fix(ci): set up Java before Kotlin in PR checks

.editorconfig

@@ -8,6 +8,3 @@ trim_trailing_whitespace = true
 [*.ts]
 indent_style = space
 indent_size = 2
-
-[*.{yml,yaml}]
-indent_size = 2

.github/ISSUE_TEMPLATE/config.yml

@@ -2,4 +2,4 @@ blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
     url: https://support.github.com/request
-    about: Contact Support
+    about: Contact Support 

.github/actions/check-codescanning-config/action.yml

@@ -1,7 +1,7 @@
 name: Check Code-Scanning Config
 description: |
-  Checks the code scanning configuration file generated by the
-  action to ensure it contains the expected contents
+    Checks the code scanning configuration file generated by the
+    action to ensure it contains the expected contents
 inputs:
   languages:
     required: false
@@ -52,7 +52,7 @@ runs:
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/codescanning-config-cli-test
       env:
-        CODEQL_ACTION_TEST_MODE: "true"
+        CODEQL_ACTION_TEST_MODE: 'true'
 
     - name: Install dependencies
       shell: bash
@@ -62,7 +62,7 @@ runs:
       working-directory: ${{ github.action_path }}
       shell: bash
       env:
-        EXPECTED_CONFIG_FILE_CONTENTS: "${{ inputs.expected-config-file-contents }}"
+        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
       run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
     - name: Clean up
       shell: bash

.github/actions/prepare-test/action.yml

@@ -6,11 +6,11 @@ inputs:
     required: true
   use-all-platform-bundle:
     description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: "false"
+    default: 'false'
     required: false
   setup-kotlin:
     description: "If true, we setup kotlin"
-    default: "true"
+    default: 'true'
     required: true
 outputs:
   tools-url:
@@ -73,10 +73,7 @@ runs:
           exit 1
         fi
 
-    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
+    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
-        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
-        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
-        # version on the `ubuntu-latest` runners and CodeQL.
-        version: 2.1.20
+        version: 1.8.21

.github/actions/query-filter-test/action.yml

@@ -54,7 +54,7 @@ runs:
     - name: Check SARIF
       uses: ./../action/.github/actions/check-sarif
       with:
-        sarif-file: ${{ inputs.sarif-file }}
+        sarif-file:  ${{ inputs.sarif-file }}
         queries-run: ${{ inputs.queries-run}}
         queries-not-run: ${{ inputs.queries-not-run}}
     - name: Cleanup after test

.github/actions/release-branches/action.yml

@@ -1,11 +1,11 @@
-name: "Release branches"
-description: "Determine branches for release & backport"
+name: 'Release branches'
+description: 'Determine branches for release & backport'
 inputs:
   major_version:
-    description: "The version as extracted from the package.json file"
+    description: 'The version as extracted from the package.json file'
     required: true
   latest_tag:
-    description: "The most recent tag published to the repository"
+    description: 'The most recent tag published to the repository'
     required: true
 outputs:
   backport_source_branch:

.github/actions/release-initialise/action.yml

@@ -1,24 +1,25 @@
-name: "Prepare release job"
-description: "Prepare for updating a release branch"
+name: 'Prepare release job'
+description: 'Prepare for updating a release branch'
 
 runs:
   using: "composite"
   steps:
+
     - name: Dump environment
       run: env
       shell: bash
 
     - name: Dump GitHub context
       env:
-        GITHUB_CONTEXT: "${{ toJson(github) }}"
+        GITHUB_CONTEXT: '${{ toJson(github) }}'
       run: echo "$GITHUB_CONTEXT"
       shell: bash
 
     - name: Set up Node
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 24
-        cache: "npm"
+        cache: 'npm'
 
     - name: Install JavaScript dependencies
       shell: bash

.github/dependabot.yml

@@ -16,14 +16,6 @@ updates:
       # This might be fixed when we move to eslint v9.
       - dependency-name: "eslint-plugin-import"
         versions: [">=2.30.0"]
-
-      # Some of our dependencies are lagging behind with support for new versions of
-      # `undici` which is why we have to override it in `package.json`. Dependabot
-      # workflows fail when they try to update a dependency that is explicitly
-      # overriden. Since this happens somewhat routinely at the moment, we are
-      # excluding `undici` here and have to manually update it when needed.
-      - dependency-name: "undici"
-        versions: [">=7.30.1"]
     groups:
       npm-minor:
         patterns:
@@ -34,7 +26,7 @@ updates:
   - package-ecosystem: github-actions
     directories:
       - "/.github/workflows"
-      - "/.github/actions/*/"
+      - "/.github/actions"
     schedule:
       interval: weekly
     cooldown:

.github/workflows/__all-platform-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,24 +46,29 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   all-platform-bundle:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: All-platform bundle
     if: github.triggering_actor != 'dependabot[bot]'
@@ -79,13 +89,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "true"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'true'
+          setup-kotlin: 'true'
       - id: init
         uses: ./../action/init
         with:

.github/workflows/__analysis-kinds.yml

@@ -17,45 +17,55 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analysis-kinds-${{github.ref}}
+  group: analysis-kinds-${{github.ref}}-${{inputs.java-version}}
 jobs:
   analysis-kinds:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: code-scanning
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
             analysis-kinds: risk-assessment
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds
@@ -68,13 +78,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: javascript
@@ -82,16 +97,16 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
-          post-processed-sarif-path: "${{ runner.temp }}/post-processed"
+          post-processed-sarif-path: '${{ runner.temp }}/post-processed'
 
       - name: Upload SARIF files
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: "${{ runner.temp }}/results/*.sarif"
+          path: '${{ runner.temp }}/results/*.sarif'
           retention-days: 7
 
       - name: Upload post-processed SARIF
@@ -99,7 +114,7 @@ jobs:
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: "${{ runner.temp }}/post-processed"
+          path: '${{ runner.temp }}/post-processed'
           retention-days: 7
           if-no-files-found: error
 
@@ -107,16 +122,16 @@ jobs:
         if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
-          EXPECT_PRESENT: "false"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          EXPECT_PRESENT: 'false'
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
-          EXPECT_PRESENT: "true"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
+          EXPECT_PRESENT: 'true'
         with:
           script: ${{ env.CHECK_SCRIPT }}
     env:

.github/workflows/__analyze-ref-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,20 +46,25 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   analyze-ref-input:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'
@@ -75,13 +85,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -91,7 +106,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__autobuild-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -25,6 +25,11 @@ on:
         description: The version of .NET to install
         required: false
         default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -32,23 +37,28 @@ on:
         description: The version of .NET to install
         required: false
         default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}
+  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.java-version}}
 jobs:
   autobuild-action:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: autobuild-action
     if: github.triggering_actor != 'dependabot[bot]'
@@ -64,13 +74,18 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: csharp
@@ -78,12 +93,12 @@ jobs:
       - uses: ./../action/autobuild
         env:
           # Explicitly disable the CLR tracer.
-          COR_ENABLE_PROFILING: ""
-          COR_PROFILER: ""
-          COR_PROFILER_PATH_64: ""
-          CORECLR_ENABLE_PROFILING: ""
-          CORECLR_PROFILER: ""
-          CORECLR_PROFILER_PATH_64: ""
+          COR_ENABLE_PROFILING: ''
+          COR_PROFILER: ''
+          COR_PROFILER_PATH_64: ''
+          CORECLR_ENABLE_PROFILING: ''
+          CORECLR_PROFILER: ''
+          CORECLR_PROFILER_PATH_64: ''
       - uses: ./../action/analyze
       - name: Check database
         run: |

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
 defaults:
   run:
     shell: bash
@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     if: github.triggering_actor != 'dependabot[bot]'
@@ -72,8 +72,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__autobuild-working-dir.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-working-dir-${{github.ref}}
+  group: autobuild-working-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
   autobuild-working-dir:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Autobuild working directory
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__build-mode-autobuild.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: "17"
+        default: '17'
 defaults:
   run:
     shell: bash
@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Build mode autobuild
     if: github.triggering_actor != 'dependabot[bot]'
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -92,7 +92,7 @@ jobs:
         id: init
         with:
           build-mode: autobuild
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-manual.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,20 +46,25 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   build-mode-manual:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Build mode manual
     if: github.triggering_actor != 'dependabot[bot]'
@@ -75,18 +85,23 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
           build-mode: manual
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-none.yml

@@ -17,26 +17,36 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-none-${{github.ref}}
+  group: build-mode-none-${{github.ref}}-${{inputs.java-version}}
 jobs:
   build-mode-none:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Build mode none
     if: github.triggering_actor != 'dependabot[bot]'
@@ -48,18 +58,23 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
           build-mode: none
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-rollback.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-rollback-${{github.ref}}
+  group: build-mode-rollback-${{github.ref}}-${{inputs.java-version}}
 jobs:
   build-mode-rollback:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Build mode rollback
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -63,7 +78,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__bundle-from-nightly.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Bundle: From nightly"
+name: 'PR Check - Bundle: From nightly'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,26 +17,36 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-nightly-${{github.ref}}
+  group: bundle-from-nightly-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-from-nightly:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-    name: "Bundle: From nightly"
+    name: 'Bundle: From nightly'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - id: init
         uses: ./../action/init
         env:

.github/workflows/__bundle-from-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Bundle: From toolcache"
+name: 'PR Check - Bundle: From toolcache'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,26 +17,36 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-toolcache-${{github.ref}}
+  group: bundle-from-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-from-toolcache:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: toolcache
-    name: "Bundle: From toolcache"
+    name: 'Bundle: From toolcache'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -60,8 +75,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Check toolcache contains CodeQL
         continue-on-error: true
         run: |

.github/workflows/__bundle-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Bundle: Caching checks"
+name: 'PR Check - Bundle: Caching checks'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,30 +17,40 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-toolcache-${{github.ref}}
+  group: bundle-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-toolcache:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
-    name: "Bundle: Caching checks"
+    name: 'Bundle: Caching checks'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -64,8 +79,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cleanup-db-cluster-dir-${{github.ref}}
+  group: cleanup-db-cluster-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cleanup-db-cluster-dir:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Clean up database cluster directory
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Add a file to the database cluster directory
         run: |
           mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
@@ -62,7 +77,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__config-export.yml

@@ -17,26 +17,36 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-export-${{github.ref}}
+  group: config-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
   config-export:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Config export
     if: github.triggering_actor != 'dependabot[bot]'
@@ -48,13 +58,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: javascript
@@ -62,18 +77,18 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check config properties appear in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         with:
           script: |
             const fs = require('fs');

.github/workflows/__config-input.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-input-${{github.ref}}
+  group: config-input-${{github.ref}}-${{inputs.java-version}}
 jobs:
   config-input:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Config input
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -60,8 +75,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Copy queries into workspace
         run: |
           cp -a ../action/queries .

