-      /** Only set when the Action selected the bundle, allowing a same-version fallback. */
-      combinedBundleURL?: string;
-    };
-
-/** A resolved download, including its bundle identity and version. */
-export interface CodeQLDownloadSource {
-  /** Distinguishes downloads from local archives and cached installations. */
-  sourceType: "download";
-  /** Information about the GitHub instance that contains the asset. */
-  apiDetails: GitHubApiDetails;
-  /** The bundle to download. */
-  bundle: CodeQLBundle;
-  /** The compression format of the bundle archive. */
-  compressionMethod: CompressionMethod;
-  /** Bundle version of the tools, if known. */
-  bundleVersion?: string;
-  /** Requested CLI version, if known. */
-  cliVersion?: string;
-  /** Resolved version for telemetry, independent of whether the bundle can be cached. */
-  toolsVersion: string;
-}
-
-/** Returns the exact bundle asset name for a platform and optional language. */
-export function getCodeQLBundleName(
-  compressionMethod: CompressionMethod,
-  platform: BundlePlatform | undefined,
-  language?: BuiltInLanguage,
-): string {
-  const extensions: Record<CompressionMethod, string> = {
-    gzip: ".tar.gz",
-    zstd: ".tar.zst",
-  };
-  const extension = extensions[compressionMethod];
-  if (platform === undefined) {
-    return `codeql-bundle${extension}`;
-  }
-  if (language !== undefined) {
-    return `codeql-bundle-${language}-${platform}${extension}`;
-  }
-  return `codeql-bundle-${platform}${extension}`;
-}
-
-const PER_LANGUAGE_BUNDLE_NAME =
-  /^codeql-bundle-(.+)-(?:linux64|osx64|win64)\.tar\.(?:gz|zst)$/;
-
-/** Classifies an explicit tools URL without changing it or adding a fallback. */
-export function getCodeQLBundleFromUrl(url: string): CodeQLBundle {
-  let assetName: string;
-  try {
-    const pathname = new URL(url).pathname;
-    // URL-encoded names must not bypass the toolcache safeguard.
-    assetName = decodeURIComponent(pathname.split("/").pop() ?? "");
-  } catch {
-    return { kind: "combined", url };
-  }
-
-  const match = assetName.match(PER_LANGUAGE_BUNDLE_NAME);
-  const language = match ? parseBuiltInLanguage(match[1]) : undefined;
-  return language === undefined
-    ? { kind: "combined", url }
-    : { kind: "per-language", url, language };
-}
--- a/src/codeql.test.ts
+++ b/src/codeql.test.ts
@@ -34,7 +34,6 @@ import {
  makeVersionInfo,
  createTestConfig,
  makeMacro,
-  mockApiDetails,
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
@@ -91,7 +90,7 @@ async function installIntoToolcache({
  tmpDir: string;
 }) {
  const url = mockBundleDownloadApi({ apiDetails, isPinned, tagName });
-  return await codeql.setupCodeQL(
+  await codeql.setupCodeQL(
    cliVersion !== undefined ? undefined : url,
    apiDetails,
    tmpDir,
@@ -100,7 +99,6 @@ async function installIntoToolcache({
      ? { enabledVersions: [{ cliVersion, tagName }] }
      : SAMPLE_DEFAULT_CLI_VERSION,
    undefined, // rawLanguages
-    undefined, // otherLanguagePacksReason
    false, // useOverlayAwareDefaultCliVersion
    createFeatures([]),
    getRunnerLogger(true),
@@ -127,6 +125,19 @@ function mockReleaseApi({
    });
 }

+function mockApiDetails(apiDetails: GitHubApiDetails) {
+  // This is a workaround to mock `api.getApiDetails()` since it doesn't seem to be possible to
+  // mock this directly. The difficulty is that `getApiDetails()` is called locally in
+  // `api-client.ts`, but `sinon.stub(api, "getApiDetails")` only affects calls to
+  // `getApiDetails()` via an imported `api` module.
+  sinon
+    .stub(actionsUtil, "getRequiredInput")
+    .withArgs("token")
+    .returns(apiDetails.auth);
+  process.env["GITHUB_SERVER_URL"] = apiDetails.url;
+  process.env["GITHUB_API_URL"] = apiDetails.apiURL || "";
+}
+
 async function stubCodeql(): Promise<codeql.CodeQL> {
  const codeqlObject = await codeql.getCodeQLForTesting();
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
@@ -161,7 +172,6 @@ test.serial(
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
          undefined, // rawLanguages
-          undefined, // otherLanguagePacksReason
          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
@@ -197,7 +207,6 @@ test.serial(
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
        undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
@@ -237,7 +246,6 @@ test.serial(
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
        undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
@@ -251,66 +259,6 @@ test.serial(
  },
 );

