Merge pull request #4220 from github/mbg/fix-action-state-type-inference

Fix type inference for `ActionState`
Merge pull request #4209 from github/dependabot/npm_and_yarn/eslint-plugin-jsdoc-65.0.1
2026-10-10 04:35:26 +00:00 · 2026-10-09 22:31:18 +00:00 · 2026-10-09 17:59:37 +00:00 · 2026-10-09 18:47:49 +01:00 · 2026-10-09 17:45:19 +00:00 · 2026-10-09 17:38:52 +00:00
42 changed files with 901 additions and 666 deletions
--- a/.github/actions/check-sarif/action.yml
+++ b/.github/actions/check-sarif/action.yml
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node20
+  using: node24
  main: index.js
--- a/.github/actions/verify-debug-artifact-scan-completed/action.yml
+++ b/.github/actions/verify-debug-artifact-scan-completed/action.yml
@@ -1,6 +1,6 @@
 name: Verify that the best-effort debug artifact scan completed
 description: Verifies that the best-effort debug artifact scan completed successfully during tests
 runs:
-  using: node20
+  using: node24
  main: index.js
  post: post.js
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,102 +2,106 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## 3.38.3 - 08 Oct 2026
+## [UNRELEASED]
+
+No user facing changes.
+
+## 4.38.3 - 08 Oct 2026

 - _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
 - Update default CodeQL bundle version to [2.27.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2). [#4203](https://github.com/github/codeql-action/pull/4203)
 - Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. [#4184](https://github.com/github/codeql-action/pull/4184)

-## 3.38.2 - 24 Sept 2026
+## 4.38.2 - 24 Sept 2026

 - Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)

-## 3.38.1 - 18 Sept 2026
+## 4.38.1 - 18 Sept 2026

 - The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://github.com/github/codeql-action/pull/4146)

-## 3.38.0 - 09 Sept 2026
+## 4.38.0 - 09 Sept 2026

 - On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. [#4124](https://github.com/github/codeql-action/pull/4124)
 - The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 - Update default CodeQL bundle version to [2.27.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0). [#4129](https://github.com/github/codeql-action/pull/4129)

-## 3.37.9 - 26 Aug 2026
+## 4.37.9 - 26 Aug 2026

 - Update default CodeQL bundle version to [2.26.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4). [#4106](https://github.com/github/codeql-action/pull/4106)

-## 3.37.8 - 21 Aug 2026
+## 4.37.8 - 21 Aug 2026

 No user facing changes.

-## 3.37.7 - 13 Aug 2026
+## 4.37.7 - 13 Aug 2026

 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085)

-## 3.37.6 - 04 Aug 2026
+## 4.37.6 - 04 Aug 2026

 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)

-## 3.37.5 - 03 Aug 2026
+## 4.37.5 - 03 Aug 2026

 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)

-## 3.37.4 - 29 Jul 2026
+## 4.37.4 - 29 Jul 2026

 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)
 - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051)

-## 3.37.3 - 22 Jul 2026
+## 4.37.3 - 22 Jul 2026

 No user facing changes.

-## 3.37.2 - 21 Jul 2026
+## 4.37.2 - 21 Jul 2026

 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
 - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007)

-## 3.37.1 - 16 Jul 2026
+## 4.37.1 - 16 Jul 2026

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956)
 - Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019)

-## 3.37.0 - 08 Jul 2026
+## 4.37.0 - 08 Jul 2026

 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995)
 - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973)

-## 3.36.3 - 01 Jul 2026
+## 4.36.3 - 01 Jul 2026

 No user facing changes.

-## 3.36.2 - 04 Jun 2026
+## 4.36.2 - 04 Jun 2026

 - Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943)
 - Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937)
 - Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948)

-## 3.36.1 - 02 Jun 2026
+## 4.36.1 - 02 Jun 2026

 No user facing changes.

-## 3.36.0 - 22 May 2026
+## 4.36.0 - 22 May 2026

 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
 - Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
 - Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926)

-## 3.35.5 - 15 May 2026
+## 4.35.5 - 15 May 2026

 - We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
 - For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
 - If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
 - Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)

-## 3.35.4 - 07 May 2026
+## 4.35.4 - 07 May 2026

 - Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)

-## 3.35.3 - 01 May 2026
+## 4.35.3 - 01 May 2026

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
 - Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
@@ -105,7 +109,7 @@ No user facing changes.
 - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
 - Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)

-## 3.35.2 - 15 Apr 2026
+## 4.35.2 - 15 Apr 2026

 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
 - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
@@ -113,26 +117,26 @@ No user facing changes.
 - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
 - Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)

-## 3.35.1 - 27 Mar 2026
+## 4.35.1 - 27 Mar 2026

 - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)

-## 3.35.0 - 27 Mar 2026
+## 4.35.0 - 27 Mar 2026

 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
 - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)

-## 3.34.1 - 20 Mar 2026
+## 4.34.1 - 20 Mar 2026

 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)

-## 3.34.0 - 20 Mar 2026
+## 4.34.0 - 20 Mar 2026

 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
 - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
 - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)

-## 3.33.0 - 16 Mar 2026
+## 4.33.0 - 16 Mar 2026

 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)

@@ -146,11 +150,11 @@ No user facing changes.
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
 - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

-## 3.32.6 - 05 Mar 2026
+## 4.32.6 - 05 Mar 2026

 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)

-## 3.32.5 - 02 Mar 2026
+## 4.32.5 - 02 Mar 2026

 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
 - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
@@ -160,7 +164,7 @@ No user facing changes.
 - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
 - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)

-## 3.32.4 - 20 Feb 2026
+## 4.32.4 - 20 Feb 2026

 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
 - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
@@ -168,89 +172,89 @@ No user facing changes.
 - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
 - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)

-## 3.32.3 - 13 Feb 2026
+## 4.32.3 - 13 Feb 2026

 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

-## 3.32.2 - 05 Feb 2026
+## 4.32.2 - 05 Feb 2026

 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)

-## 3.32.1 - 02 Feb 2026
+## 4.32.1 - 02 Feb 2026

 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
 - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)

-## 3.32.0 - 26 Jan 2026
+## 4.32.0 - 26 Jan 2026

 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425)

-## 3.31.11 - 23 Jan 2026
+## 4.31.11 - 23 Jan 2026

 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409)
 - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415)
 - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318)
 - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403)

-## 3.31.10 - 12 Jan 2026
+## 4.31.10 - 12 Jan 2026

 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393)

-## 3.31.9 - 16 Dec 2025
+## 4.31.9 - 16 Dec 2025

 No user facing changes.

-## 3.31.8 - 11 Dec 2025
+## 4.31.8 - 11 Dec 2025

 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354)

-## 3.31.7 - 05 Dec 2025
+## 4.31.7 - 05 Dec 2025

 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343)

-## 3.31.6 - 01 Dec 2025
+## 4.31.6 - 01 Dec 2025

 No user facing changes.