.github/workflows/__cpp-deptrace-disabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)"
+name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,30 +17,40 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-disabled-${{github.ref}}
+  group: cpp-deptrace-disabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-disabled:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "C/C++: disabling autoinstalling dependencies (Linux)"
+    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -50,13 +60,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +90,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)"
+name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,28 +17,38 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-on-macos-${{github.ref}}
+  group: cpp-deptrace-enabled-on-macos-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-enabled-on-macos:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "C/C++: autoinstalling dependencies is skipped (macOS)"
+    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -48,13 +58,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +90,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - C/C++: autoinstalling dependencies (Linux)"
+name: 'PR Check - C/C++: autoinstalling dependencies (Linux)'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,30 +17,40 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-${{github.ref}}
+  group: cpp-deptrace-enabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-enabled:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "C/C++: autoinstalling dependencies (Linux)"
+    name: 'C/C++: autoinstalling dependencies (Linux)'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -50,13 +60,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +90,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__diagnostics-export.yml

@@ -17,26 +17,36 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-export-${{github.ref}}
+  group: diagnostics-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
   diagnostics-export:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Diagnostic export
     if: github.triggering_actor != 'dependabot[bot]'
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -62,8 +77,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -82,18 +97,18 @@ jobs:
             --ready-for-status-page
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
 
       - name: Check diagnostics appear in SARIF
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         run: |
           cd ../action
           npx tsx ./pr-checks/check-diagnostics.ts

.github/workflows/__diagnostics-without-db.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-without-db-${{github.ref}}
+  group: diagnostics-without-db-${{github.ref}}-${{inputs.java-version}}
 jobs:
   diagnostics-without-db:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Diagnostic export without database
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,6 +63,11 @@ jobs:
       #
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -67,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Initialise failing analysis
         id: init
         uses: ./../action/init
@@ -87,11 +102,11 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: "/test-codeql-version:${{ matrix.version }}"
+          category: '/test-codeql-version:${{ matrix.version }}'
 
       - name: Check diagnostics appear on disk
         env:
-          DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
+          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
         run: |
           cd ../action
           npx tsx ./pr-checks/diagnostics-without-db.ts
@@ -108,7 +123,7 @@ jobs:
       contents: read
       security-events: read
     timeout-minutes: 5
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -122,7 +137,7 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Download workflow artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: test-mode-sarif-*
           path: sarif

.github/workflows/__export-file-baseline-information.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,24 +46,29 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   export-file-baseline-information:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-          - os: windows-2025
+          - os: windows-latest
             version: nightly-latest
     name: Export file baseline information
     if: github.triggering_actor != 'dependabot[bot]'
@@ -79,13 +89,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -100,12 +115,12 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__extractor-ram-threads.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: extractor-ram-threads-${{github.ref}}
+  group: extractor-ram-threads-${{github.ref}}-${{inputs.java-version}}
 jobs:
   extractor-ram-threads:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Extractor ram and threads options test
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: java

.github/workflows/__global-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Proxy test
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "false"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'false'
       - name: Block direct internet access to force proxy usage
         run: |
           apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1

.github/workflows/__go-custom-queries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: Custom queries"
+name: 'PR Check - Go: Custom queries'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,24 +46,29 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-custom-queries:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Go: Custom queries"
+    name: 'Go: Custom queries'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -77,13 +87,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -93,5 +108,5 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: diagnostic when Go is changed after init step"
+name: 'PR Check - Go: diagnostic when Go is changed after init step'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,36 +17,46 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround-diagnostic:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-    name: "Go: diagnostic when Go is changed after init step"
+    name: 'Go: diagnostic when Go is changed after init step'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -61,13 +71,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -75,17 +90,17 @@ jobs:
       # Deliberately change Go after the `init` step
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.20"
+          go-version: '1.20'
       - name: Build code
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: diagnostic when `file` is not installed"
+name: 'PR Check - Go: diagnostic when `file` is not installed'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,36 +17,46 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround-no-file-program:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-    name: "Go: diagnostic when `file` is not installed"
+    name: 'Go: diagnostic when `file` is not installed'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -61,13 +71,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Remove `file` program
         run: |
           echo $(which file)
@@ -81,12 +96,12 @@ jobs:
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
+          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: workaround for indirect tracing"
+name: 'PR Check - Go: workaround for indirect tracing'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,36 +17,46 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-    name: "Go: workaround for indirect tracing"
+    name: 'Go: workaround for indirect tracing'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -61,13 +71,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: tracing with autobuilder step"
+name: 'PR Check - Go: tracing with autobuilder step'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,56 +17,66 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-autobuilder:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "Go: tracing with autobuilder step"
+    name: 'Go: tracing with autobuilder step'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -81,13 +91,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -106,5 +121,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: tracing with custom build steps"
+name: 'PR Check - Go: tracing with custom build steps'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,56 +17,66 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-custom-build-steps:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "Go: tracing with custom build steps"
+    name: 'Go: tracing with custom build steps'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -81,13 +91,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Go: tracing with legacy workflow"
+name: 'PR Check - Go: tracing with legacy workflow'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,56 +17,66 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-legacy-workflow:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
-    name: "Go: tracing with legacy workflow"
+    name: 'Go: tracing with legacy workflow'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -81,13 +91,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go
@@ -100,5 +115,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go.yml

@@ -19,10 +19,15 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 jobs:
   go-custom-queries:
-    name: "Go: Custom queries"
+    name: 'Go: Custom queries'
     permissions:
       contents: read
       security-events: read
@@ -30,51 +35,58 @@ jobs:
     with:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround-diagnostic:
-    name: "Go: diagnostic when Go is changed after init step"
+    name: 'Go: diagnostic when Go is changed after init step'
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround-no-file-program:
-    name: "Go: diagnostic when `file` is not installed"
+    name: 'Go: diagnostic when `file` is not installed'
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround:
-    name: "Go: workaround for indirect tracing"
+    name: 'Go: workaround for indirect tracing'
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-autobuilder:
-    name: "Go: tracing with autobuilder step"
+    name: 'Go: tracing with autobuilder step'
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/__go-tracing-autobuilder.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-custom-build-steps:
-    name: "Go: tracing with custom build steps"
+    name: 'Go: tracing with custom build steps'
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-legacy-workflow:
-    name: "Go: tracing with legacy workflow"
+    name: 'Go: tracing with legacy workflow'
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}

.github/workflows/__init-with-registries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Download using registries"
+name: 'PR Check - Packaging: Download using registries'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,30 +17,40 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: init-with-registries-${{github.ref}}
+  group: init-with-registries-${{github.ref}}-${{inputs.java-version}}
 jobs:
   init-with-registries:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Download using registries"
+    name: 'Packaging: Download using registries'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -50,17 +60,22 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Init with registries
         uses: ./../action/init
         with:
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: ./.github/codeql/codeql-config-registries.yml
           languages: javascript

.github/workflows/__javascript-source-root.yml

@@ -17,28 +17,38 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: javascript-source-root-${{github.ref}}
+  group: javascript-source-root-${{github.ref}}-${{inputs.java-version}}
 jobs:
   javascript-source-root:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Custom source root
     if: github.triggering_actor != 'dependabot[bot]'
@@ -50,13 +60,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Move codeql-action
         run: |
           mkdir ../new-source-root

.github/workflows/__job-run-uuid-sarif.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: job-run-uuid-sarif-${{github.ref}}
+  group: job-run-uuid-sarif-${{github.ref}}-${{inputs.java-version}}
 jobs:
   job-run-uuid-sarif:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Job run UUID added to SARIF
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -60,12 +75,12 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: "${{ runner.temp }}/results/javascript.sarif"
+          path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__language-aliases.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: language-aliases-${{github.ref}}
+  group: language-aliases-${{github.ref}}-${{inputs.java-version}}
 jobs:
   language-aliases:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Language aliases
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,19 +56,24 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: C#,java-kotlin,typescript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: "Check languages"
+      - name: 'Check languages'
         run: |
           expected_languages="csharp,java,javascript"
           actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

.github/workflows/__linux-arm64.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,13 +46,18 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   linux-arm64:
     strategy:
@@ -75,13 +85,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: ${{ env.LANGUAGES }}

.github/workflows/__local-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,20 +46,25 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   local-bundle:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Local CodeQL bundle
     if: github.triggering_actor != 'dependabot[bot]'
@@ -75,13 +85,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst

.github/workflows/__multi-language-autodetect.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,54 +46,59 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   multi-language-autodetect:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.21.4
           - os: macos-15-xlarge
             version: stable-v2.21.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.4
           - os: macos-15-xlarge
             version: stable-v2.22.4
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.23.9
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.23.9
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.24.3
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.24.3
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.25.6
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.25.6
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
     name: Multi-language repository
     if: github.triggering_actor != 'dependabot[bot]'
@@ -109,21 +119,26 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Install Python 3.13.15 for older CLI versions
         # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
         # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.13.15"
+          python-version: '3.13.15'
 
       - name: Use Xcode 16
         # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
@@ -133,7 +148,7 @@ jobs:
       - uses: ./../action/init
         id: init
         with:
-          db-location: "${{ runner.temp }}/customDbLocation"
+          db-location: '${{ runner.temp }}/customDbLocation'
           languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__overlay-init-fallback.yml

@@ -17,26 +17,36 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: overlay-init-fallback-${{github.ref}}
+  group: overlay-init-fallback-${{github.ref}}-${{inputs.java-version}}
 jobs:
   overlay-init-fallback:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Overlay database init fallback
     if: github.triggering_actor != 'dependabot[bot]'
@@ -48,13 +58,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: actions # Any language without overlay support will do

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Config and input passed to the CLI"
+name: 'PR Check - Packaging: Config and input passed to the CLI'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,26 +46,31 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-codescanning-config-inputs-js:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Config and input passed to the CLI"
+    name: 'Packaging: Config and input passed to the CLI'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -93,11 +108,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging3.yml"
+          config-file: '.github/codeql/codeql-config-packaging3.yml'
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +120,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Config and input"
+name: 'PR Check - Packaging: Config and input'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,26 +46,31 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-config-inputs-js:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Config and input"
+    name: 'Packaging: Config and input'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -93,11 +108,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging3.yml"
+          config-file: '.github/codeql/codeql-config-packaging3.yml'
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +120,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Config file"
+name: 'PR Check - Packaging: Config file'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,26 +46,31 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-config-js:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Config file"
+    name: 'Packaging: Config file'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -93,18 +108,18 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging.yml"
+          config-file: '.github/codeql/codeql-config-packaging.yml'
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: "PR Check - Packaging: Action input"
+name: 'PR Check - Packaging: Action input'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,26 +46,31 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-inputs-js:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-    name: "Packaging: Action input"
+    name: 'Packaging: Action input'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -93,11 +108,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging2.yml"
+          config-file: '.github/codeql/codeql-config-packaging2.yml'
           languages: javascript
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +120,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
 