-for (const { cliVersion, tagName, expectedToolcacheVersion } of [
-  {
-    cliVersion: "2.21.0",
-    tagName: "codeql-bundle-20240101",
-    expectedToolcacheVersion: "2.21.0",
-  },
-  {
-    cliVersion: "2.21.0-rc.1",
-    tagName: "codeql-bundle-20240101",
-    expectedToolcacheVersion: "0.0.0-20240101",
-  },
-  {
-    cliVersion: "2.21.0+20240101",
-    tagName: "codeql-bundle-20240101",
-    expectedToolcacheVersion: "0.0.0-20240101",
-  },
-  {
-    cliVersion: "2.21.0",
-    tagName: "custom-release",
-    expectedToolcacheVersion: undefined,
-  },
-]) {
-  test.serial(
-    `preserves CLI version ${cliVersion} when installing ${tagName}`,
-    async (t) => {
-      await util.withTmpDir(async (tmpDir) => {
-        setupActionsVars(tmpDir, tmpDir);
-        mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
-
-        const result = await installIntoToolcache({
-          cliVersion,
-          isPinned: false,
-          tagName,
-          tmpDir,
-        });
-
-        t.is(result.toolsVersion, cliVersion);
-        t.is(result.toolsSource, ToolsSource.Download);
-        t.true(
-          Number.isInteger(result.toolsDownloadStatusReport?.totalDurationMs),
-        );
-        t.deepEqual(
-          toolcache.findAllVersions("CodeQL"),
-          expectedToolcacheVersion === undefined
-            ? []
-            : [expectedToolcacheVersion],
-        );
-        if (expectedToolcacheVersion !== undefined) {
-          const cachedFolder = toolcache.find(
-            "CodeQL",
-            expectedToolcacheVersion,
-          );
-          t.truthy(cachedFolder);
-          t.true(fs.existsSync(`${cachedFolder}.complete`));
-        }
-      });
-    },
-  );
-}
-
 const EXPLICITLY_REQUESTED_BUNDLE_TEST_CASES = [
  {
    tagName: "codeql-bundle-2.17.6",
@@ -348,7 +296,6 @@ for (const {
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
          undefined, // rawLanguages
-          undefined, // otherLanguagePacksReason
          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
@@ -391,7 +338,6 @@ for (const toolcacheVersion of [
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
          undefined, // rawLanguages
-          undefined, // otherLanguagePacksReason
          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
@@ -436,7 +382,6 @@ test.serial(
          ],
        },
        undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
@@ -459,7 +404,6 @@ test.serial(

    await util.withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

      await installIntoToolcache({
        tagName: "codeql-bundle-20200601",
@@ -484,7 +428,6 @@ test.serial(
          ],
        },
        undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
@@ -507,7 +450,6 @@ test.serial(

    await util.withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

      await installIntoToolcache({
        tagName: "codeql-bundle-20200601",
@@ -525,7 +467,6 @@ test.serial(
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
        undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
@@ -567,7 +508,6 @@ test.serial(
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
        undefined, // rawLanguages
-        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -15,10 +15,9 @@ import * as api from "./api-client";
 import * as outputCache from "./cli/output-cache";
 import type { VersionInfo } from "./cli/types";
 import { CliError, wrapCliConfigurationError } from "./cli-errors";
-import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -198,7 +197,7 @@ export interface CodeQL {
  diagnosticsExport(
    sarifFile: string,
    automationDetailsId: string | undefined,
-    config: ActionConfig<"tempDir">,
+    config: Config,
  ): Promise<void>;
  /** Get the location of an extractor for the specified language. */
  resolveExtractor(language: Language): Promise<string>;
@@ -254,22 +253,22 @@ let cachedCodeQL: CodeQL | undefined = undefined;
 * The version flags below can be used to conditionally enable certain features
 * on versions newer than this.
 */
-const CODEQL_MINIMUM_VERSION = "2.20.7";
+const CODEQL_MINIMUM_VERSION = "2.19.4";

 /**
 * This version will shortly become the oldest version of CodeQL that the Action will run with.
 */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.20.7";

 /**
 * This is the version of GHES that was most recently deprecated.
 */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16";

 /**
 * This is the deprecation date for the version of GHES that was most recently deprecated.
 */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";