-## 3.31.5 - 24 Nov 2025
+## 4.31.5 - 24 Nov 2025

 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321)

-## 3.31.4 - 18 Nov 2025
+## 4.31.4 - 18 Nov 2025

 No user facing changes.

-## 3.31.3 - 13 Nov 2025
+## 4.31.3 - 13 Nov 2025

 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
 - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)

-## 3.31.2 - 30 Oct 2025
+## 4.31.2 - 30 Oct 2025

 No user facing changes.

-## 3.31.1 - 30 Oct 2025
+## 4.31.1 - 30 Oct 2025

 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

-## 3.31.0 - 24 Oct 2025
+## 4.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 3.30.9 - 17 Oct 2025
+## 4.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 3.30.8 - 10 Oct 2025
+## 4.30.8 - 10 Oct 2025

 No user facing changes.

-## 3.30.7 - 06 Oct 2025
+## 4.30.7 - 06 Oct 2025

+- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)

-No user facing changes.
 ## 3.30.6 - 02 Oct 2025

 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
--- a/analyze/action.yml
+++ b/analyze/action.yml
@@ -94,6 +94,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node20
+  using: node24
  main: "../lib/analyze-entry.js"
  post: "../lib/analyze-post-entry.js"
--- a/autobuild/action.yml
+++ b/autobuild/action.yml
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node20
+  using: node24
  main: '../lib/autobuild-entry.js'
--- a/ava.setup.mjs
+++ b/ava.setup.mjs
@@ -1,3 +1,4 @@
 import pkg from "./package.json" with { type: "json" };

 globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;
+globalThis.__CODEQL_ACTION_TEST_ENV__ = "unit-test";
--- a/build.mjs
+++ b/build.mjs
@@ -78,7 +78,7 @@ const UPLOAD_LIB_SRC = "./src/upload-lib";
 *
 * The virtual module additionally re-exports `upload-lib` under the `uploadLib` namespace so that
 * external consumers can access it via the small `lib/upload-lib.js` stub emitted below.
- * 
+ *
 * A tiny stub file is emitted for each Action entrypoint, and one for `upload-lib`. Each stub
 * imports the shared bundle and calls/re-exports from the respective entry point.
 *
@@ -212,6 +212,7 @@ const context = await esbuild.context({
  target: ["node20"],
  define: {
    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
+    __CODEQL_ACTION_TEST_ENV__: JSON.stringify(""),
  },
  metafile: true,
 });
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -140,6 +140,17 @@ export default [
      "no-async-foreach/no-async-foreach": "error",
      "no-sequences": "error",
      "no-shadow": "off",
+
+      // A basic check that we don't use `exportVariable` from `@actions/core`.
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector: "MemberExpression[property.name='exportVariable']",
+          message:
+            "Use the `export` method of an `Env` instance or `exportEnvVar` from `environment.ts` instead.",
+        },
+      ],
+
      // This is overly restrictive with unsetting `EnvVar`s
      "@typescript-eslint/no-dynamic-delete": "off",
      "@typescript-eslint/no-shadow": "error",
@@ -157,6 +168,15 @@ export default [
      ],
    },
  },
+  {
+    files: ["src/environment.ts"],
+
+    // We allow `exportVariable` from `@actions/core` to be used in this file
+    // since it defines the wrapper around it that other modules use.
+    rules: {
+      "no-restricted-syntax": "off",
+    },
+  },
  {
    files: ["**/*.ts", "**/*.js"],

--- a/init/action.yml
+++ b/init/action.yml
@@ -177,6 +177,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node20
+  using: node24
  main: '../lib/init-entry.js'
  post: '../lib/init-post-entry.js'
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.38.3",
+  "version": "4.38.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.38.3",
+      "version": "4.38.4",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
@@ -58,7 +58,7 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^64.5.4",
+        "eslint-plugin-jsdoc": "^65.0.1",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
        "globals": "^17.12.0",
@@ -5381,15 +5381,15 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "64.5.4",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.5.4.tgz",
-      "integrity": "sha512-xfRhXPSSWT612muJ6XTvxuVJ8zYHv99qNgBqPVqF28aSqoy4s4XbSkrWXnYA2hl5ejC02yEpk6fqkj3BmJ6Xbg==",
+      "version": "65.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.0.1.tgz",
+      "integrity": "sha512-7IvB+ZS71WCw5tGKh6f6D5k55qtXKdrGTnIpQTBKWdpyZ5IfhGHfh0i6ArWlCJ4JEtz22YRk5Bqu1MvbOlpMKQ==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
        "@es-joy/jsdoccomment": "~0.98.0",
        "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.70.0",
+        "@typescript-eslint/utils": "^8.70.1",
        "are-docs-informative": "^0.1.1",
        "comment-parser": "1.4.9",
        "debug": "^4.4.3",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "3.38.3",
+  "version": "4.38.4",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -66,7 +66,7 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^64.5.4",
+    "eslint-plugin-jsdoc": "^65.0.1",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
    "globals": "^17.12.0",
--- a/pr-checks/changelog/validate.test.ts
+++ b/pr-checks/changelog/validate.test.ts
@@ -154,26 +154,6 @@ await describe("isValidChangenoteFile", async () => {
    assert.equal(isValidChangenoteFile("non-existent-file.md"), false);
  });

-  await it("rejects invalid filename", async () => {
-    await withTmpFile(
-      "fix-bug.md",
-      "---\ncategory: fix\n---\n- Fixed a bug\n",
-      (filePath) => {
-        assert.equal(isValidChangenoteFile(filePath), false);
-      },
-    );
-  });
-
-  await it("rejects missing frontmatter", async () => {
-    await withTmpFile(
-      "2026-01-01-fix-bug.md",
-      "- Fixed a bug\n",
-      (filePath) => {
-        assert.equal(isValidChangenoteFile(filePath), false);
-      },
-    );
-  });
-
  await it("rejects invalid Markdown", async () => {
    await withTmpFile(
      "2026-01-01-fix-bug.md",
--- a/pr-checks/changelog/validate.ts
+++ b/pr-checks/changelog/validate.ts
@@ -1,5 +1,4 @@
 import * as fs from "node:fs";
-import * as path from "node:path";

 import { matter } from "lite-matter";
 import type { List, ListItem } from "mdast";
@@ -95,21 +94,7 @@ export function isValidChangenoteFile(filename: string): boolean {
    return false;
  }