       - name: Check results
         uses: ./../action/.github/actions/check-sarif

.github/workflows/__per-language-bundle-validation.yml

@@ -17,17 +17,27 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}
+  group: per-language-bundle-validation-${{github.ref}}-${{inputs.java-version}}
 jobs:
   per-language-bundle-validation:
     strategy:
@@ -35,40 +45,40 @@ jobs:
       matrix:
         include:
           - language: actions
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             expected-extractors: actions javascript
           - language: cpp
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: manual
             build-command: gcc -o main main.c
           - language: csharp
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: none
           - language: go
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: autobuild
           - language: java
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
             build-mode: none
           - language: javascript
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: python
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: ruby
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: rust
-            os: ubuntu-26.04
+            os: ubuntu-latest
             version: linked
           - language: swift
-            os: macos-26-xlarge
+            os: macos-latest-xlarge
             version: linked
             build-mode: autobuild
     name: Per-language bundles
@@ -81,6 +91,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -95,8 +110,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action

.github/workflows/__remote-config.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,22 +46,27 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   remote-config:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Remote config file
     if: github.triggering_actor != 'dependabot[bot]'
@@ -77,13 +87,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__resolve-environment-action.yml

@@ -17,28 +17,38 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: resolve-environment-action-${{github.ref}}
+  group: resolve-environment-action-${{github.ref}}-${{inputs.java-version}}
 jobs:
   resolve-environment-action:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Resolve environment
     if: github.triggering_actor != 'dependabot[bot]'
@@ -50,13 +60,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: go,javascript-typescript

.github/workflows/__rubocop-multi-language.yml

@@ -0,0 +1,89 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - RuboCop multi-language
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+  workflow_call:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: rubocop-multi-language-${{github.ref}}-${{inputs.java-version}}
+jobs:
+  rubocop-multi-language:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: RuboCop multi-language
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        with:
+          ruby-version: 2.6
+      - name: Install Code Scanning integration
+        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+      - name: Install dependencies
+        run: bundle install
+      - name: RuboCop run
+        run: |
+          bash -c "
+            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+            [[ $? -ne 2 ]]
+          "
+      - uses: ./../action/upload-sarif
+        with:
+          sarif_file: rubocop.sarif
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__ruby.yml

@@ -17,34 +17,44 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ruby-${{github.ref}}
+  group: ruby-${{github.ref}}-${{inputs.java-version}}
 jobs:
   ruby:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: macos-26
+          - os: macos-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
     name: Ruby analysis
     if: github.triggering_actor != 'dependabot[bot]'
@@ -56,13 +66,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: ruby

.github/workflows/__rust.yml

@@ -17,32 +17,42 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rust-${{github.ref}}
+  group: rust-${{github.ref}}-${{inputs.java-version}}
 jobs:
   rust:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: stable-v2.22.1
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Rust analysis
     if: github.triggering_actor != 'dependabot[bot]'
@@ -54,13 +64,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           languages: rust

.github/workflows/__split-workflow.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,30 +46,35 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   split-workflow:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: macos-26
+          - os: macos-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-26
+          - os: macos-latest
             version: nightly-latest
     name: Split workflow
     if: github.triggering_actor != 'dependabot[bot]'
@@ -85,16 +95,21 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
-          config-file: ".github/codeql/codeql-config-packaging3.yml"
+          config-file: '.github/codeql/codeql-config-packaging3.yml'
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +118,7 @@ jobs:
       - uses: ./../action/analyze
         with:
           skip-queries: true
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
 
       - name: Assert No Results
@@ -114,7 +129,7 @@ jobs:
           fi
       - uses: ./../action/analyze
         with:
-          output: "${{ runner.temp }}/results"
+          output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Assert Results
         run: |

.github/workflows/__start-proxy.yml

@@ -17,28 +17,38 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: start-proxy-${{github.ref}}
+  group: start-proxy-${{github.ref}}-${{inputs.java-version}}
 jobs:
   start-proxy:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: macos-26
+          - os: macos-latest
             version: linked
-          - os: windows-2025
+          - os: windows-latest
             version: linked
     name: Start proxy
     if: github.triggering_actor != 'dependabot[bot]'
@@ -50,13 +60,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Setup proxy for registries
         id: proxy
         uses: ./../action/start-proxy
@@ -101,5 +116,5 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
     env:
-      CODEQL_ACTION_PROXY_API_REQUESTS: "true"
+      CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__submit-sarif-failure.yml

@@ -17,28 +17,38 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: submit-sarif-failure-${{github.ref}}
+  group: submit-sarif-failure-${{github.ref}}-${{inputs.java-version}}
 jobs:
   submit-sarif-failure:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Submit SARIF after failure
     if: github.triggering_actor != 'dependabot[bot]'
@@ -50,13 +60,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./init
         with:
@@ -76,7 +91,7 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: "/test-codeql-version:${{ matrix.version }}"
+          category: '/test-codeql-version:${{ matrix.version }}'
     env:
       CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
       CODEQL_ACTION_UPLOAD_FAILED_SARIF: true

.github/workflows/__swift-autobuild.yml

@@ -17,24 +17,34 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-autobuild-${{github.ref}}
+  group: swift-autobuild-${{github.ref}}-${{inputs.java-version}}
 jobs:
   swift-autobuild:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
     name: Swift analysis using autobuild
     if: github.triggering_actor != 'dependabot[bot]'
@@ -46,13 +56,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__swift-custom-build.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,24 +46,29 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   swift-custom-build:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: linked
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: default
-          - os: macos-26-xlarge
+          - os: macos-latest-xlarge
             version: nightly-latest
     name: Swift analysis using a custom build command
     if: github.triggering_actor != 'dependabot[bot]'
@@ -79,13 +89,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:
@@ -107,5 +122,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__unset-environment.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,22 +46,27 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   unset-environment:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: nightly-latest
     name: Test unsetting environment variables
     if: github.triggering_actor != 'dependabot[bot]'
@@ -77,13 +87,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__unsupported-macos.yml

@@ -1,135 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Unsupported macOS
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: "0 5 * * *"
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unsupported-macos-${{github.ref}}
-jobs:
-  unsupported-macos:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: xcode-27
-            version: linked
-          - os: xcode-27
-            version: nightly-latest
-    name: Unsupported macOS
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
-      - name: Install dependencies
-        run: npm ci
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
-      - name: Check xcode_select_link
-        run: |
-          readlink /private/var/db/xcode_select_link
-          file -h /private/var/db/xcode_select_link
-
-      - uses: ./../action/init
-        id: init
-        continue-on-error: true
-        env:
-          CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
-          CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
-        with:
-          languages: swift
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Analyze
-        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
-        # can't cope with that unless we introduce a different testing environment. Since this step
-        # would just fail on `xcode-27` anyway, we just skip it instead.
-        if: false
-        uses: ./analyze
-        with:
-          category: "/test-codeql-version:${{ matrix.version }}"
-    env:
-      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
-      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
-      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
-      CODEQL_ACTION_TEST_MODE: true
-  unsupported-macos-sarif-checks:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs:
-      - unsupported-macos
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 5
-    runs-on: ubuntu-26.04
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
-      - name: Install dependencies
-        run: npm ci
-      - name: Download workflow artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          pattern: test-mode-sarif-*
-          path: sarif
-
-      - name: List artifact contents
-        run: ls -laR ./sarif
-
-      - name: Check diagnostics appear in SARIF
-        env:
-          SARIF_PATH: "./sarif/"
-          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
-          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
-          EXPECTED_LOCATIONS: "0"
-          EXPECTED_MESSAGE: |
-            Traced analysis is not supported on macOS 27 or above.
-        run: npx tsx ./pr-checks/check-diagnostics.ts
-    env:
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,20 +46,25 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   upload-ref-sha-input:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'
@@ -75,13 +85,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -92,12 +107,12 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           upload: never
       - uses: ./../action/upload-sarif
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,26 +46,31 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   upload-sarif:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
             analysis-kinds: code-scanning
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
             analysis-kinds: code-quality
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`
@@ -82,13 +92,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -99,8 +114,8 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           upload: never
           output: ${{ runner.temp }}/results
 
@@ -109,15 +124,15 @@ jobs:
         uses: ./../action/upload-sarif
         id: upload-sarif
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
-      - name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
+      - name: 'Fail for missing output from `upload-sarif` step for `code-scanning`'
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
-      - name: "Fail for missing output from `upload-sarif` step for `code-quality`"
+      - name: 'Fail for missing output from `upload-sarif` step for `code-quality`'
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -126,12 +141,12 @@ jobs:
         id: upload-single-sarif-code-scanning
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results/javascript.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
-      - name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
+      - name: 'Fail for missing output from `upload-single-sarif-code-scanning` step'
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
         run: exit 1
       - name: Upload single SARIF file for Code Quality
@@ -139,12 +154,12 @@ jobs:
         id: upload-single-sarif-code-quality
         if: contains(matrix.analysis-kinds, 'code-quality')
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
-      - name: "Fail for missing output from `upload-single-sarif-code-quality` step"
+      - name: 'Fail for missing output from `upload-single-sarif-code-quality` step'
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -156,12 +171,12 @@ jobs:
         id: upload-single-non-sarif
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: "refs/heads/main"
-          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
+          ref: 'refs/heads/main'
+          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
           sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
-      - name: "Fail for missing output from `upload-single-non-sarif` step"
+      - name: 'Fail for missing output from `upload-single-non-sarif` step'
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
     env:

.github/workflows/__with-checkout-path.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,12 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,20 +46,25 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: ">=1.21.0"
+        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   with-checkout-path:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
+          - os: ubuntu-latest
             version: linked
     name: Use a custom `checkout_path`
     if: github.triggering_actor != 'dependabot[bot]'
@@ -76,13 +86,18 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: "false"
-          setup-kotlin: "true"
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.