 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
@@ -303,9 +302,6 @@ export function isDiskConfigurationError(e: unknown): boolean {
 * @param variant
 * @param defaultCliVersion
 * @param rawLanguages Raw set of languages.
- * @param otherLanguagePacksReason Why the CodeQL CLI may need packs for languages other than
- *   `rawLanguages`, or `undefined` if it won't. If defined, the combined bundle is used. See
- *   `PerLanguageBundleOptions.otherLanguagePacksReason`.
 * @param useOverlayAwareDefaultCliVersion Whether to select an overlay-aware default CLI version.
 * @param features Information about the features that are enabled.
 * @param logger
@@ -320,7 +316,6 @@ export async function setupCodeQL(
  variant: util.GitHubVariant,
  defaultCliVersion: CodeQLDefaultVersionInfo,
  rawLanguages: string[] | undefined,
-  otherLanguagePacksReason: string | undefined,
  useOverlayAwareDefaultCliVersion: boolean,
  features: FeatureEnablement,
  logger: Logger,
@@ -344,7 +339,6 @@ export async function setupCodeQL(
      variant,
      defaultCliVersion,
      rawLanguages,
-      otherLanguagePacksReason,
      useOverlayAwareDefaultCliVersion,
      features,
      logger,
@@ -914,7 +908,7 @@ async function getCodeQLForCmd(
    async diagnosticsExport(
      sarifFile: string,
      automationDetailsId: string | undefined,
-      config: ActionConfig<"tempDir">,
+      config: Config,
    ): Promise<void> {
      const args = [
        "diagnostics",
@@ -943,7 +937,6 @@ async function getCodeQLForCmd(
          "--format=json",
          `--language=${language}`,
          "--extractor-include-aliases",
-          "-J-XX:-UsePerfData",
          ...getExtraOptionsFromEnv(["resolve", "extractor"]),
        ],
        {
@@ -958,13 +951,7 @@ async function getCodeQLForCmd(
          },
        },
      ).exec();
-      try {
-        return JSON.parse(extractorPath) as string;
-      } catch (err) {
-        throw new Error(
-          `Failed to parse extractor path for '${language}' from CLI: ${getErrorMessage(err)}\nOutput was: ${extractorPath}`,
-        );
-      }
+      return JSON.parse(extractorPath) as string;
    },
    async resolveQueriesStartingPacks(queries: string[]): Promise<string[]> {
      const codeqlArgs = [
@@ -1055,7 +1042,7 @@ async function getCodeQLForCmd(
        }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
        "continue using this version of the CodeQL Action.",
    );
-    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    core.exportVariable(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
  }
  return codeql;
 }
@@ -1225,7 +1212,7 @@ export async function getTrapCachingExtractorConfigArgsForLang(
 ): Promise<string[]> {
  const cacheDir = config.trapCaches[language];
  if (cacheDir === undefined) return [];
-  const write = await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot);
+  const write = await isAnalyzingDefaultBranch();
  return [
    `-O=${language}.trap.cache.dir=${cacheDir}`,
    `-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`,
@@ -1238,9 +1225,7 @@ export async function getTrapCachingExtractorConfigArgsForLang(
 *
 * This will not exist if the configuration is being parsed in the Action.
 */
-function getGeneratedCodeScanningConfigPath(
-  config: ActionConfig<"tempDir">,
-): string {
+function getGeneratedCodeScanningConfigPath(config: Config): string {
  return path.resolve(config.tempDir, "user-config.yaml");
 }

--- a/src/config-utils.test.ts
+++ b/src/config-utils.test.ts
@@ -172,7 +172,6 @@ test.serial("load empty config", async (t) => {
      createTestInitConfigInputs({
        languagesInput: languages,
        repository: { owner: "github", repo: "example" },
-        sourceRoot: tempDir,
        tempDir,
        codeql,
        logger,
@@ -187,7 +186,6 @@ test.serial("load empty config", async (t) => {
        logger,
      }),
      {},
-      undefined,
    );

    t.deepEqual(config, expectedConfig);
@@ -218,7 +216,6 @@ test.serial("load code quality config", async (t) => {
        analysisKinds: [AnalysisKind.CodeQuality],
        languagesInput: languages,
        repository: { owner: "github", repo: "example" },
-        sourceRoot: tempDir,
        tempDir,
        codeql,
        logger,
@@ -299,7 +296,6 @@ test.serial(
            analysisKinds: [AnalysisKind.CodeQuality],
            languagesInput: languages,
            repository: { owner: "github", repo: "example" },
-            sourceRoot: tempDir,
            tempDir,
            codeql,
            repositoryProperties,
@@ -477,12 +473,6 @@ const simpleConfigFileContents = `
  queries:
    - uses: ./foo_file`;

-/** The configuration in `simpleConfigFileContents`. */
-const simpleConfigInput: UserConfig = {
-  name: "my config",
-  queries: [{ uses: "./foo_file" }],
-};
-
 /** A less minimal configuration file. */
 const otherConfigFileContents = `
  name: my config
@@ -522,7 +512,6 @@ test.serial("load non-empty input", async (t) => {
    // And the config we expect it to parse to
    const expectedConfig = createTestConfig({
      languages: [BuiltInLanguage.javascript],
-      repositoryRoot: undefined,
      buildMode: BuildMode.None,
      originalUserInput: userConfig,
      computedConfig: userConfig,
@@ -543,7 +532,6 @@ test.serial("load non-empty input", async (t) => {
      state,
      createTestInitConfigInputs({
        languagesInput,
-        sourceRoot: tempDir,
        buildModeInput: "none",
        configFile: configFilePath,
        debugArtifactName: "my-artifact",
@@ -570,14 +558,16 @@ test.serial(
        tempDir,
      );