-  const { data: frontmatter, content } = matter(fileData);
-
-  if (!isValidChangenoteFilename(path.basename(filename))) {
-    isValid = false;
-    console.error(
-      `${filename}: invalid filename; must match pattern YYYY-MM-DD-id.md`,
-    );
-  }
-  if (!hasValidChangenoteCategory(frontmatter)) {
-    isValid = false;
-    const categories = Object.keys(VALID_CHANGE_NOTE_CATEGORIES).join(", ");
-    console.error(
-      `${filename}: invalid category; must be one of: ${categories}`,
-    );
-  }
+  const { content } = matter(fileData);
  if (!isValidChangenoteContent(content)) {
    isValid = false;
    console.error(
--- a/queries/default-setup-environment-variables.ql
+++ b/queries/default-setup-environment-variables.ql
@@ -23,7 +23,8 @@ predicate isSafeForDefaultSetup(string envVar) {
      "GITHUB_BASE_REF", "GITHUB_EVENT_NAME", "GITHUB_JOB", "GITHUB_RUN_ATTEMPT", "GITHUB_RUN_ID",
      "GITHUB_SHA", "GITHUB_REPOSITORY", "GITHUB_SERVER_URL", "GITHUB_TOKEN", "GITHUB_WORKFLOW",
      "GITHUB_WORKSPACE", "GOFLAGS", "ImageVersion", "JAVA_TOOL_OPTIONS", "RUNNER_ARCH",
-      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE"
+      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE",
+      "NODE_ENV"
    ]
 }

--- a/resolve-environment/action.yml
+++ b/resolve-environment/action.yml
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node20
+  using: node24
  main: '../lib/resolve-environment-entry.js'
--- a/setup-codeql/action.yml
+++ b/setup-codeql/action.yml
@@ -51,5 +51,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node20
+  using: node24
  main: '../lib/setup-codeql-entry.js'
--- a/src/action-common.ts
+++ b/src/action-common.ts
@@ -56,6 +56,29 @@ export interface FeatureState {
 /** Identifies a type of state an Action may have. */
 export type StateFeature = keyof FeatureState;

+/**
+ * The `Env` feature implies the availability of the `ReadOnlyEnv` feature.
+ *
+ * If `T` is `Env`, this returns `Env | ReadOnlyEnv`.
+ * Otherwise, it is the identity and returns T.
+ */
+type ImpliedFeatures<T extends StateFeature> = T extends "Env"
+  ? "Env" | "ReadOnlyEnv"
+  : T;
+
+/**
+ * Given an object type `Obj`, this tries to lookup a corresponding `StateFeature`
+ * to which the object type belongs in `FeatureState`. Resolves to `never` if there
+ * is no match.
+ */
+type FeatureNameFor<Obj extends object> = {
+  [K in StateFeature]: [Obj] extends [FeatureState[K]]
+    ? [FeatureState[K]] extends [Obj]
+      ? K
+      : never
+    : never;
+}[StateFeature];
+
 /** Constructs the intersection of all state types identifies by `Fs`. */
 export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
  ? Record<never, never>
@@ -66,8 +89,54 @@ export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
    ? FeatureState[Head] & FieldsOf<Tail>
    : never;

+/**
+ * Symbol used for a field in `ActionState` that carries the type array of state features.
+ * This is a Symbol so that it doesn't clash with any property names we might want to have.
+ */
+const stateFeatures = Symbol();
+
 /** Describes the state of an Action that has access to the state corresponding to `Fs`. */
-export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs>;
+export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs> & {
+  /**
+   * When given a chance, TypeScript will simplify an `ActionState<Fs>` type as much as possible,
+   * which results in a concrete object type that doesn't mention `Fs`.
+   *
+   * That causes problems for functions which accept `ActionState<Fs>` values, but need to know the
+   * feature keys `Fs`. This property here explicitly captures `Fs` in the concrete object type
+   * that results from simplifying `ActionState<Fs>`.
+   *
+   * This is a function rather than a field, because we want to be able to provide values of type
+   * `ActionState<Fs>` to functions expecting `ActionState<As>` where `As` is a subset of `Fs`.
+   *
+   * Since function types are contravariant in the types of their parameters, using a function
+   * type here allows that to happen.
+   *
+   * Because the field is optional, we don't have to explicitly provide a value
+   * for it anywhere while the type is still inferred.
+   *
+   * `Fs[number]` returns the union of all features in `Fs`. We wrap it in `ImpliedFeatures`
+   * so that `Env` is expanded into `Env | ReadOnlyEnv`, allowing functions that expect the
+   * `ReadOnlyEnv` feature to be provided with an `ActionState` that has the `Env` feature
+   * without requiring this to be made explicit.
+   */
+  readonly [stateFeatures]?: (ts: ImpliedFeatures<Fs[number]>) => void;
+};
+
+/** Extends `state` with an `extra` feature. */
+export function extendActionState<
+  // In first position, so that it can be explicitly provided if `FeatureNameFor`
+  // should not work on `extra`.
+  F extends StateFeature,
+  Fs extends readonly StateFeature[],
+  E extends FeatureState[F],
+>(
+  state: ActionState<Fs>,
+  extra: E,
+): ActionState<[...Fs, FeatureNameFor<E> & F]> {
+  return { ...state, ...extra } as unknown as ActionState<
+    [...Fs, FeatureNameFor<E> & F]
+  >;
+}

 /** The type of an Action's main entry point. This is a function that is provided
 * with a basic `ActionState` object with features that are always available.
--- a/src/actions-util.ts
+++ b/src/actions-util.ts
@@ -30,7 +30,6 @@ declare const __CODEQL_ACTION_VERSION__: string;
 export interface ActionsEnv {
  getRequiredInput: (name: string) => string;
  getOptionalInput: (name: string) => string | undefined;
-  exportVariable: (name: string, value: string) => void;
 }

 /**
@@ -40,7 +39,6 @@ export function getActionsEnv(): ActionsEnv {
  return {
    getRequiredInput,
    getOptionalInput,
-    exportVariable: core.exportVariable,
  };
 }

--- a/src/analyze-action.ts
+++ b/src/analyze-action.ts
@@ -214,9 +214,10 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {

 async function run({
  startedAt,
+  env,
  logger,
  actions,
-}: ActionState<["Base", "Logger", "Actions"]>) {
+}: ActionState<["Base", "Env", "Logger", "Actions"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -287,7 +288,7 @@ async function run({

    const apiDetails = getApiDetails();
    const outputDir = actionsUtil.getRequiredInput("output");
-    core.exportVariable(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
+    env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
    const threads = util.getThreadsFlag(
      actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"],
      logger,
@@ -456,7 +457,7 @@ async function run({
        `expect-error input was set to true but no error was thrown.`,
      );
    }
-    core.exportVariable(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+    env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
  } catch (unwrappedError) {
    const error = util.wrapError(unwrappedError);
    if (
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -17,6 +17,7 @@ import {
  ReadOnlyEnv,
  RegistryProxyVars,
  getEnv,
+  exportEnvVar,
 } from "./environment";
 import { Logger } from "./logging";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
@@ -316,7 +317,7 @@ export async function getAnalysisKey(): Promise<string> {
  const jobName = getRequiredEnvParam("GITHUB_JOB");

  analysisKey = `${workflowPath}:${jobName}`;
-  core.exportVariable(EnvVar.ANALYSIS_KEY, analysisKey);
+  exportEnvVar(EnvVar.ANALYSIS_KEY, analysisKey);
  return analysisKey;
 }