.github/workflows/codeql.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Sunday.
-    - cron: "30 1 * * 0"
+    - cron: '30 1 * * 0'
   workflow_dispatch:
 
 defaults:
@@ -22,7 +22,7 @@ jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
   check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     outputs:
       versions: ${{ steps.compare.outputs.versions }}
 
@@ -32,41 +32,41 @@ jobs:
       security-events: read
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up default CodeQL bundle
-        id: setup-default
-        uses: ./setup-codeql
-      - name: Set up linked CodeQL bundle
-        id: setup-linked
-        uses: ./setup-codeql
-        with:
-          tools: linked
-      - name: Compare default and linked CodeQL bundle versions
-        id: compare
-        env:
-          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-        run: |
-          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Set up default CodeQL bundle
+      id: setup-default
+      uses: ./setup-codeql
+    - name: Set up linked CodeQL bundle
+      id: setup-linked
+      uses: ./setup-codeql
+      with:
+        tools: linked
+    - name: Compare default and linked CodeQL bundle versions
+      id: compare
+      env:
+        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+      run: |
+        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
 
-          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-          # required status check.
-          #
-          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-          # the same as running with `tools: null`.
-          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-            VERSIONS_JSON='[null]'
-          else
-            VERSIONS_JSON='[null, "linked"]'
-          fi
+        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+        # required status check.
+        #
+        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+        # the same as running with `tools: null`.
+        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+          VERSIONS_JSON='[null]'
+        else
+          VERSIONS_JSON='[null, "linked"]'
+        fi
 
-          # Output a JSON-encoded list with the distinct versions to test against.
-          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+        # Output a JSON-encoded list with the distinct versions to test against.
+        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
 
   analyze-javascript:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -74,13 +74,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-22.04
-          - ubuntu-24.04
-          - windows-2022
-          - windows-2025
-          - macos-14-xlarge
-          - macos-15-xlarge
+        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
         tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
     runs-on: ${{ matrix.os }}
 
@@ -89,30 +83,30 @@ jobs:
       security-events: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: ./init
-        id: init
-        with:
-          languages: javascript
-          config-file: ./.github/codeql/codeql-config-javascript.yml
-          tools: ${{ matrix.tools }}
-      # confirm steps.init.outputs.codeql-path points to the codeql binary
-      - name: Print CodeQL Version
-        run: >
-          "$CODEQL" version --format=json
-        env:
-          CODEQL: ${{steps.init.outputs.codeql-path}}
-      - name: Perform CodeQL Analysis
-        uses: ./analyze
-        with:
-          category: "/language:javascript"
-          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Initialize CodeQL
+      uses: ./init
+      id: init
+      with:
+        languages: javascript
+        config-file: ./.github/codeql/codeql-config-javascript.yml
+        tools: ${{ matrix.tools }}
+    # confirm steps.init.outputs.codeql-path points to the codeql binary
+    - name: Print CodeQL Version
+      run: >
+        "$CODEQL" version --format=json
+      env:
+        CODEQL: ${{steps.init.outputs.codeql-path}}
+    - name: Perform CodeQL Analysis
+      uses: ./analyze
+      with:
+        category: "/language:javascript"
+        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
@@ -125,21 +119,21 @@ jobs:
       security-events: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Initialize CodeQL
-        uses: ./init
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: none
-          config: >
-            paths-ignore:
-              - lib
-              - tests
-            queries:
-              - uses: security-and-quality
-      - name: Perform CodeQL Analysis
-        uses: ./analyze
-        with:
-          category: "/language:${{ matrix.language }}"
-          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Initialize CodeQL
+      uses: ./init
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: none
+        config: >
+          paths-ignore:
+            - lib
+            - tests
+          queries:
+            - uses: security-and-quality
+    - name: Perform CodeQL Analysis
+      uses: ./analyze
+      with:
+        category: "/language:${{ matrix.language }}"
+        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}

.github/workflows/codescanning-config-cli.yml

@@ -10,13 +10,13 @@ env:
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -41,187 +41,187 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
-            version: linked
-          - os: ubuntu-26.04
-            version: default
-          - os: ubuntu-26.04
-            version: nightly-latest
+        - os: ubuntu-latest
+          version: linked
+        - os: ubuntu-latest
+          version: default
+        - os: ubuntu-latest
+          version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
     name: Code Scanning Configuration tests
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Check out repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24
-          cache: "npm"
+    - name: Set up Node.js
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+        cache: 'npm'
 
-      - name: Install dependencies
-        run: npm ci
+    - name: Install dependencies
+      run: npm ci
 
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: ${{ matrix.version }}
 
-      - name: Empty file
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: "{}"
-          # Request multiple languages so later checks can reuse the combined bundle.
-          languages: javascript,python
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Empty file
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: "{}"
+        # Request multiple languages so later checks can reuse the combined bundle.
+        languages: javascript,python
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Packs from input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+    - name: Packs from input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+          }
+        languages: javascript
+        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Packs from input with +
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+          }
+        languages: javascript
+        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries from input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+          }
+        languages: javascript
+        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries from input with +
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+          }
+        languages: javascript
+        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries and packs from input with +
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+          }
+        languages: javascript
+        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+    - name: Queries and packs from config
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
+            "packs": {
+              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
             }
-          languages: javascript
-          packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          }
+        languages: javascript
+        config-file-test: .github/codeql/queries-and-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Packs from input with +
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-            }
-          languages: javascript
-          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Queries and packs from config overriden by input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+            "packs": ["codeql/javascript-queries"]
+          }
+        languages: javascript
+        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        packs: codeql/javascript-queries
+        config-file-test: .github/codeql/queries-and-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Queries from input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-            }
-          languages: javascript
-          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Queries and packs from config merging with input
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": {
+              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
+            },
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+            ]
+          }
+        languages: javascript
+        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+        packs: + codeql/javascript-queries
+        config-file-test: .github/codeql/queries-and-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Queries from input with +
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-            }
-          languages: javascript
-          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Multi-language packs from config
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "packs": {
+              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
+              "ruby": ["codeql/ruby-queries"]
+            },
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+            ]
+          }
+        languages: javascript,ruby
+        config-file-test: .github/codeql/multi-language-packs-config.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Queries and packs from input with +
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-            }
-          languages: javascript
-          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Queries and packs from config
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-              "packs": {
-                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-              }
-            }
-          languages: javascript
-          config-file-test: .github/codeql/queries-and-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Queries and packs from config overriden by input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-              "packs": ["codeql/javascript-queries"]
-            }
-          languages: javascript
-          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          packs: codeql/javascript-queries
-          config-file-test: .github/codeql/queries-and-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Queries and packs from config merging with input
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": {
-                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-              },
-              "queries": [
-                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-              ]
-            }
-          languages: javascript
-          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-          packs: + codeql/javascript-queries
-          config-file-test: .github/codeql/queries-and-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Multi-language packs from config
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "packs": {
-                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-                "ruby": ["codeql/ruby-queries"]
-              },
-              "queries": [
-                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-              ]
-            }
-          languages: javascript,ruby
-          config-file-test: .github/codeql/multi-language-packs-config.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Other config properties
-        if: success() || failure()
-        uses: ./../action/.github/actions/check-codescanning-config
-        with:
-          expected-config-file-contents: |
-            {
-              "name": "Config using all properties",
-              "packs": ["codeql/javascript-queries" ],
-              "disable-default-queries": true,
-              "paths-ignore": ["xxx"],
-              "paths": ["yyy"]
-            }
-          languages: javascript
-          packs: + codeql/javascript-queries
-          config-file-test: .github/codeql/other-config-properties.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Other config properties
+      if: success() || failure()
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "name": "Config using all properties",
+            "packs": ["codeql/javascript-queries" ],
+            "disable-default-queries": true,
+            "paths-ignore": ["xxx"],
+            "paths": ["yyy"]
+          }
+        languages: javascript
+        packs: + codeql/javascript-queries
+        config-file-test: .github/codeql/other-config-properties.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/debug-artifacts-failure-safe.yml

@@ -6,13 +6,13 @@ env:
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -30,10 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - stable-v2.20.7
-          - default
-          - linked
-          - nightly-latest
+        - stable-v2.20.7
+        - default
+        - linked
+        - nightly-latest
     name: Upload debug artifacts after failure in analyze
     continue-on-error: true
     env:
@@ -43,12 +43,7 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
-
-    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
-    # We could install that older version on the newer runners, or use the older runner.
-    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
-
+    runs-on: ubuntu-latest
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
@@ -65,7 +60,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: "9.x"
+          dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
@@ -91,13 +86,12 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       - name: Check expected artifacts exist
         run: |
-          VERSIONS="stable-v2.20.7 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             echo "Artifacts from version $version:"

.github/workflows/debug-artifacts-safe.yml

@@ -5,13 +5,13 @@ env:
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -29,10 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - stable-v2.20.7
-          - default
-          - linked
-          - nightly-latest
+        - stable-v2.20.7
+        - default
+        - linked
+        - nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -41,12 +41,7 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-
-    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
-    # We could install that older version on the newer runners, or use the older runner.
-    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
-
+    runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -61,7 +56,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: "9.x"
+          dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
@@ -84,7 +79,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/deflake.yml

@@ -60,6 +60,7 @@ on:
       - "PR Check - Proxy test"
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
+      - "PR Check - RuboCop multi-language"
       - "PR Check - Ruby analysis"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"

.github/workflows/post-release-mergeback.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       baseBranch:
-        description: "The base branch to merge into"
+        description: 'The base branch to merge into'
         default: main
         required: false
 
@@ -24,7 +24,7 @@ defaults:
 
 jobs:
   merge-back:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     environment: Automation
     if: github.repository == 'github/codeql-action'
     env:
@@ -41,16 +41,16 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: "${{ toJson(github) }}"
+          GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "${GITHUB_CONTEXT}"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0 # ensure we have all tags and can push commits
+          fetch-depth: 0  # ensure we have all tags and can push commits
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install JavaScript dependencies
         run: npm ci

.github/workflows/pr-checks.yml

@@ -25,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-26.04, macos-26, windows-2025]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         node-version: [20, 24]
     permissions:
       contents: read
@@ -64,14 +64,14 @@ jobs:
           npm ci
 
       - name: Verify compiled JS up to date
-        run: npx tsx pr-checks/check-unchanged.ts --language javascript
+        run: .github/workflows/script/check-js.sh
 
       - name: Run unit tests
         if: always()
         run: npm test
 
       - name: Lint
-        if: always() && matrix.os != 'windows-2025'
+        if: always() && matrix.os != 'windows-latest'
         run: npm run lint-ci
 
       - name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
         # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
         # rather than the event. The same results are uploaded by the `pull_request` run and again
         # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -93,7 +93,7 @@ jobs:
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     concurrency:
@@ -122,22 +122,14 @@ jobs:
         id: install-deps
         run: npm ci
 
-      - name: Verify YAML is correctly formatted
-        run: npx tsx pr-checks/check-unchanged.ts --language yaml
-
       - name: Verify PR checks up to date
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
 
-      - name: Typecheck pr-checks scripts
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
-        working-directory: pr-checks
-        run: npm run typecheck
-
       - name: Run pr-checks tests
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         working-directory: pr-checks
-        run: npm run test
+        run: npx tsx --test
 
       - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}

.github/workflows/pr-dequeued.yml

@@ -21,23 +21,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REASON: ${{ github.event.reason }}
+          USER: ${{ github.event.pull_request.user.login }}
         run: |
-          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
-          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
-          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
-          enqueuer=$(gh api graphql \
-            -F number="$PR_NUMBER" \
-            -f query='
-              query($number: Int!) {
-                repository(owner: "github", name: "codeql-action") {
-                  pullRequest(number: $number) {
-                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
-                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
-                    }
-                  }
-                }
-              }' \
-            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
-          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
+          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
             "Please resolve any issues if required and enqueue the PR again." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