-      const configInput: UserConfig = {
-        name: "my config",
-        queries: [{ uses: "./foo" }],
-        packs: {
-          javascript: ["a/b@1.2.3"],
-          python: ["c/d@1.2.3"],
-        },
-      };
+      const configInput = `
+      name: my config
+      queries:
+        - uses: ./foo
+      packs:
+        javascript:
+          - a/b@1.2.3
+        python:
+          - c/d@1.2.3
+    `;

      fs.mkdirSync(path.join(tempDir, "foo"));

@@ -608,16 +598,7 @@ test.serial(
        }),
      );

-      // Compare with a separate object rather than `configInput` itself, so that the test catches
-      // changes made to the input in place.
-      t.deepEqual(config.originalUserInput, {
-        name: "my config",
-        queries: [{ uses: "./foo" }],
-        packs: {
-          javascript: ["a/b@1.2.3"],
-          python: ["c/d@1.2.3"],
-        },
-      });
+      t.deepEqual(config.originalUserInput, yaml.load(configInput));
    });
  },
 );
@@ -1111,6 +1092,11 @@ const checkOverlayEnablementMacro = makeMacro({
            return lang === BuiltInLanguage.java;
          });

+        // Mock git root detection
+        if (setup.gitRoot !== undefined) {
+          sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
+        }
+
        // Mock submodule detection
        sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules);

@@ -1123,7 +1109,6 @@ const checkOverlayEnablementMacro = makeMacro({
          codeql,
          features,
          setup.languages,
-          setup.gitRoot, // repositoryRoot
          tempDir, // sourceRoot
          setup.buildMode,
          undefined,
@@ -2428,7 +2413,7 @@ test("determineUserConfig - loads config input", async (t) => {
    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);

    const inputs = createTestInitConfigInputs({
-      configInput: simpleConfigInput,
+      configInput: simpleConfigFileContents,
      configFile: undefined,
      workspacePath: tmpDir,
    });
@@ -2438,15 +2423,17 @@ test("determineUserConfig - loads config input", async (t) => {

    await target
      // The input source and path of the generated config file should have been logged.
-      .logs(t, `Using config from action input: ${expectedConfigPath}`)
-      // The message about no configuration input and the warning about both inputs should not have
-      // been logged. The generated config file isn't loaded, since the `config` input has already
-      // been parsed.
+      .logs(
+        t,
+        "Using config from action input:",
+        `Using configuration file: ${expectedConfigPath}`,
+      )
+      // The message about no configuration input and
+      // the warning about both inputs should not have been logged.
      .notLogs(
        t,
        "No configuration file was provided",
        "Both a config file and config input were provided. Ignoring config file.",
-        `Using configuration file: ${expectedConfigPath}`,
      )
      // The loaded configuration should match `simpleConfigFileContents`.
      .passes(t.deepEqual, {
@@ -2465,7 +2452,7 @@ test("determineUserConfig - ignores config file input when both specified", asyn
    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);

    const inputs = createTestInitConfigInputs({
-      configInput: simpleConfigInput,
+      configInput: simpleConfigFileContents,
      configFile: configFilePath,
      workspacePath: tmpDir,
    });
@@ -2479,14 +2466,10 @@ test("determineUserConfig - ignores config file input when both specified", asyn
      .logs(
        t,
        `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
        "Both a config file and config input were provided. Ignoring config file.",
      )
-      // The generated config file isn't loaded, since the `config` input has already been parsed.
-      .notLogs(
-        t,
-        "No configuration file was provided",
-        `Using configuration file: ${expectedConfigPath}`,
-      )
+      .notLogs(t, "No configuration file was provided")
      // The loaded configuration should match `simpleConfigFileContents`.
      .passes(t.deepEqual, {
        name: "my config",
@@ -2499,14 +2482,11 @@ test("determineUserConfig - ignores config file input when both specified", asyn
 });