--- a/src/autobuild-action.ts
+++ b/src/autobuild-action.ts
@@ -68,7 +68,11 @@ async function sendCompletedStatusReport(
  }
 }

-async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
+async function run({
+  startedAt,
+  env,
+  logger,
+}: ActionState<["Base", "Env", "Logger"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -135,7 +139,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
    return;
  }

-  core.exportVariable(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
+  env.export(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");

  await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
 }
--- a/src/autobuild.ts
+++ b/src/autobuild.ts
@@ -1,11 +1,9 @@
-import * as core from "@actions/core";
-
 import { getTemporaryDirectory, getWorkflowEventName } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { ActionsEnvVars, EnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -136,16 +134,16 @@ export async function setupCppAutobuild(codeql: CodeQL, logger: Logger) {
            : ""
        }`,
      );
-      core.exportVariable(envVar, "false");
+      exportEnvVar(envVar, "false");
    } else {
      logger.info(
        `Enabling ${featureName}. This can be disabled by setting the ${envVar} environment variable to 'false'. See ${DocUrl.DEFINE_ENV_VARIABLES} for more information.`,
      );
-      core.exportVariable(envVar, "true");
+      exportEnvVar(envVar, "true");
    }
  } else {
    logger.info(`Disabling ${featureName}.`);
-    core.exportVariable(envVar, "false");
+    exportEnvVar(envVar, "false");
  }
 }

@@ -165,7 +163,7 @@ export async function runAutobuild(
    await codeQL.runAutobuild(config, language);
  }
  if (language === BuiltInLanguage.go) {
-    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
+    exportEnvVar(EnvVar.DID_AUTOBUILD_GOLANG, "true");
  }
  logger.endGroup();
 }
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -17,7 +17,7 @@ import type { VersionInfo } from "./cli/types";
 import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar, getEnv, exportEnvVar } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -1054,7 +1054,7 @@ async function getCodeQLForCmd(
        }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
        "continue using this version of the CodeQL Action.",
    );
-    core.exportVariable(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
  }
  return codeql;
 }
--- a/src/config-utils.ts
+++ b/src/config-utils.ts
@@ -2,7 +2,6 @@ import * as fs from "fs";
 import * as path from "path";
 import { performance } from "perf_hooks";

-import * as core from "@actions/core";
 import * as yaml from "js-yaml";

 import { ActionState } from "./action-common";
@@ -46,7 +45,7 @@ import {
  makeTelemetryDiagnostic,
 } from "./diagnostics";
 import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportEnvVar } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
 import {
@@ -965,10 +964,10 @@ async function setCppTrapCachingEnvironmentVariables(
      );
    } else if (config.trapCaches[BuiltInLanguage.cpp]) {
      logger.info("Enabling TRAP caching for C/C++.");
-      core.exportVariable(envVar, "true");
+      exportEnvVar(envVar, "true");
    } else {
      logger.debug(`Disabling TRAP caching for C/C++.`);
-      core.exportVariable(envVar, "false");
+      exportEnvVar(envVar, "false");
    }
  }
 }
--- a/src/debug-artifacts.ts
+++ b/src/debug-artifacts.ts
@@ -11,7 +11,7 @@ import { dbIsFinalized } from "./analyze";
 import { scanArtifactsForTokens } from "./artifact-scanner";
 import { type CodeQL } from "./codeql";
 import { Config } from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportEnvVar } from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
 import { Logger, withGroup } from "./logging";
@@ -330,7 +330,7 @@ export async function uploadArtifacts(
  // some issues early.
  if (isInTestMode()) {
    await scanArtifactsForTokens(toUpload, logger);
-    core.exportVariable("CODEQL_ACTION_ARTIFACT_SCAN_FINISHED", "true");
+    exportEnvVar("CODEQL_ACTION_ARTIFACT_SCAN_FINISHED", "true");
  }

  const suffix = getArtifactSuffix(getOptionalInput("matrix"));
--- a/src/environment.test.ts
+++ b/src/environment.test.ts
@@ -0,0 +1,12 @@
+import test from "ava";
+
+import { Env, ReadOnlyEnv } from "./environment";
+import { getTestEnv, setupTests } from "./testing-utils";
+
+setupTests(test);
+
+test("isTestingEnv() is true", (t) => {
+  t.true(new ReadOnlyEnv(process.env).isTestingEnv());
+  t.true(new Env(process.env).isTestingEnv());
+  t.true(getTestEnv().isTestingEnv());
+});
--- a/src/environment.ts
+++ b/src/environment.ts
@@ -1,3 +1,10 @@
+import * as core from "@actions/core";
+
+/**
+ * This constant is set in `ava.setup.mjs` for tests.
+ */
+declare const __CODEQL_ACTION_TEST_ENV__: string | undefined;
+
 /**
 * Environment variables used by Default Setup to communicate the private registry proxy configuration.
 */
@@ -211,8 +218,20 @@ export enum ActionsEnvVars {
  RUNNER_TOOL_CACHE = "RUNNER_TOOL_CACHE",
 }

+/** Environment variables which are not specific to CodeQL. */
+export enum SystemEnvVar {
+  /**
+   * Used by Node and related tools to indicate what kind of environment we are running in.
+   */
+  NODE_ENV = "NODE_ENV",
+}
+
 /** A type representing all known environment variables. */
-export type KnownEnvVar = EnvVar | ActionsEnvVars | RegistryProxyVars;
+export type KnownEnvVar =
+  | EnvVar
+  | ActionsEnvVars
+  | RegistryProxyVars
+  | SystemEnvVar;

 /**
 * Gets an environment variable, but throws an error if it is not set.
@@ -289,6 +308,26 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
  public entries(): Array<[string, T]> {
    return Object.entries(this.vars);
  }
+
+  /**
+   * Gets a value indicating whether we should skip uploads of
+   * all kinds (SARIF results, status reports, DBs, ...).
+   *
+   * This is not guaranteed to be set in all test environments.
+   */
+  public isSkippingUploadsInTests(): boolean {
+    return this.getOptional(EnvVar.TEST_MODE) === "true";
+  }
+
+  /**
+   * Gets a value indicative of whether we are in a testing environment
+   * by testing whether the value of the `NODE_ENV` variable is "test".
+   * This is expected to be the case if e.g. `ava` is running the tests
+   * or if this instance was constructed by `getTestEnv`.
+   */
+  public isTestingEnv(): boolean {
+    return __CODEQL_ACTION_TEST_ENV__ === "unit-test";
+  }
 }