.github/workflows/prepare-release.yml

@@ -29,7 +29,7 @@ defaults:
 jobs:
   prepare:
     name: "Release info"
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     if: github.repository == 'github/codeql-action'
 
     permissions:

.github/workflows/publish-immutable-action.yml

@@ -1,10 +1,10 @@
-name: "Publish Immutable Action Version"
+name: 'Publish Immutable Action Version'
 
 on:
   push:
     tags:
       # Match version tags, but not the major version tags.
-      - "v[0-9]+.**"
+      - 'v[0-9]+.**'
 
 defaults:
   run:

.github/workflows/python312-windows.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Monday.
-    - cron: "0 0 * * 1"
+    - cron: '0 0 * * 1'
   workflow_dispatch:
 
 concurrency:
@@ -29,25 +29,25 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: windows-2025
+    runs-on: windows-latest
 
     steps:
-      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
-        with:
-          python-version: 3.12
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      with:
+        python-version: 3.12
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Prepare test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: default
+    - name: Prepare test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: default
 
-      - name: Initialize CodeQL
-        uses: ./../action/init
-        with:
-          tools: linked
-          languages: python
+    - name: Initialize CodeQL
+      uses: ./../action/init
+      with:
+        tools: linked
+        languages: python
 
-      - name: Analyze
-        uses: ./../action/analyze
+    - name: Analyze
+      uses: ./../action/analyze

.github/workflows/query-filters.yml

@@ -3,13 +3,13 @@ name: Query filters tests
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -25,51 +25,51 @@ jobs:
     name: Query Filters Tests
     if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Check out repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24
-          cache: npm
+    - name: Install Node.js
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+        cache: npm
 
-      - name: Install dependencies
-        run: npm ci
+    - name: Install dependencies
+      run: npm ci
 
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: linked
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: linked
 
-      - name: Check SARIF for default queries with Single include, Single exclude
-        uses: ./../action/.github/actions/query-filter-test
-        with:
-          sarif-file: ${{ runner.temp }}/results/javascript.sarif
-          queries-run: js/zipslip
-          queries-not-run: js/path-injection
-          config-file: ./.github/codeql/codeql-config-query-filters1.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Check SARIF for default queries with Single include, Single exclude
+      uses: ./../action/.github/actions/query-filter-test
+      with:
+        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/zipslip
+        queries-not-run: js/path-injection
+        config-file: ./.github/codeql/codeql-config-query-filters1.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Check SARIF for query packs with Single include, Single exclude
-        uses: ./../action/.github/actions/query-filter-test
-        with:
-          sarif-file: ${{ runner.temp }}/results/javascript.sarif
-          queries-run: js/zipslip,javascript/example/empty-or-one-block
-          queries-not-run: js/path-injection
-          config-file: ./.github/codeql/codeql-config-query-filters2.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Check SARIF for query packs with Single include, Single exclude
+      uses: ./../action/.github/actions/query-filter-test
+      with:
+        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/zipslip,javascript/example/empty-or-one-block
+        queries-not-run: js/path-injection
+        config-file: ./.github/codeql/codeql-config-query-filters2.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Check SARIF for query packs and local queries with Single include, Single exclude
-        uses: ./../action/.github/actions/query-filter-test
-        with:
-          sarif-file: ${{ runner.temp }}/results/javascript.sarif
-          queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-          queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-          config-file: ./.github/codeql/codeql-config-query-filters3.yml
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Check SARIF for query packs and local queries with Single include, Single exclude
+      uses: ./../action/.github/actions/query-filter-test
+      with:
+        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
+        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
+        config-file: ./.github/codeql/codeql-config-query-filters3.yml
+        tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/rebuild.yml

@@ -12,7 +12,7 @@ defaults:
 jobs:
   rebuild:
     name: Rebuild Action
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
     env:
@@ -33,7 +33,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Remove label
         if: github.event_name == 'pull_request'

.github/workflows/rollback-release.yml

@@ -34,7 +34,7 @@ jobs:
   rollback:
     name: "Create rollback release"
     if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     timeout-minutes: 45
 
     # Don't set the deployment environment for test runs

.github/workflows/script/check-js.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -eu
+
+# Sanity check that repo is clean to start with
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then this workflow needs attention...
+    >&2 echo "Failed: Repo should be clean before testing!"
+    exit 1
+fi
+# Wipe the lib directory in case there are extra unnecessary files in there
+rm -rf lib
+# Generate the JavaScript files
+npm run-script build
+# Check that repo is still clean
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then the PR needs attention
+    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
+    git status
+
+    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
+    echo "" >> $GITHUB_STEP_SUMMARY
+    echo '```diff' >> $GITHUB_STEP_SUMMARY
+    git diff --output="$RUNNER_TEMP/js.diff"
+    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
+    echo '```' >> $GITHUB_STEP_SUMMARY
+
+    # Reset bundled files to allow other checks to test for changes
+    git checkout lib
+
+    # Fail this check
+    exit 1
+fi
+echo "Success: JavaScript files are up to date"

.github/workflows/test-codeql-bundle-all.yml

@@ -1,17 +1,17 @@
-name: "PR Check - CodeQL Bundle All"
+name: 'PR Check - CodeQL Bundle All'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
 on:
   push:
     branches:
-      - main
-      - releases/v*
+    - main
+    - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 5 * * *"
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -27,9 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-26.04
-            version: nightly-latest
-    name: "CodeQL Bundle All"
+        - os: ubuntu-latest
+          version: nightly-latest
+    name: 'CodeQL Bundle All'
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -37,26 +37,26 @@ jobs:
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: true
-      - name: Install .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "9.x"
-      - id: init
-        uses: ./../action/init
-        with:
-          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-          languages: cpp,csharp,go,java,javascript,python,ruby
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - name: Build code
-        run: ./build.sh
-      - uses: ./../action/analyze
+    - name: Check out repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: ${{ matrix.version }}
+        use-all-platform-bundle: true
+    - name: Install .NET
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      with:
+        dotnet-version: '9.x'
+    - id: init
+      uses: ./../action/init
+      with:
+        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
+        languages: cpp,csharp,go,java,javascript,python,ruby
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - name: Build code
+      run: ./build.sh
+    - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/update-bundle.yml

@@ -20,7 +20,7 @@ defaults:
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests
@@ -30,7 +30,7 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: "${{ toJson(github) }}"
+          GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "$GITHUB_CONTEXT"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -44,7 +44,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
@@ -113,12 +113,11 @@ jobs:
           echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
           echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"
 
-      - name: Create changenote
+      - name: Create changelog note
         run: |
           npx tsx pr-checks/bundle-changelog.ts
 
-      - name: Push changenote
+      - name: Push changelog note
         run: |
-          git add unreleased-change-notes
-          git commit -m "Add changenote"
+          git commit -am "Add changelog note"
           git push

.github/workflows/update-release-branch.yml

@@ -26,7 +26,7 @@ jobs:
   update:
     name: "Update release branch"
     timeout-minutes: 45
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch'
     needs: [prepare]
     env:
@@ -38,48 +38,48 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-      - uses: ./.github/actions/release-initialise
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0  # Need full history for calculation of diffs
+    - uses: ./.github/actions/release-initialise
 
-      # when the workflow has been manually triggered on main,
-      # we know that we definitely want the release branch to exist
-      - name: Ensure release branch exists
-        run: |
-          echo "MAJOR_VERSION ${MAJOR_VERSION}"
-          RELEASE_BRANCH=releases/${MAJOR_VERSION}
-          if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-              echo "Branch $RELEASE_BRANCH already exists"
-              echo ""
-          else
-              echo "Creating $RELEASE_BRANCH branch"
-              git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-              git push --set-upstream origin ${RELEASE_BRANCH}
-              git branch --show-current
-              echo ""
-          fi
-          echo "Returning to branch: ${REF_NAME}"
-          git checkout ${REF_NAME}
+    # when the workflow has been manually triggered on main,
+    # we know that we definitely want the release branch to exist
+    - name: Ensure release branch exists
+      run: |
+        echo "MAJOR_VERSION ${MAJOR_VERSION}"
+        RELEASE_BRANCH=releases/${MAJOR_VERSION}
+        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
+            echo "Branch $RELEASE_BRANCH already exists"
+            echo ""
+        else
+            echo "Creating $RELEASE_BRANCH branch"
+            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
+            git push --set-upstream origin ${RELEASE_BRANCH}
+            git branch --show-current
+            echo ""
+        fi
+        echo "Returning to branch: ${REF_NAME}"
+        git checkout ${REF_NAME}
 
-      - name: Update current release branch
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo SOURCE_BRANCH=${REF_NAME}
-          echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-          npx tsx ./pr-checks/update-release-branch.ts \
-            --repository-nwo ${{ github.repository }} \
-            --source-branch '${{ env.REF_NAME }}' \
-            --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-            --is-primary-release \
-            --conductor ${GITHUB_ACTOR}
+    - name: Update current release branch
+      if: github.event_name == 'workflow_dispatch'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        echo SOURCE_BRANCH=${REF_NAME}
+        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
+        npx tsx ./pr-checks/update-release-branch.ts \
+          --repository-nwo ${{ github.repository }} \
+          --source-branch '${{ env.REF_NAME }}' \
+          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
+          --is-primary-release \
+          --conductor ${GITHUB_ACTOR}
 
   backport:
     name: "Create backport"
     timeout-minutes: 45
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     environment: Automation
     needs: [prepare]
     if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -94,28 +94,28 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-      - name: Generate token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+    - name: Generate token
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+      id: app-token
+      with:
+        app-id: ${{ vars.AUTOMATION_APP_ID }}
+        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-          token: ${{ steps.app-token.outputs.token }}
-      - uses: ./.github/actions/release-initialise
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0  # Need full history for calculation of diffs
+        token: ${{ steps.app-token.outputs.token }}
+    - uses: ./.github/actions/release-initialise
 
-      - name: Update older release branch
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo SOURCE_BRANCH=${SOURCE_BRANCH}
-          echo TARGET_BRANCH=${TARGET_BRANCH}
-          npx tsx ./pr-checks/update-release-branch.ts \
-            --repository-nwo ${{ github.repository }} \
-            --source-branch ${SOURCE_BRANCH} \
-            --target-branch ${TARGET_BRANCH} \
-            --conductor ${GITHUB_ACTOR}
+    - name: Update older release branch
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        echo SOURCE_BRANCH=${SOURCE_BRANCH}
+        echo TARGET_BRANCH=${TARGET_BRANCH}
+        npx tsx ./pr-checks/update-release-branch.ts \
+          --repository-nwo ${{ github.repository }} \
+          --source-branch ${SOURCE_BRANCH} \
+          --target-branch ${TARGET_BRANCH} \
+          --conductor ${GITHUB_ACTOR}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: "npm"
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci

.vscode/settings.json

@@ -15,7 +15,7 @@
   "search.exclude": {
     "**/node_modules": true,
     "build": true,
-    "lib": true
+    "lib": true,
   },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
   // an intermediate stage where many files are modified. This setting suppresses these warnings.
@@ -26,9 +26,4 @@
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
-  "[yaml]": {
-    "editor.tabSize": 2,
-    "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
-  "prettier.prettierPath": "./node_modules/prettier"
 }

CHANGELOG.md

@@ -2,16 +2,9 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## 4.39.3 - 04 Nov 2026
+## [UNRELEASED]
 
-- Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. [#4283](https://github.com/github/codeql-action/pull/4283)
-
-## 4.39.2 - 03 Nov 2026
-
-- Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284)
-- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)
-- Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See [this blog post for more information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/). The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). This check will be rolled out following this release of the CodeQL Action. [#4221](https://github.com/github/codeql-action/pull/4221)
-- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze` Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#4243](https://github.com/github/codeql-action/pull/4243)
+No user facing changes.
 