 /** A `config` input that we might get from Default Setup. */
-const defaultSetupConfigInput: UserConfig = {
-  "threat-models": ["local", "remote"],
-  "default-setup": {
-    org: {
-      "model-packs": ["foo", "bar"],
-    },
-  },
-};
+const defaultSetupConfigInput = `
+  threat-models: [local, remote]
+  default-setup:
+    org:
+      model-packs: [foo, bar]`;

 test("determineUserConfig - merges configs if FF is enabled in Default Setup", async (t) => {
  await withTmpDir(async (tmpDir) => {
@@ -2575,7 +2555,7 @@ test("determineUserConfig - ignores config file input in Default Setup if FF is
      .withArgs(
        tmpDir,
        createTestInitConfigInputs({
-          configInput: simpleConfigInput,
+          configInput: simpleConfigFileContents,
          configFile: configFilePath,
          workspacePath: tmpDir,
        }),
@@ -2585,14 +2565,10 @@ test("determineUserConfig - ignores config file input in Default Setup if FF is
      .logs(
        t,
        `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
        "Both a config file and config input were provided. Ignoring config file.",
      )
-      // The generated config file isn't loaded, since the `config` input has already been parsed.
-      .notLogs(
-        t,
-        "No configuration file was provided",
-        `Using configuration file: ${expectedConfigPath}`,
-      )
+      .notLogs(t, "No configuration file was provided")
      .passes(t.deepEqual, {
        name: "my config",
        queries: [{ uses: "./foo_file" }],
@@ -2611,7 +2587,7 @@ test("determineUserConfig - ignores config file input outside Default Setup if F
      .withArgs(
        tmpDir,
        createTestInitConfigInputs({
-          configInput: simpleConfigInput,
+          configInput: simpleConfigFileContents,
          configFile: configFilePath,
          workspacePath: tmpDir,
        }),
@@ -2621,14 +2597,10 @@ test("determineUserConfig - ignores config file input outside Default Setup if F
      .logs(
        t,
        `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
        "Both a config file and config input were provided. Ignoring config file.",
      )
-      // The generated config file isn't loaded, since the `config` input has already been parsed.
-      .notLogs(
-        t,
-        "No configuration file was provided",
-        `Using configuration file: ${expectedConfigPath}`,
-      )
+      .notLogs(t, "No configuration file was provided")
      .passes(t.deepEqual, {
        name: "my config",
        queries: [{ uses: "./foo_file" }],
--- a/src/config-utils.ts
+++ b/src/config-utils.ts
@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { performance } from "perf_hooks";

+import * as core from "@actions/core";
 import * as yaml from "js-yaml";

 import { ActionState } from "./action-common";
@@ -21,11 +22,7 @@ import {
 import * as api from "./api-client";
 import { getCachingKind } from "./caching-utils";
 import { type CodeQL } from "./codeql";
-import {
-  type AbortedInitConfig,
-  type ActionConfig,
-  type Config,
-} from "./config/action-config";
+import { type Config } from "./config/action-config";
 import {
  calculateAugmentation,
  ExcludeQueryFilter,
@@ -49,7 +46,7 @@ import {
  makeTelemetryDiagnostic,
 } from "./diagnostics";
 import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
-import { EnvVar, exportEnvVar, getEnv } from "./environment";
+import { EnvVar } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
 import {
@@ -75,7 +72,6 @@ import {
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { shouldSkipOverlayAnalysis } from "./overlay/status";
 import { RepositoryNwo } from "./repository";
-import { ActionName } from "./status-report";
 import { ToolsFeature } from "./tools-features";
 import { downloadTrapCaches } from "./trap-caching";
 import {
@@ -341,8 +337,7 @@ export interface InitConfigInputs {
  packsInput: string | undefined;
  configFile: string | undefined;
  dbLocation: string | undefined;
-  /** The configuration from the `config` input. */
-  configInput: UserConfig | undefined;
+  configInput: string | undefined;
  buildModeInput: string | undefined;
  ramInput: string | undefined;
  dependencyCachingEnabled: string | undefined;
@@ -390,7 +385,6 @@ export async function initActionState(
    enableFileCoverageInformation,
  }: InitConfigInputs,
  userConfig: UserConfig,
-  repositoryRoot: string | undefined,
 ): Promise<Config> {
  const languages = await getLanguages(
    codeql,
@@ -442,7 +436,6 @@ export async function initActionState(