 /**
@@ -307,6 +346,26 @@ export class Env<
    this.changed = true;
  }

+  /**
+   * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
+   * when running unit tests. This is important, because otherwise `core.exportVariable`
+   * sets environment variables for other steps in a workflow when we run unit tests in CI.
+   *
+   * @param name The name of the environment variable to set and export.
+   * @param val The value to set and export for the environment variable.
+   */
+  public export(name: string, val: T): void {
+    // Setting the environment variable for this instance is always OK, including
+    // in tests, since we use fresh `Env` instances whenever needed. This allows
+    // tests to pass that rely on that part of the `core.exportVariable` behaviour.
+    this.set(name, val);
+
+    // Call `core.exportVariable` whenever we are not in a test environment.
+    if (!this.isTestingEnv()) {
+      core.exportVariable(name, val);
+    }
+  }
+
  /** Gets a value indicating whether `set` was called at least once. */
  public hasChanged(): boolean {
    return this.changed;
@@ -317,3 +376,34 @@ export class Env<
 export function getEnv(env: NodeJS.ProcessEnv = process.env): Env {
  return new Env(env);
 }
+
+/**
+ * Returns whether we are in test mode. This is used by CodeQL Action PR checks.
+ *
+ * In test mode, we skip several uploads (SARIF results, status reports, DBs, ...).
+ *
+ * @deprecated
+ *  The purpose of this function is ambiguous. Use `isSkippingUploadsInTests` on
+ *  a `ReadOnlyEnv` instance instead for equivalent behaviour. Use `isTestingEnv`
+ *  to determine if we are running in a unit test.
+ */
+export function isInTestMode(): boolean {
+  return getEnv().isSkippingUploadsInTests();
+}
+
+/**
+ * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
+ * when running unit tests. This is important, because otherwise `core.exportVariable`
+ * sets environment variables for other steps in a workflow when we run unit tests in CI.
+ *
+ * @deprecated Use `export` on an `Env` instance instead.
+ */
+export function exportEnvVar(name: string, val: any): void {
+  const env = getEnv();
+
+  if (typeof val === "string") {
+    env.export(name, val);
+  } else {
+    env.export(name, JSON.stringify(val));
+  }
+}
--- a/src/init-action-post.ts
+++ b/src/init-action-post.ts
@@ -21,7 +21,7 @@ import {
  DependencyCachingUsageReport,
  getDependencyCacheUsage,
 } from "./dependency-caching";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar, getEnv, exportEnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import * as initActionPostHelper from "./init-action-post-helper";
@@ -166,7 +166,7 @@ function getFinalJobStatus(config: Config | undefined): JobStatus {
  let jobStatus: JobStatus;

  if (process.env[EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY] === "true") {
-    core.exportVariable(EnvVar.JOB_STATUS, JobStatus.SuccessStatus);
+    exportEnvVar(EnvVar.JOB_STATUS, JobStatus.SuccessStatus);
    jobStatus = JobStatus.SuccessStatus;
  } else if (config !== undefined) {
    // - We have computed a CodeQL config
@@ -191,7 +191,7 @@ function getFinalJobStatus(config: Config | undefined): JobStatus {

  // This shouldn't be necessary, but in the odd case that we run more than one
  // `init` post step, ensure the job status is consistent between them.
-  core.exportVariable(EnvVar.JOB_STATUS, jobStatus);
+  exportEnvVar(EnvVar.JOB_STATUS, jobStatus);
  return jobStatus;
 }

--- a/src/init-action.ts
+++ b/src/init-action.ts
@@ -5,7 +5,12 @@ import * as core from "@actions/core";
 import * as io from "@actions/io";
 import * as semver from "semver";

-import { Action, ActionState, runInActions } from "./action-common";
+import {
+  Action,
+  ActionState,
+  extendActionState,
+  runInActions,
+} from "./action-common";
 import {
  FileCmdNotFoundError,
  getActionVersion,
@@ -93,7 +98,6 @@ import {
  checkActionVersion,
  getErrorMessage,
  BuildMode,
-  getOptionalEnvVar,
 } from "./util";
 import { checkWorkflow } from "./workflow";

@@ -253,7 +257,7 @@ async function run(
    );
    const repositoryProperties = repositoryPropertiesResult.orElse({});

-    core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true");
+    actionState.env.export(EnvVar.INIT_ACTION_HAS_RUN, "true");

    // path.resolve() respects the intended semantics of source-root. If
    // source-root is relative, it is relative to the GITHUB_WORKSPACE. If
@@ -278,7 +282,9 @@ async function run(
    }

    // Compute the value of the `config-file` input.
-    const actionStateWithFeatures = { ...actionState, features };
+    const actionStateWithFeatures = extendActionState(actionState, {
+      features,
+    });
    configFile = await getConfigFileInput(
      actionStateWithFeatures,
      repositoryProperties,
@@ -369,7 +375,7 @@ async function run(
        );
      }
      if (semver.lt(actualVer, publicPreview)) {
-        core.exportVariable(EnvVar.EXPERIMENTAL_FEATURES, "true");
+        actionState.env.export(EnvVar.EXPERIMENTAL_FEATURES, "true");
        logger.info("Experimental Rust analysis enabled");
      }
    }
@@ -517,9 +523,9 @@ async function run(
    }

    // Forward Go flags
-    const goFlags = process.env["GOFLAGS"];
+    const goFlags = actionState.env.getOptional("GOFLAGS");
    if (goFlags) {
-      core.exportVariable("GOFLAGS", goFlags);
+      actionState.env.export("GOFLAGS", goFlags);
      core.warning(
        "Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.",
      );
@@ -565,7 +571,7 @@ async function run(

            // Store the original location of our wrapper script somewhere where we can
            // later retrieve it from and cross-check that it hasn't been changed.
-            core.exportVariable(EnvVar.GO_BINARY_LOCATION, goWrapperPath);
+            actionState.env.export(EnvVar.GO_BINARY_LOCATION, goWrapperPath);
          } catch (e) {
            logger.warning(
              `Analyzing Go on Linux, but failed to install wrapper script. Tracing custom builds may fail: ${e}`,
@@ -574,7 +580,7 @@ async function run(
        } else {
          // Store the location of the original Go binary, so we can check that no setup tasks were performed after the
          // `init` Action ran.
-          core.exportVariable(EnvVar.GO_BINARY_LOCATION, goBinaryPath);
+          actionState.env.export(EnvVar.GO_BINARY_LOCATION, goBinaryPath);
        }
      } catch (e) {
        logger.warning(
@@ -609,12 +615,12 @@ async function run(
    // threads it would ask extractors to use. See help text for the "--ram" and "--threads"
    // options at https://codeql.github.com/docs/codeql-cli/manual/database-trace-command/
    // for details.
-    core.exportVariable(
+    actionState.env.export(
      "CODEQL_RAM",
      process.env["CODEQL_RAM"] ||
        getCodeQLMemoryLimit(getOptionalInput("ram"), logger).toString(),
    );
-    core.exportVariable(
+    actionState.env.export(
      "CODEQL_THREADS",
      process.env["CODEQL_THREADS"] ||
        getThreadsFlagValue(getOptionalInput("threads"), logger).toString(),
@@ -622,12 +628,15 @@ async function run(