 ## 4.39.1 - 21 Oct 2026
 

README.md

@@ -76,6 +76,7 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
+| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 

action.yml

@@ -1,10 +1,10 @@
-name: "CodeQL: Stub"
+name: 'CodeQL: Stub'
 description: "Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead."
-author: "GitHub"
+author: 'GitHub'
 runs:
-  using: "composite"
+  using: 'composite'
   steps:
-    - name: "Stub"
+    - name: 'Stub'
       run: |
         echo 'This is a stub. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.'
         exit 1

autobuild/action.yml

@@ -1,6 +1,6 @@
-name: "CodeQL: Autobuild"
-description: "Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead."
-author: "GitHub"
+name: 'CodeQL: Autobuild'
+description: 'Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead.'
+author: 'GitHub'
 inputs:
   token:
     description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission."
@@ -16,4 +16,4 @@ inputs:
     required: false
 runs:
   using: node24
-  main: "../lib/autobuild-entry.js"
+  main: '../lib/autobuild-entry.js'

init/action.yml

@@ -1,6 +1,6 @@
-name: "CodeQL: Init"
-description: "Set up CodeQL"
-author: "GitHub"
+name: 'CodeQL: Init'
+description: 'Set up CodeQL'
+author: 'GitHub'
 inputs:
   tools:
     description: >-
@@ -56,7 +56,7 @@ inputs:
       - `code-scanning`: The default, security-focused analysis.
       - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
                         with `code-scanning`.
-    default: "code-scanning"
+    default: 'code-scanning'
     required: true
   token:
     description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
@@ -100,7 +100,7 @@ inputs:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
   quality-queries:
-    description: "[Internal] DEPRECATED. Comma-separated list of code quality queries to run."
+    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
     required: false
   packs:
     description: >-
@@ -140,7 +140,7 @@ inputs:
       This will result in more output being produced which may be useful when debugging certain issues.
       Debugging mode is enabled automatically when step debug logging is turned on.
     required: false
-    default: "false"
+    default: 'false'
   debug-artifact-name:
     description: >-
       The name of the artifact to store debugging information in.
@@ -181,5 +181,5 @@ outputs:
     description: The version of the CodeQL binary used for analysis
 runs:
   using: node24
-  main: "../lib/init-entry.js"
-  post: "../lib/init-post-entry.js"
+  main: '../lib/init-entry.js'
+  post: '../lib/init-post-entry.js'