  return {
    version: getActionVersion(),
-    repositoryRoot,
    analysisKinds,
    languages,
    buildMode,
@@ -472,18 +465,12 @@ async function downloadCacheWithTime(
  codeQL: CodeQL,
  languages: Language[],
  logger: Logger,
-  repositoryRoot: string | undefined,
 ): Promise<{
  trapCaches: { [language: string]: string };
  trapCacheDownloadTime: number;
 }> {
  const start = performance.now();
-  const trapCaches = await downloadTrapCaches(
-    codeQL,
-    languages,
-    logger,
-    repositoryRoot,
-  );
+  const trapCaches = await downloadTrapCaches(codeQL, languages, logger);
  const trapCacheDownloadTime = performance.now() - start;
  return { trapCaches, trapCacheDownloadTime };
 }
@@ -731,7 +718,6 @@ export async function checkOverlayEnablement(
  codeql: CodeQL,
  features: FeatureEnablement,
  languages: Language[],
-  repositoryRoot: string | undefined,
  sourceRoot: string,
  buildMode: BuildMode | undefined,
  ramInput: string | undefined,
@@ -761,7 +747,6 @@ export async function checkOverlayEnablement(
      true,
      codeql,
      languages,
-      repositoryRoot,
      sourceRoot,
      buildMode,
      gitVersion,
@@ -835,7 +820,7 @@ export async function checkOverlayEnablement(
      `Setting overlay database mode to ${overlayDatabaseMode} ` +
        "with caching because we are analyzing a pull request.",
    );
-  } else if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) {
+  } else if (await isAnalyzingDefaultBranch()) {
    overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
    logger.info(
      `Setting overlay database mode to ${overlayDatabaseMode} ` +
@@ -851,7 +836,6 @@ export async function checkOverlayEnablement(
    false,
    codeql,
    languages,
-    repositoryRoot,
    sourceRoot,
    buildMode,
    gitVersion,
@@ -871,7 +855,6 @@ async function validateOverlayDatabaseMode(
  overlayModeSetExplicitly: boolean,
  codeql: CodeQL,
  languages: Language[],
-  repositoryRoot: string | undefined,
  sourceRoot: string,
  buildMode: BuildMode | undefined,
  gitVersion: GitVersionInfo | undefined,
@@ -907,7 +890,8 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
  }
-  if (repositoryRoot === undefined) {
+  const gitRoot = await getGitRoot(sourceRoot);
+  if (gitRoot === undefined) {
    logger.warning(
      `Cannot build an ${overlayDatabaseMode} database because ` +
        `the source root "${sourceRoot}" is not inside a git repository. ` +
@@ -915,7 +899,7 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.NoGitRoot);
  }
-  if (hasSubmodules(repositoryRoot)) {
+  if (hasSubmodules(gitRoot)) {
    if (gitVersion === undefined) {
      logger.warning(
        `Cannot build an ${overlayDatabaseMode} database because ` +
@@ -980,10 +964,10 @@ async function setCppTrapCachingEnvironmentVariables(
      );
    } else if (config.trapCaches[BuiltInLanguage.cpp]) {
      logger.info("Enabling TRAP caching for C/C++.");
-      exportEnvVar(envVar, "true");
+      core.exportVariable(envVar, "true");
    } else {
      logger.debug(`Disabling TRAP caching for C/C++.`);
-      exportEnvVar(envVar, "false");
+      core.exportVariable(envVar, "false");
    }
  }
 }
@@ -1073,13 +1057,17 @@ export async function determineUserConfig(
  tempDir: string,
  inputs: InitConfigInputs,
 ): Promise<UserConfig> {
+  const validateConfig = await action.features.getValue(
+    Feature.ValidateDbConfig,
+  );
+
  // We have the following cases:
  // 1. A `config` or `config-file` input is provided, but not both: use the provided one.
  // 2. Both are provided and we are in an advanced workflow: ignore the `config-file` input.
  // 3. Both are provided and we are in Default Setup: the `config` input uses a limited
  //    set of options, which are supported by `mergeDefaultSetupAndUserConfigs`,
  //    and we merge the two configs.
-  if (inputs.configInput !== undefined) {
+  if (inputs.configInput) {
    const computedConfigPath = userConfigFromActionPath(tempDir);

    // Get a function which enables us to determine whether the FF that allows us to
@@ -1096,6 +1084,12 @@ export async function determineUserConfig(
    ) {
      // If the FF is enabled and we are in Default Setup, combine the supported
      // configuration file properties and write the result to disk.
+      const fromConfigInput = parseUserConfig(
+        action.logger,
+        "`config` input",
+        inputs.configInput,
+        validateConfig,
+      );
      const fromConfigFile = await loadUserConfig(
        action,
        inputs.configFile,
@@ -1108,7 +1102,7 @@ export async function determineUserConfig(
      // the CLI or other CodeQL Action steps.
      const mergedConfig = mergeDefaultSetupAndUserConfigs(
        action.logger,
-        inputs.configInput,
+        fromConfigInput,
        fromConfigFile,
      );
      fs.writeFileSync(computedConfigPath, yaml.dump(mergedConfig));
@@ -1128,13 +1122,12 @@ export async function determineUserConfig(
        );
      }

-      // Write the `config` input to disk without merging it with a configuration file.
-      fs.writeFileSync(computedConfigPath, yaml.dump(inputs.configInput));
+      // Write the `config` input straight to disk.
+      fs.writeFileSync(computedConfigPath, inputs.configInput);
      inputs.configFile = computedConfigPath;
      action.logger.debug(
        `Using config from action input: ${inputs.configFile}`,
      );
-      return inputs.configInput;
    }
  }