    // Disable Kotlin extractor if feature flag set
    if (await features.getValue(Feature.DisableKotlinAnalysisEnabled)) {
-      core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
+      actionState.env.export(
+        "CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN",
+        "true",
+      );
    }

    // Emergency override to force the CodeQL CLI back to the JGit-based Git backend.
    if (await features.getValue(Feature.ForceJGit)) {
-      core.exportVariable("CODEQL_GIT_BACKEND", "jgit");
+      actionState.env.export("CODEQL_GIT_BACKEND", "jgit");
    }

    const kotlinLimitVar =
@@ -636,7 +645,7 @@ async function run(
      (await codeQlVersionAtLeast(codeql, "2.20.3")) &&
      !(await codeQlVersionAtLeast(codeql, "2.20.4"))
    ) {
-      core.exportVariable(kotlinLimitVar, "2.1.20");
+      actionState.env.export(kotlinLimitVar, "2.1.20");
    }

    // Restore dependency cache(s), if they exist.
@@ -685,7 +694,7 @@ async function run(
      config.buildMode === BuildMode.None &&
      config.languages.includes(BuiltInLanguage.java)
    ) {
-      core.exportVariable(
+      actionState.env.export(
        EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS,
        "true",
      );
@@ -743,7 +752,7 @@ async function run(
    const tracerConfig = await getCombinedTracerConfig(logger, codeql, config);
    if (tracerConfig !== undefined) {
      for (const [key, value] of Object.entries(tracerConfig.env)) {
-        core.exportVariable(key, value);
+        actionState.env.export(key, value);
      }
    }

@@ -751,10 +760,10 @@ async function run(
    if (await features.getValue(Feature.JavaNetworkDebugging)) {
      // Get the existing value of `JAVA_TOOL_OPTIONS`, if any.
      const existingJavaToolOptions =
-        getOptionalEnvVar(JavaEnvVars.JAVA_TOOL_OPTIONS) || "";
+        actionState.env.getOptional(JavaEnvVars.JAVA_TOOL_OPTIONS) ?? "";

      // Add the network debugging options.
-      core.exportVariable(
+      actionState.env.export(
        JavaEnvVars.JAVA_TOOL_OPTIONS,
        `${existingJavaToolOptions} -Djavax.net.debug=all`,
      );
--- a/src/init.test.ts
+++ b/src/init.test.ts
@@ -1,14 +1,13 @@
 import * as fs from "fs";
 import path from "path";

-import * as core from "@actions/core";
 import * as github from "@actions/github";
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
 import { createStubCodeQL } from "./codeql";
-import { ActionsEnvVars } from "./environment";
+import * as environment from "./environment";
 import { Feature } from "./feature-flags";
 import {
  checkPacksForOverlayCompatibility,
@@ -85,7 +84,7 @@ for (const { runnerEnv, ErrorConstructor, message } of [
    `cleanupDatabaseClusterDirectory throws a ${ErrorConstructor.name} when cleanup fails on ${runnerEnv} runner`,
    async (t) => {
      await withTmpDir(async (tmpDir: string) => {
-        process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;
+        process.env[environment.ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;

        const dbLocation = path.resolve(tmpDir, "dbs");
        fs.mkdirSync(dbLocation, { recursive: true });
@@ -546,7 +545,7 @@ test.serial(
 test.serial(
  "file coverage deprecation warning for org-owned repo with default setup recommends repo property",
  (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
    github.context.payload = {
      repository: {
@@ -566,14 +565,14 @@ test.serial(
        'with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to ' +
        "`true` in the repository's settings.",
    );
-    t.true(exportVariableStub.calledOnce);
+    t.true(exportEnvVarStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for org-owned repo with advanced setup recommends env var and repo property",
  (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
    github.context.payload = {
      repository: {
@@ -594,14 +593,14 @@ test.serial(
        'with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to ' +
        "`true` in the repository's settings.",
    );
-    t.true(exportVariableStub.calledOnce);
+    t.true(exportEnvVarStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for user-owned repo with default setup recommends advanced setup",
  (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
    github.context.payload = {
      repository: {
@@ -620,14 +619,14 @@ test.serial(
        "To opt out of this change, switch to an advanced setup workflow and " +
        "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportVariableStub.calledOnce);
+    t.true(exportEnvVarStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for user-owned repo with advanced setup recommends env var",
  (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
    github.context.payload = {
      repository: {
@@ -645,14 +644,14 @@ test.serial(
        "to improve analysis performance. File coverage information will still be computed on non-PR analyses.\n\n" +
        "To opt out of this change, set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportVariableStub.calledOnce);
+    t.true(exportEnvVarStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for unknown owner type with default setup recommends advanced setup",
  (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
    github.context.payload = { repository: undefined };
    const messages: LoggedMessage[] = [];
@@ -666,14 +665,14 @@ test.serial(
        "To opt out of this change, switch to an advanced setup workflow and " +
        "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportVariableStub.calledOnce);
+    t.true(exportEnvVarStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for unknown owner type with advanced setup recommends env var",
  (t) => {
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
    github.context.payload = { repository: undefined };
    const messages: LoggedMessage[] = [];
@@ -686,7 +685,7 @@ test.serial(
        "to improve analysis performance. File coverage information will still be computed on non-PR analyses.\n\n" +
        "To opt out of this change, set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportVariableStub.calledOnce);
+    t.true(exportEnvVarStub.calledOnce);
  },
 );

@@ -695,10 +694,10 @@ test.serial(
  (t) => {
    process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION"] =
      "true";
-    const exportVariableStub = sinon.stub(core, "exportVariable");
+    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
    const messages: LoggedMessage[] = [];
    logFileCoverageOnPrsDeprecationWarning(getRecordingLogger(messages));
    t.is(messages.length, 0);
-    t.true(exportVariableStub.notCalled);
+    t.true(exportEnvVarStub.notCalled);
  },
 );
--- a/src/init.ts
+++ b/src/init.ts
@@ -1,7 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";

-import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";
@@ -17,7 +16,7 @@ import {
 import { GitHubApiDetails } from "./api-client";
 import { CodeQL, setupCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportEnvVar } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -411,5 +410,5 @@ export function logFileCoverageOnPrsDeprecationWarning(logger: Logger): void {
  }

  logger.warning(message);
-  core.exportVariable(EnvVar.DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION, "true");
+  exportEnvVar(EnvVar.DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION, "true");
 }
--- a/src/overlay/caching.test.ts
+++ b/src/overlay/caching.test.ts
@@ -8,6 +8,7 @@ import * as sinon from "sinon";
 import * as actionsUtil from "../actions-util";
 import * as apiClient from "../api-client";
 import type { ResolveDatabaseOutput } from "../codeql";
+import * as environment from "../environment";
 import * as gitUtils from "../git-utils";
 import { BuiltInLanguage } from "../languages";
 import { getRunnerLogger } from "../logging";
@@ -82,7 +83,7 @@ const testDownloadOverlayBaseDatabaseFromCache = makeMacro({

      sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");