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.4",
-  "cliVersion": "2.27.4",
-  "priorBundleVersion": "codeql-bundle-v2.27.3",
-  "priorCliVersion": "2.27.3"
+  "bundleVersion": "codeql-bundle-v2.27.3",
+  "cliVersion": "2.27.3",
+  "priorBundleVersion": "codeql-bundle-v2.27.2",
+  "priorCliVersion": "2.27.2"
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.3",
+      "version": "4.39.2",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -30,12 +30,12 @@
         "follow-redirects": "^1.16.1",
         "get-folder-size": "^5.0.0",
         "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.5.0",
+        "js-yaml": "^5.4.3",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
-        "node-forge": "^1.4.1",
+        "node-forge": "^1.4.0",
         "semver": "^7.8.5",
-        "undici": "^7.30.1",
+        "undici": "^6.28.0",
         "uuid": "^14.0.3"
       },
       "devDependencies": {
@@ -50,22 +50,29 @@
         "@types/node-forge": "^1.3.14",
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.8.0",
-        "@types/sinon": "^22.0.1",
+        "@types/sinon": "^22.0.0",
         "ava": "^6.4.1",
         "esbuild": "^0.28.2",
         "eslint": "^9.39.5",
         "eslint-import-resolver-typescript": "^4.4.5",
         "eslint-plugin-github": "^6.1.2",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.4.0",
+        "eslint-plugin-jsdoc": "^65.3.4",
         "eslint-plugin-no-async-foreach": "^0.1.1",
-        "glob": "^14.0.3",
+        "glob": "^13.0.6",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
-        "prettier": "^3.9.10",
         "sinon": "^22.1.0",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.72.0"
+        "typescript-eslint": "^8.71.2"
+      }
+    },
+    "node_modules/@aashutoshrathi/word-wrap": {
+      "version": "1.2.6",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
     "node_modules/@actions/artifact": {
@@ -951,89 +958,18 @@
         "tslib": "^2.4.0"
       }
     },
-    "node_modules/@es-joy/escodegen": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/escodegen/-/escodegen-4.2.0.tgz",
-      "integrity": "sha512-jWqqS3StW6vGwJeT8yu6alS4nipOBi3kD/pR63+9hG2NfGafCJ4viDME15mVf+fyupyptcUJDXfv63gFF5Gzfg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@es-joy/estraverse": "^7.1.1",
-        "@es-joy/jsdoccomment": "^0.62.0",
-        "esprima": "^4.0.1",
-        "esutils": "^2.0.3",
-        "optionator": "^0.9.4"
-      },
-      "bin": {
-        "escodegen": "bin/escodegen.js",
-        "esgenerate": "bin/esgenerate.js"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "optionalDependencies": {
-        "source-map": "~0.7.6"
-      }
-    },
-    "node_modules/@es-joy/escodegen/node_modules/@es-joy/jsdoccomment": {
-      "version": "0.62.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.62.0.tgz",
-      "integrity": "sha512-yWi6sm7INEwnfS7IJvE0dU+RTrwzLPFcY7e7eGpu/l5Q9lWfQ2ROwZ0qVnc242jw2TUPsfHX3XMIISkGBv57RQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.8",
-        "@typescript-eslint/types": "^8.44.1",
-        "comment-parser": "1.4.1",
-        "esquery": "^1.6.0",
-        "jsdoc-type-pratt-parser": "~5.9.0"
-      },
-      "engines": {
-        "node": ">=20.11.0"
-      }
-    },
-    "node_modules/@es-joy/escodegen/node_modules/comment-parser": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.1.tgz",
-      "integrity": "sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12.0.0"
-      }
-    },
-    "node_modules/@es-joy/escodegen/node_modules/jsdoc-type-pratt-parser": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-5.9.2.tgz",
-      "integrity": "sha512-TYzkACp/wPvDJLRY7qpHXtrhgwoAaojIOnLaaVNi+AbPU2u1kkjfKd9hXXTq0qSAGsyYXvwUXt99h9I5iCmjjw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/@es-joy/estraverse": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@es-joy/estraverse/-/estraverse-7.1.1.tgz",
-      "integrity": "sha512-h2d737iS0LFAqypZOmXizu54qAbHofI/RpD30Zom03O6BCXKHuFevWKPcGarZbGq82h7qSBb5G6kLdhTMO+caw==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.100.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.100.0.tgz",
-      "integrity": "sha512-QuIT5kMg3XWN22Wa1rcXmR/GkfSg6Ygs/ikMiHihdSpu+o3O59LygkFV9srKa5xHplBFwNd5ZCo3bywL4k7qMQ==",
+      "version": "0.98.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.98.0.tgz",
+      "integrity": "sha512-QS+b7I2aaSM+gZfDz1b9E4B367JJ2qTjFXRKF289iKkh9sYdZ21Q5MiF/Duzouy3J0C4VhM3I/8f2F4+zT8gYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.72.0",
+        "@typescript-eslint/types": "^8.70.0",
         "comment-parser": "1.4.9",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~9.3.0"
+        "jsdoc-type-pratt-parser": "~9.2.2"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
@@ -1811,12 +1747,6 @@
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@isaacs/nonrecursive-glob-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.2.tgz",
-      "integrity": "sha512-GJPHIgPPtFl+nLhFHyF0zZoFcOFLsZWbHFFzo+Zr+PWDXJbl9hHxb2w+9SiF2fHmLgKaXIpUzQo3SbBBZ9WObw==",
-      "license": "BlueOak-1.0.0"
-    },
     "node_modules/@mapbox/node-pre-gyp": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz",
@@ -2751,15 +2681,20 @@
       "license": "MIT"
     },
     "node_modules/@types/sinon": {
-      "version": "22.0.1",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.1.tgz",
-      "integrity": "sha512-MThluJXPmpBY+Z5S3565F2z+hjkCXnBrr36j2mitVQ7JUtxA+A+YQhs+0Q6J8jxb0SVJvydO+6NWfj9EBzpiBQ==",
+      "version": "22.0.0",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.0.tgz",
+      "integrity": "sha512-TDbVpbccc2HfiqHR09Argj3mHV1KMW7sCCKj52fsl8lbRLkEn7fB1966EWhOKWUBcqfBueZuPoA7/OK1CKiy3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@sinonjs/fake-timers": "^15.4.0"
+        "@types/sinonjs__fake-timers": "*"
       }
     },
+    "node_modules/@types/sinonjs__fake-timers": {
+      "version": "8.1.2",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -2767,17 +2702,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.72.0.tgz",
-      "integrity": "sha512-aysKgysPX9XOv/dk95UkvUDe++Q3n3dJPG9CEWT3RUccxfkPJ+Qn6nhKPDhZXU6Ofo9kgwGWwKyQCnZIXTgngg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
+      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/type-utils": "8.72.0",
-        "@typescript-eslint/utils": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/type-utils": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -2790,7 +2725,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.72.0",
+        "@typescript-eslint/parser": "^8.71.2",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -2806,16 +2741,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.72.0.tgz",
-      "integrity": "sha512-0O+x3ynciD6zuXb1CKSu165haQV6ey53DKhHHUnujP7U+XlltJG+/keT0Xhd1HXCze+IHf7Tvt39ovyepX/LNw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
+      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2849,14 +2784,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.72.0.tgz",
-      "integrity": "sha512-bzHngBbmIgzj6TsTjVUCntGx6FFLgE7mPjpO0PzHycOaZHXqS43XnrkFIHRS16LLr/xO6FHSXG3GJFo/F4bSBQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
+      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.72.0",
-        "@typescript-eslint/types": "^8.72.0",
+        "@typescript-eslint/tsconfig-utils": "^8.71.2",
+        "@typescript-eslint/types": "^8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2889,14 +2824,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.72.0.tgz",
-      "integrity": "sha512-JewPyJOYcXBSAS7PIgufscHOwZqhTGyBRiQJhhuDln66tMchxvvt7nJ90JKKIoOelmdHA3kAQbm9cEUHc4JSEA==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
+      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0"
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2907,9 +2842,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.72.0.tgz",
-      "integrity": "sha512-0vbxCf7xLVPSjcOdm6eQbgViH8EDJ8xnl1laLT9yoqSz2YmcSfSg5Vdl0JUvZf6rcuJ0ZivJIuMD4edTg8obaA==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
+      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2924,15 +2859,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.72.0.tgz",
-      "integrity": "sha512-gEXxmmbSTSOVTC37IYYvremOM31v+UN2W772bJxmVYPhAOPSUxtacyb7wkm1EhkYKU6KzFJsdU44DCV4to0LWw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
+      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/utils": "8.72.0",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -2967,9 +2902,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.72.0.tgz",
-      "integrity": "sha512-Adfoy59kxNEjT5E5fnyrp7GpHYuWs8ONbdohu4ez6IU46qDq8LltG90tLmkucZB2uhYL8mqBjtXqGd8yhfjXqQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
+      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2981,16 +2916,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.72.0.tgz",
-      "integrity": "sha512-gwLfFgWcw15tN2KXDCJvxEOQjPn+P3j/n3eSqkZ5sX4VpW9Cosodr+tWwBZRvJT3TcKx6HnPRGZMCNAiP1Xhug==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
+      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.72.0",
-        "@typescript-eslint/tsconfig-utils": "8.72.0",
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/visitor-keys": "8.72.0",
+        "@typescript-eslint/project-service": "8.71.2",
+        "@typescript-eslint/tsconfig-utils": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -3066,16 +3001,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.72.0.tgz",
-      "integrity": "sha512-0up3oArJZBYnzOaEXKo8DmI43QvMZyPoFEt9LWzRJcyl/RcJjfKKPebknN1VbTgXBf3M/KggUh5uUMdURLnseg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
+      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.72.0",
-        "@typescript-eslint/types": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0"
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3090,13 +3025,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.72.0.tgz",
-      "integrity": "sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
+      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/types": "8.71.2",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -3530,6 +3465,7 @@
     },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -3539,6 +3475,7 @@
       "version": "6.2.3",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
       "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -3639,7 +3576,6 @@
     },
     "node_modules/argparse": {
       "version": "2.0.1",
-      "dev": true,
       "license": "Python-2.0"
     },
     "node_modules/aria-query": {
@@ -4443,6 +4379,7 @@
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -4453,6 +4390,7 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/comment-parser": {
@@ -4577,6 +4515,7 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -4831,6 +4770,7 @@
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-abstract": {
@@ -5425,16 +5365,15 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.4.0.tgz",
-      "integrity": "sha512-bRiU6LfCFmLL7GuePKvA6ZIcXLonhZGCg2TgQLmkcExeVdAirQp2Hsf3xeSUTmlKwAAsREVEOLbZYD8F7oA69g==",
+      "version": "65.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
+      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/escodegen": "^4.2.0",
-        "@es-joy/jsdoccomment": "~0.100.0",
+        "@es-joy/jsdoccomment": "~0.98.0",
         "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.72.0",
+        "@typescript-eslint/utils": "^8.70.1",
         "are-docs-informative": "^0.1.1",
         "comment-parser": "1.4.9",
         "debug": "^4.4.3",
@@ -6273,14 +6212,14 @@
       }
     },
     "node_modules/glob": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
-      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^11.0.2",
+        "minimatch": "^10.2.2",
         "minipass": "^7.1.3",
-        "path-scurry": "^3.0.0"
+        "path-scurry": "^2.0.2"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6324,13 +6263,12 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.2.tgz",
-      "integrity": "sha512-pWTgz5CN3tjqyZNSK2tePlSmu9IwM41q8yn8Usdqqwe9TIHh+9dEpLLjF4uApsfPEAZY71qtSiA2B2APEr+1Yw==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/nonrecursive-glob-match": "^1.0.2",
-        "brace-expansion": "^5.0.12"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -6859,6 +6797,7 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7169,6 +7108,7 @@
     },
     "node_modules/isexe": {
       "version": "2.0.0",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/js-string-escape": {
@@ -7181,9 +7121,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz",
-      "integrity": "sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==",
+      "version": "5.4.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
+      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
       "funding": [
         {
           "type": "github",
@@ -7196,28 +7136,12 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "argparse": "^3.0.3"
+        "argparse": "^2.0.1"
       },
       "bin": {
         "js-yaml": "bin/js-yaml.mjs"
       }
     },
-    "node_modules/js-yaml/node_modules/argparse": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.3.tgz",
-      "integrity": "sha512-Sn98ftV3KfsO8xfLPHG6oT8y+b0yvbrLgZjgPDXsharNY15tTAjqIsIju4S32nl6/iEUNNE4v+yL2Zhm8ooP3w==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodeca"
-        }
-      ],
-      "license": "PSF-2.0"
-    },
     "node_modules/jschardet": {
       "version": "3.1.4",
       "resolved": "https://registry.npmjs.org/jschardet/-/jschardet-3.1.4.tgz",
@@ -7229,18 +7153,36 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.3.0.tgz",
-      "integrity": "sha512-JZ8lKMCZXDlM1jAjAK5tTmtFJtgv6iFQQfjE3Fza6jBRACUueaEXLY17n1u05JO1lcPkNxgP+ddEDtiPsk5ktg==",
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.2.tgz",
+      "integrity": "sha512-eFY7Rlscvv/BpY6UsVsjKwMhu1tJO/F4U/vC9g3yeRy/JqszuO1UP6Vdq+85G+3FP6fEw/sWR8a5ftPFY86csw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.9"
+        "@types/estree": "^1.0.9",
+        "@types/node": "^26.4.0"
       },
       "engines": {
         "node": "^22.22.2 || >=24.15.0"
       }
     },
+    "node_modules/jsdoc-type-pratt-parser/node_modules/@types/node": {
+      "version": "26.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.9.0"
+      }
+    },
+    "node_modules/jsdoc-type-pratt-parser/node_modules/undici-types": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -7478,9 +7420,9 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="
     },
     "node_modules/lru-cache": {
-      "version": "11.5.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
-      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -8198,9 +8140,9 @@
       }
     },
     "node_modules/node-forge": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.1.tgz",
-      "integrity": "sha512-w5/MfWaeMrpR/5ba6fZyAUTLSuE6aYz7H/3cYrqwZEmf5eQS3IaaLgJt4MBv7HglGFWmV22K8h4U18RJQmw/ow==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
+      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
         "node": ">= 6.13.0"
@@ -8401,18 +8343,16 @@
       }
     },
     "node_modules/optionator": {
-      "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "version": "0.9.3",
       "dev": true,
       "license": "MIT",
       "dependencies": {
+        "@aashutoshrathi/word-wrap": "^1.2.3",
         "deep-is": "^0.1.3",
         "fast-levenshtein": "^2.0.6",
         "levn": "^0.4.1",
         "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0",
-        "word-wrap": "^1.2.5"
+        "type-check": "^0.4.0"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -8571,6 +8511,7 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8582,9 +8523,9 @@
       "license": "MIT"
     },
     "node_modules/path-scurry": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
-      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
@@ -8669,9 +8610,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.10.tgz",
-      "integrity": "sha512-skGHTH1Yb9QvaTC4hWnRTzEYtCpApF0UMBPz+t/0ZPzP8ihefo/btKd+QA7pUE0fEwA1SbS/NmhyEcstdXOIdA==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.4.1.tgz",
+      "integrity": "sha512-G+YdqtITVZmOJje6QkXQWzl3fSfMxFwm1tjTyo9exhkmWSqC4Yhd1+lug++IlR2mvRVAxEDDWYkQdeSztajqgg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -9170,6 +9111,7 @@
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -9180,6 +9122,7 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -9265,6 +9208,7 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
       "engines": {
         "node": ">=14"
       },
@@ -9332,17 +9276,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.7.6",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
-      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true,
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -9451,6 +9384,7 @@
     },
     "node_modules/string-width": {
       "version": "4.2.3",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -9536,6 +9470,7 @@
     },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -10046,16 +9981,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.72.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.72.0.tgz",
-      "integrity": "sha512-r26Fkc8As+mZvqp7SLsMmNFyYUup/6CjK7/eHBHmhOw6GH6n6YFxHVFrG0jN1c5CMpDzelLPxvgeCOzx7BjN+A==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
+      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.72.0",
-        "@typescript-eslint/parser": "8.72.0",
-        "@typescript-eslint/typescript-estree": "8.72.0",
-        "@typescript-eslint/utils": "8.72.0"
+        "@typescript-eslint/eslint-plugin": "8.71.2",
+        "@typescript-eslint/parser": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10089,12 +10024,12 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.30.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
-      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "license": "MIT",
       "engines": {
-        "node": ">=20.18.1"
+        "node": ">=18.17"
       }
     },
     "node_modules/undici-types": {
@@ -10273,6 +10208,7 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -10373,16 +10309,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/word-wrap": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
@@ -10562,7 +10488,6 @@
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-        "glob": "^14.0.3",
         "lite-matter": "^0.1.2",
         "mdast-util-from-markdown": "^2.1.0",
         "semver": "^7.8.5",

package.json

@@ -1,12 +1,11 @@
 {
   "name": "codeql",
-  "version": "4.39.3",
+  "version": "4.39.2",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
     "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
     "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
-    "format-yaml": "prettier --write --parser yaml '**/*.{yml,yaml}'",
     "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
     "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
     "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
@@ -14,8 +13,7 @@
     "test": "npm run ava -- src/",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh",
-    "typecheck": "tsc --noEmit"
+    "update-pr-checks": "./pr-checks/sync.sh"
   },
   "license": "MIT",
   "workspaces": [
@@ -40,12 +38,12 @@
     "follow-redirects": "^1.16.1",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.5.0",
+    "js-yaml": "^5.4.3",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
-    "node-forge": "^1.4.1",
+    "node-forge": "^1.4.0",
     "semver": "^7.8.5",
-    "undici": "^7.30.1",
+    "undici": "^6.28.0",
     "uuid": "^14.0.3"
   },
   "devDependencies": {
@@ -60,22 +58,21 @@
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.8.0",
-    "@types/sinon": "^22.0.1",
+    "@types/sinon": "^22.0.0",
     "ava": "^6.4.1",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.4.0",
+    "eslint-plugin-jsdoc": "^65.3.4",
     "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^14.0.3",
+    "glob": "^13.0.6",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
-    "prettier": "^3.9.10",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.72.0"
+    "typescript-eslint": "^8.71.2"
   },
   "overrides": {
     "@actions/tool-cache": {
@@ -96,7 +93,7 @@
     "eslint-plugin-jsx-a11y": {
       "semver": ">=6.3.1"
     },
-    "glob": "^14.0.3",
-    "undici": "^7.30.1"
+    "glob": "^13.0.6",
+    "undici": "^6.28.0"
   }
 }

pr-checks/bundle-changelog.test.ts

@@ -10,13 +10,17 @@ import { afterEach, beforeEach, describe, it } from "node:test";
 
 import {
   CLI_VERSION_ENV_VAR,
-  getChangenote,
   getCLIVersion,
   getPRNumber,
   getPRUrl,
   PR_URL_ENV_VAR,
+  updateChangelog,
 } from "./bundle-changelog";
-import { isValidChangenoteContent } from "./changelog/validate";
+import {
+  EMPTY_CHANGELOG,
+  NO_CHANGES_STR,
+  UNRELEASED_PLACEHOLDER,
+} from "./changelog";
 
 let testDir: string;
 