@@ -1167,11 +1160,9 @@ export async function initConfig(
  const { logger, features } = actionState;
  const { tempDir } = inputs;

-  const repositoryRoot = await getGitRoot(inputs.sourceRoot);
-
  const userConfig = await determineUserConfig(actionState, tempDir, inputs);

-  const config = await initActionState(inputs, userConfig, repositoryRoot);
+  const config = await initActionState(inputs, userConfig);

  // If Code Quality analysis is the only enabled analysis kind, then we will initialise
  // the database for Code Quality. That entails disabling the default queries and only
@@ -1253,7 +1244,6 @@ export async function initConfig(
    inputs.codeql,
    inputs.features,
    config.languages,
-    repositoryRoot,
    inputs.sourceRoot,
    config.buildMode,
    inputs.ramInput,
@@ -1307,7 +1297,6 @@ export async function initConfig(
      inputs.codeql,
      config.languages,
      logger,
-      repositoryRoot,
    );
    config.trapCaches = trapCaches;
    config.trapCacheDownloadTime = trapCacheDownloadTime;
@@ -1399,86 +1388,31 @@ export function getPathToParsedConfigFile(tempDir: string): string {
  return path.join(tempDir, "config");
 }

-function getPathToFailedConfigFile(tempDir: string): string {
-  return path.join(tempDir, "failed-config");
-}
-
 /**
- * Writes {@link config} to {@link configFilePath}.
- *
- * This function is not intended to be called, other than by
- * {@link saveConfig} and {@link saveAbortedInitConfig} below.
+ * Store the given config to the path returned from getPathToParsedConfigFile.
 */
-function saveConfigFile(
-  logger: Logger,
-  configFilePath: string,
-  config: Partial<Config>,
-) {
+export async function saveConfig(config: Config, logger: Logger) {
  const configString = JSON.stringify(config);
-  fs.mkdirSync(path.dirname(configFilePath), { recursive: true });
-  fs.writeFileSync(configFilePath, configString, "utf8");
+  const configFile = getPathToParsedConfigFile(config.tempDir);
+  fs.mkdirSync(path.dirname(configFile), { recursive: true });
+  fs.writeFileSync(configFile, configString, "utf8");
  logger.debug("Saved config:");
  logger.debug(configString);
 }

 /**
- * Store the given config to the path returned from getPathToParsedConfigFile.
+ * Get the config that has been saved to the given temp dir.
+ * If the config could not be found then returns undefined.
 */
-export async function saveConfig(config: Config, logger: Logger) {
-  const configFile = getPathToParsedConfigFile(config.tempDir);
-  saveConfigFile(logger, configFile, config);
-}
-
-/**
- * Store parts of {@link config} as a failed configuration file.
- *
- * The file will only contain parts of {@link config} that are relevant to
- * the `init-post` step in the workflow.
- */
-export function saveAbortedInitConfig(
-  action: ActionState<["Base", "Logger"]>,
-  config: Config,
-) {
-  // Should only be called by init.
-  if (action.name !== ActionName.Init) {
-    throw new Error(
-      `Internal error: 'saveAbortedInitConfig' should only be called by '${ActionName.Init}', but was called by '${action.name}'.`,
-    );
-  }
-
-  // Create a copy of the input `Config` that only contains the keys we want.
-  const failedConfig: AbortedInitConfig = {
-    version: config.version,
-    tempDir: config.tempDir,
-    codeQLCmd: config.codeQLCmd,
-    debugMode: config.debugMode,
-    gitHubVersion: config.gitHubVersion,
-    languages: config.languages,
-    analysisKinds: config.analysisKinds,
-  };
-
-  action.logger.debug(`Saving config for failed init step.`);
-  saveConfigFile(
-    action.logger,
-    getPathToFailedConfigFile(config.tempDir),
-    failedConfig,
-  );
-}
-
-/**
- * Attempts to read a {@link Config} from {@link configFilePath}.
- *
- * This function is not intended to be called, other than by
- * {@link getConfig} and {@link getAbortedInitConfig} below.
- */
-function readConfigFile(
+export async function getConfig(
+  tempDir: string,
  logger: Logger,
-  configFilePath: string,
-): Config | undefined {
-  if (!fs.existsSync(configFilePath)) {
+): Promise<Config | undefined> {
+  const configFile = getPathToParsedConfigFile(tempDir);
+  if (!fs.existsSync(configFile)) {
    return undefined;
  }
-  const configString = fs.readFileSync(configFilePath, "utf8");
+  const configString = fs.readFileSync(configFile, "utf8");
  logger.debug("Loaded config:");
  logger.debug(configString);