-      sinon.stub(utils, "isInTestMode").returns(testCase.isInTestMode);
+      sinon.stub(environment, "isInTestMode").returns(testCase.isInTestMode);

      if (testCase.restoreCacheResult instanceof Error) {
        sinon
--- a/src/setup-codeql-action.ts
+++ b/src/setup-codeql-action.ts
@@ -1,6 +1,11 @@
 import * as core from "@actions/core";

-import { Action, ActionState, runInActions } from "./action-common";
+import {
+  Action,
+  ActionState,
+  extendActionState,
+  runInActions,
+} from "./action-common";
 import {
  getActionVersion,
  getOptionalInput,
@@ -131,7 +136,9 @@ async function run(
    );
    const repositoryProperties = repositoryPropertiesResult.orElse({});

-    const actionStateWithFeatures = { ...actionState, features };
+    const actionStateWithFeatures = extendActionState(actionState, {
+      features,
+    });

    const statusReportBase = await createStatusReportBase(
      ActionName.SetupCodeQL,
@@ -184,7 +191,7 @@ async function run(
    core.setOutput("codeql-path", codeql.getPath());
    core.setOutput("codeql-version", (await codeql.getVersion()).version);

-    core.exportVariable(EnvVar.SETUP_CODEQL_ACTION_HAS_RUN, "true");
+    actionState.env.export(EnvVar.SETUP_CODEQL_ACTION_HAS_RUN, "true");
  } catch (unwrappedError) {
    const error = wrapError(unwrappedError);
    core.setFailed(error.message);
--- a/src/setup-codeql.ts
+++ b/src/setup-codeql.ts
@@ -3,7 +3,6 @@ import { OutgoingHttpHeaders } from "http";
 import * as path from "path";
 import { performance } from "perf_hooks";

-import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";
 import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
@@ -29,7 +28,7 @@ import {
  makeDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { EnvVar, getEnv } from "./environment";
+import { EnvVar, exportEnvVar, getEnv } from "./environment";
 import {
  CODEQL_VERSION_ZSTD_BUNDLE,
  CodeQLDefaultVersionInfo,
@@ -1071,7 +1070,7 @@ export async function setupCodeQLBundle(

  // Record that this job now has a copy of the CodeQL tools, so that a later step doesn't delete
  // the toolcache out from under the path we are about to return.
-  core.exportVariable(EnvVar.HAS_SET_UP_CODEQL, "true");
+  exportEnvVar(EnvVar.HAS_SET_UP_CODEQL, "true");

  return {
    codeqlFolder,
--- a/src/start-proxy-action.ts
+++ b/src/start-proxy-action.ts
@@ -3,7 +3,12 @@ import * as path from "path";

 import * as core from "@actions/core";

-import { Action, ActionState, runInActions } from "./action-common";
+import {
+  Action,
+  ActionState,
+  extendActionState,
+  runInActions,
+} from "./action-common";
 import * as actionsUtil from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { FeatureEnablement, initFeatures } from "./feature-flags";
@@ -98,7 +103,8 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    };

    // Start the Proxy
-    const proxyBin = await getProxyBinaryPath({ ...action, features });
+    const actionWithFeatures = extendActionState(action, { features });
+    const proxyBin = await getProxyBinaryPath(actionWithFeatures);
    const proxyInfo = await startProxy(
      proxyBin,
      proxyConfig,
--- a/src/status-report.ts
+++ b/src/status-report.ts
@@ -23,7 +23,13 @@ import type { ComputedInput, InputName } from "./config/inputs";
 import { parseRegistriesWithoutCredentials } from "./config/pack-registries";
 import type { DependencyCacheRestoreStatusReport } from "./dependency-caching";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment";
+import {
+  EnvVar,
+  getEnv,
+  ReadOnlyEnv,
+  RegistryProxyVars,
+  exportEnvVar,
+} from "./environment";
 import { getRef } from "./git-utils";
 import * as json from "./json";
 import type { Logger } from "./logging";
@@ -71,9 +77,7 @@ export function getDisplayActionName(actionName: ActionName): string {
 * environment and returns it.
 * If a new UUID is generated, it is also exported as an environment variable.
 */
-export function getJobUUID(
-  action: ActionState<["Logger", "ReadOnlyEnv", "Actions"]>,
-) {
+export function getJobUUID(action: ActionState<["Logger", "Env", "Actions"]>) {
  // Check if we already have a UUID for the analysis and return it if so.
  const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID);

@@ -86,7 +90,7 @@ export function getJobUUID(
  const jobRunUuid = uuid.v4();
  action.logger.info(`Job run UUID is ${jobRunUuid}.`);

-  action.actions.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid);
+  action.env.export(EnvVar.JOB_RUN_UUID, jobRunUuid);
  return jobRunUuid;
 }

@@ -268,12 +272,12 @@ export function getJobStatusDisplayName(status: JobStatus): string {
 */
 function setJobStatusIfUnsuccessful(actionStatus: ActionStatus) {
  if (actionStatus === "user-error") {
-    core.exportVariable(
+    exportEnvVar(
      EnvVar.JOB_STATUS,
      process.env[EnvVar.JOB_STATUS] ?? JobStatus.ConfigErrorStatus,
    );
  } else if (actionStatus === "failure" || actionStatus === "aborted") {
-    core.exportVariable(
+    exportEnvVar(
      EnvVar.JOB_STATUS,
      process.env[EnvVar.JOB_STATUS] ?? JobStatus.FailureStatus,
    );
@@ -376,7 +380,7 @@ export async function createStatusReportBase(
    let workflowStartedAt = process.env[EnvVar.WORKFLOW_STARTED_AT];
    if (workflowStartedAt === undefined) {
      workflowStartedAt = actionStartedAt.toISOString();
-      core.exportVariable(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt);
+      exportEnvVar(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt);
    }
    const runnerOs = getRequiredEnvParam("RUNNER_OS");
    const codeQlCliVersion = getCachedCodeQlVersion(
@@ -388,7 +392,7 @@ export async function createStatusReportBase(
    // re-export the testing environment variable so that it is available to subsequent steps,
    // even if it was only set for this step
    if (testingEnvironment) {
-      core.exportVariable(EnvVar.TESTING_ENVIRONMENT, testingEnvironment);
+      exportEnvVar(EnvVar.TESTING_ENVIRONMENT, testingEnvironment);
    }
    const isSteadyStateDefaultSetupRun =
      process.env["CODE_SCANNING_IS_STEADY_STATE_DEFAULT_SETUP"] === "true";
--- a/src/testing-utils.ts
+++ b/src/testing-utils.ts
@@ -202,10 +202,6 @@ class TestActionsEnv implements ActionsEnv {
  public getOptionalInput(_name: string): string | undefined {
    return undefined;
  }
-
-  public exportVariable(name: string, value: string): void {
-    this.env.set(name, value);
-  }
 }