@@ -81,15 +85,58 @@ describe("getPRNumber", async () => {
   });
 });
 
-describe("getChangenote", async () => {
-  await it("returns a note linking to the bundle release and the PR", async () => {
-    assert.equal(
-      getChangenote("1.2.3", testPrUrl),
-      "- Update default CodeQL bundle version to [1.2.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v1.2.3). [#42](https://github.com/github/codeql-action/pulls/42)\n",
-    );
+const testChangelog = `${EMPTY_CHANGELOG.trimEnd()}
+
+## 4.23.7
+
+- Other change
+
+## 4.23.6
+
+${NO_CHANGES_STR}`;
+
+const expectedChangelog = `# CodeQL Action Changelog
+
+## ${UNRELEASED_PLACEHOLDER}
+
+- Update default CodeQL bundle version to
+
+## 4.23.7
+
+- Other change
+
+## 4.23.6
+
+${NO_CHANGES_STR}`;
+
+describe("updateChangelog", async () => {
+  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
+    const result = updateChangelog(EMPTY_CHANGELOG, "");
+    assert.ok(!result.includes(NO_CHANGES_STR));
   });
 
-  await it("returns valid changenote content", async () => {
-    assert.ok(isValidChangenoteContent(getChangenote("1.2.3", testPrUrl)));
+  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
+    const result = updateChangelog(
+      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
+      "",
+    );
+    assert.ok(result.includes(NO_CHANGES_STR));
+  });
+
+  await it("throws if there are no sections", async () => {
+    assert.throws(() => {
+      updateChangelog(
+        "# CodeQL Action Changelog",
+        "- Update default CodeQL bundle version to",
+      );
+    });
+  });
+
+  await it("adds note at the end of the first section", async () => {
+    const result = updateChangelog(
+      testChangelog,
+      "- Update default CodeQL bundle version to",
+    );
+    assert.deepEqual(result, expectedChangelog);
   });
 });

pr-checks/bundle-changelog.ts

@@ -1,13 +1,17 @@
 #!/usr/bin/env npx tsx
 
 /**
- * Creates a changenote file for an update to the default CodeQL CLI bundle.
+ * Updates the changelog with a change note for an updated CodeQL CLI bundle.
  */
 
 import * as fs from "node:fs";
-import * as path from "node:path";
 
-import { CHANGENOTES_DIR, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
+import {
+  parseChangelog,
+  renderChangelog,
+  UNRELEASED_PLACEHOLDER,
+} from "./changelog";
+import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
 import { getErrorMessage } from "./util";
 
 export const CLI_VERSION_ENV_VAR = "CLI_VERSION";
@@ -54,19 +58,42 @@ export function getPRNumber(prUrl: string) {
 }
 
 /**
- * Returns the contents of the changenote file for an update to the default
- * CodeQL CLI bundle.
+ * Updates `changelog` by adding `changelogNote` to the first section.
  *
- * @param cliVersion The CodeQL CLI version of the new default bundle.
- * @param prUrl The URL of the PR that updates the default bundle.
- * @throws If the PR number can't be determined from `prUrl`.
+ * @param contents The existing changelog contents.
+ * @param changelogNote The note to add to the first section.
  */
-export function getChangenote(cliVersion: string, prUrl: string): string {
-  // The GitHub Release for the new bundle version.
-  const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
+export function updateChangelog(contents: string, changelogNote: string) {
+  // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
+  contents = contents.replace(
+    `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`,
+    `## ${UNRELEASED_PLACEHOLDER}\n`,
+  );
 
-  const prNumber = getPRNumber(prUrl);
-  return `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})\n`;
+  const changelog = parseChangelog(contents);
+
+  if (changelog.sections.length === 0) {
+    throw new Error("The changelog contains no existing sections.");
+  }
+
+  // Add the changelog note to the bottom of the first section.
+  const firstSection = changelog.sections[0];
+  const lastLine = firstSection.bodyLines.pop();
+
+  if (lastLine !== undefined && lastLine.trim() !== "") {
+    // We expect the last line to be empty. If it isn't for some reason,
+    // add it back.
+    firstSection.bodyLines.push(lastLine);
+  }
+
+  firstSection.bodyLines.push(changelogNote);
+
+  // If the last line is empty as expected, then add it back in after the new note.
+  if (lastLine?.trim() === "") {
+    firstSection.bodyLines.push(lastLine);
+  }
+
+  return renderChangelog(changelog);
 }
 
 function main() {
@@ -74,19 +101,22 @@ function main() {
     const cliVersion = getCLIVersion();
     const prUrl = getPRUrl();
 
-    // Include the CLI version in the file name so that changenotes for
-    // different bundle updates don't conflict.
-    const changenotePath = path.join(
-      CHANGENOTES_DIR,
-      `update-bundle-${cliVersion}.md`,
-    );
-    fs.writeFileSync(changenotePath, getChangenote(cliVersion, prUrl));
+    // The GitHub Release for the new bundle version.
+    const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
+
+    // Get the PR number from the PR URL.
+    const prNumber = getPRNumber(prUrl);
+    const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`;
+
+    let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
+
+    changelog = updateChangelog(changelog, changelogNote);
+
+    fs.writeFileSync(CHANGELOG_FILE, changelog);
 
     return 0;
   } catch (err) {
-    console.error(
-      `Failed to create changenote for bundle update: ${getErrorMessage(err)}`,
-    );
+    console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`);
     return -1;
   }
 }

pr-checks/check-diagnostics.ts

@@ -1,8 +1,6 @@
 import fs from "fs";
-import path from "path";
 
 import * as core from "@actions/core";
-import { globSync } from "glob";
 
 import * as sarif from "../src/sarif";
 
@@ -36,83 +34,59 @@ function checkStatusPageNotification(n: sarif.Notification) {
   }
 }
 
-function checkSarif(sarifFile: string) {
-  core.info(`Checking SARIF file at '${sarifFile}'`);
-
-  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
-  const run = log.runs[0];
-
-  if (run.invocations === undefined) {
-    throw new Error("run.invocations is undefined");
-  }
-
-  const toolExecutionNotifications =
-    run.invocations[0].toolExecutionNotifications;
-
-  if (toolExecutionNotifications === undefined) {
-    throw new Error("toolExecutionNotifications is undefined");
-  }
-
-  const statusPageNotifications = toolExecutionNotifications.filter(
-    (n) =>
-      n.descriptor?.id === DIAGNOSTIC_ID &&
-      n.properties?.visibility?.statusPage,
-  );
-  if (statusPageNotifications.length !== 1) {
-    core.setFailed(
-      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-        `${JSON.stringify(toolExecutionNotifications)}.`,
-    );
-  }
-  checkStatusPageNotification(statusPageNotifications[0]);
-
-  const notifications = run.tool.driver.notifications;
-
-  if (notifications === undefined) {
-    throw new Error("notifications is undefined");
-  }
-
-  const diagnosticNotification = notifications.filter(
-    (n) =>
-      n.id === DIAGNOSTIC_ID &&
-      n.name === DIAGNOSTIC_ID &&
-      n.fullDescription?.text === DIAGNOSTIC_NAME,
-  );
-  if (diagnosticNotification.length !== 1) {
-    core.setFailed(
-      "Expected exactly one notification for this diagnostic in the " +
-        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-        `${diagnosticNotification.length}. All notifications: ` +
-        `${JSON.stringify(notifications)}.`,
-    );
-  }
-}
-
 const sarifPath = process.env["SARIF_PATH"];
 
 if (sarifPath === undefined) {
-  throw new Error(
-    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
+  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
+}
+
+const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
+const run = log.runs[0];
+
+if (run.invocations === undefined) {
+  throw new Error("run.invocations is undefined");
+}
+
+const toolExecutionNotifications =
+  run.invocations[0].toolExecutionNotifications;
+
+if (toolExecutionNotifications === undefined) {
+  throw new Error("toolExecutionNotifications is undefined");
+}
+
+const statusPageNotifications = toolExecutionNotifications.filter(
+  (n) =>
+    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
+);
+if (statusPageNotifications.length !== 1) {
+  core.setFailed(
+    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+      `${JSON.stringify(toolExecutionNotifications)}.`,
+  );
+}
+checkStatusPageNotification(statusPageNotifications[0]);
+
+const notifications = run.tool.driver.notifications;
+
+if (notifications === undefined) {
+  throw new Error("notifications is undefined");
+}
+
+const diagnosticNotification = notifications.filter(
+  (n) =>
+    n.id === DIAGNOSTIC_ID &&
+    n.name === DIAGNOSTIC_ID &&
+    n.fullDescription?.text === DIAGNOSTIC_NAME,
+);
+if (diagnosticNotification.length !== 1) {
+  core.setFailed(
+    "Expected exactly one notification for this diagnostic in the " +
+      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+      `${diagnosticNotification.length}. All notifications: ` +
+      `${JSON.stringify(notifications)}.`,
   );
 }
 
-if (fs.statSync(sarifPath).isDirectory()) {
-  const sarifFiles = globSync("**/*.sarif", {
-    cwd: path.resolve(sarifPath),
-    absolute: true,
-  });
-
-  if (sarifFiles.length < 1) {
-    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
-  }
-
-  for (const sarifFile of sarifFiles) {
-    checkSarif(sarifFile);
-  }
-} else {
-  checkSarif(sarifPath);
-}
-
 core.info("Finished diagnostic export test");