@@ -1491,50 +1425,13 @@ function readConfigFile(
  }
  if (config.version !== getActionVersion()) {
    throw new ConfigurationError(
-      [
-        `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'.`,
-        "All steps in a workflow that use `github/codeql-action` must use the same version to work correctly.",
-        "If you are using Dependabot to manage dependency updates, you can configure a dependency group to update all `github/codeql-action` steps at the same time.",
-        "For more information, see https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--",
-      ].join(" "),
+      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`,
    );
  }

  return config as Config;
 }

-/**
- * Get the config that has been saved to the given temp dir.
- * If the config could not be found then returns undefined.
- */
-export async function getConfig(
-  tempDir: string,
-  logger: Logger,
-): Promise<Config | undefined> {
-  const configFile = getPathToParsedConfigFile(tempDir);
-  return readConfigFile(logger, configFile);
-}
-
-/**
- * Loads a {@link AbortedInitConfig} from a failed `init` step if it exists.
- *
- * The result will only contain parts of a {@link Config} that are relevant to
- * the `init-post` step in the workflow.
- */
-export function getAbortedInitConfig(
-  action: ActionState<["Base", "Logger"]>,
-  tempDir: string,
-): AbortedInitConfig | undefined {
-  // Only intended to be called by the `init-post` action.
-  if (action.name !== ActionName.InitPost) {
-    throw new Error(
-      `Internal error: 'getAbortedInitConfig' should only be called by '${ActionName.InitPost}', but was called by '${action.name}'.`,
-    );
-  }
-
-  return readConfigFile(action.logger, getPathToFailedConfigFile(tempDir));
-}
-
 /**
 * Generate a `qlconfig.yml` file from the `registries` input.
 * This file is used by the CodeQL CLI to list the registries to use for each
@@ -1725,27 +1622,21 @@ export function appendExtraQueryExclusions(
 /**
 * Returns `true` if Code Scanning analysis is enabled, or `false` if not.
 */
-export function isCodeScanningEnabled(
-  config: ActionConfig<"analysisKinds">,
-): boolean {
+export function isCodeScanningEnabled(config: Config): boolean {
  return config.analysisKinds.includes(AnalysisKind.CodeScanning);
 }

 /**
 * Returns `true` if Code Quality analysis is enabled, or `false` if not.
 */
-export function isCodeQualityEnabled(
-  config: ActionConfig<"analysisKinds">,
-): boolean {
+export function isCodeQualityEnabled(config: Config): boolean {
  return config.analysisKinds.includes(AnalysisKind.CodeQuality);
 }

 /**
 * Returns `true` if Code Scanning Risk Assessment analysis is enabled, or `false` if not.
 */
-export function isRiskAssessmentEnabled(
-  config: ActionConfig<"analysisKinds">,
-): boolean {
+export function isRiskAssessmentEnabled(config: Config): boolean {
  return config.analysisKinds.includes(AnalysisKind.RiskAssessment);
 }

--- a/src/config/action-config.ts
+++ b/src/config/action-config.ts
@@ -16,11 +16,6 @@ export interface Config {
   * The version of the CodeQL Action that the configuration is for.
   */
  version: string;
-  /**
-   * The path at which the repository being analysed is checked out at, if available.
-   * Persisted in the CodeQL Action configuration state, so that we can consult it in later workflow steps.
-   */
-  repositoryRoot: string | undefined;
  /**
   * Set of analysis kinds that are enabled.
   */
@@ -131,38 +126,3 @@ export interface Config {
   */
  enableFileCoverageInformation: boolean;
 }
-
-/** Properties available in `Config`. */
-export type ActionConfigProperties = keyof Config;
-
-/**
- * The CodeQL Action configuration state that is persisted
- * between steps of the CodeQL Action in a CodeQL workflow.
- *
- * By default, this is equivalent to `Config`. By explicitly
- * providing required property names for `T` this can be restricted
- * to requiring only those. For example, in `ActionConfig<"codeQLCmd">`
- * all properties except `codeqlCmd` are optional.
- */
-export type ActionConfig<
-  T extends ActionConfigProperties = ActionConfigProperties,
-> = Partial<Config> & Pick<Config, T>;
-
-/** Helper function to check whether `config` has `key` to narrow the type of `config`. */
-export function hasConfigKey<Key extends ActionConfigProperties>(
-  config: Partial<Config>,
-  key: Key,
-): config is ActionConfig<Key> {
-  return config[key] !== undefined;
-}
-
-/** A minimal configuration that we can make available even when `init` aborts. */
-export type AbortedInitConfig = ActionConfig<
-  | "version"
-  | "tempDir"
-  | "gitHubVersion"
-  | "debugMode"
-  | "languages"
-  | "analysisKinds"
-  | "codeQLCmd"
->;
--- a/Show More
+++ b/Show More