 /**
--- a/src/upload-lib.ts
+++ b/src/upload-lib.ts
@@ -14,7 +14,7 @@ import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import { getConfig } from "./config-utils";
 import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
 import * as gitUtils from "./git-utils";
@@ -126,7 +126,7 @@ async function combineSarifFilesUsingCLI(
      logger.warning(
        `Uploading multiple SARIF runs with the same category is deprecated ${deprecationWarningMessage}. Please update your workflow to upload a single run per category. ${deprecationMoreInformationMessage}`,
      );
-      core.exportVariable("CODEQL_MERGE_SARIF_DEPRECATION_WARNING", "true");
+      exportEnvVar("CODEQL_MERGE_SARIF_DEPRECATION_WARNING", "true");
    }

    // If not, use the naive method of combining the files.
@@ -1032,7 +1032,7 @@ export function validateUniqueCategory(
          `Category: (${id ? id : "none"}) Tool: (${tool ? tool : "none"})`,
      );
    }
-    core.exportVariable(sentinelEnvVar, sentinelEnvVar);
+    exportEnvVar(sentinelEnvVar, sentinelEnvVar);
  }
 }

--- a/src/util.ts
+++ b/src/util.ts
@@ -14,13 +14,23 @@ import * as apiCompatibility from "./api-compatibility.json";
 import type { CodeQL } from "./codeql";
 import type { Pack } from "./config/db-config";
 import type { Config } from "./config-utils";
-import { EnvVar, getRequiredEnvParam } from "./environment";
+import {
+  EnvVar,
+  getRequiredEnvParam,
+  isInTestMode,
+  exportEnvVar,
+} from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
 import { Logger } from "./logging";

 // Re-export for backwards compatibility to avoid updating a lot of imports elsewhere.
-export { getRequiredEnvParam, getOptionalEnvVar, getEnv } from "./environment";
+export {
+  getRequiredEnvParam,
+  getOptionalEnvVar,
+  getEnv,
+  isInTestMode,
+} from "./environment";

 /**
 * The name of the file containing the base database OIDs, as stored in the
@@ -542,7 +552,7 @@ export function checkGitHubVersionInRange(
    );
  }
  hasBeenWarnedAboutVersion = true;
-  core.exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
+  exportEnvVar(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
 }

 export enum DisallowedAPIVersionReason {
@@ -586,11 +596,11 @@ export function assertNever(value: never): never {
 * knowing what version of CodeQL we're running.
 */
 export function initializeEnvironment(version: string) {
-  core.exportVariable(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
-  core.exportVariable(EnvVar.FEATURE_SANDWICH, "false");
-  core.exportVariable(EnvVar.FEATURE_SARIF_COMBINE, "true");
-  core.exportVariable(EnvVar.FEATURE_WILL_UPLOAD, "true");
-  core.exportVariable(EnvVar.VERSION, version);
+  exportEnvVar(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
+  exportEnvVar(EnvVar.FEATURE_SANDWICH, "false");
+  exportEnvVar(EnvVar.FEATURE_SARIF_COMBINE, "true");
+  exportEnvVar(EnvVar.FEATURE_WILL_UPLOAD, "true");
+  exportEnvVar(EnvVar.VERSION, version);
 }

 export class HTTPError extends Error {
@@ -711,15 +721,6 @@ export function isGoodVersion(versionSpec: string) {
  return !BROKEN_VERSIONS.includes(versionSpec);
 }

-/**
- * Returns whether we are in test mode. This is used by CodeQL Action PR checks.
- *
- * In test mode, we skip several uploads (SARIF results, status reports, DBs, ...).
- */
-export function isInTestMode(): boolean {
-  return process.env[EnvVar.TEST_MODE] === "true";
-}
-
 /**
 * Returns whether we specifically want to skip uploading SARIF files.
 */
@@ -948,7 +949,7 @@ export async function checkDiskUsage(
      } else {
        logger.debug(message);
      }
-      core.exportVariable(EnvVar.HAS_WARNED_ABOUT_DISK_SPACE, "true");
+      exportEnvVar(EnvVar.HAS_WARNED_ABOUT_DISK_SPACE, "true");
    }
    return {
      numAvailableBytes: diskUsage.bavail * blockSizeInBytes,
@@ -997,7 +998,7 @@ export function checkActionVersion(
          "https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/",
      );
      // set LOG_VERSION_DEPRECATION env var to prevent the warning from being logged multiple times
-      core.exportVariable(EnvVar.LOG_VERSION_DEPRECATION, "true");
+      exportEnvVar(EnvVar.LOG_VERSION_DEPRECATION, "true");
    }
  }
 }
--- a/start-proxy/action.yml
+++ b/start-proxy/action.yml
@@ -29,6 +29,6 @@ outputs:
  proxy_urls:
    description: A stringified JSON array of objects containing the types and URLs of the configured registries.
 runs:
-  using: node20
+  using: node24
  main: "../lib/start-proxy-entry.js"
  post: "../lib/start-proxy-post-entry.js"
--- a/upload-sarif/action.yml
+++ b/upload-sarif/action.yml
@@ -41,6 +41,6 @@ outputs:

      { "code-scanning": "some-id", "code-quality": "some-other-id" }
 runs:
-  using: node20
+  using: node24
  main: '../lib/upload-sarif-entry.js'
  post: '../lib/upload-sarif-post-entry.js'
Author	SHA1	Message	Date
Michael B. Gale	6e7fe2e990	Merge pull request #4220 from github/mbg/fix-action-state-type-inference Fix type inference for `ActionState`	2026-10-09 22:31:18 +00:00
Michael B. Gale	71f2680f85	Merge pull request #4209 from github/dependabot/npm_and_yarn/eslint-plugin-jsdoc-65.0.1 Bump eslint-plugin-jsdoc from 64.5.4 to 65.0.1	2026-10-09 17:59:37 +00:00
Michael B. Gale	3b399fec34	Merge branch 'main' into dependabot/npm_and_yarn/eslint-plugin-jsdoc-65.0.1	2026-10-09 18:47:49 +01:00
Mario Campos	5532d8e11e	Merge pull request #4218 from github/mario-campos/loosen-changenote-validation Do not validate change-note file names or frontmatter	2026-10-09 17:45:19 +00:00
Michael B. Gale	68f5b579fa	Merge pull request #4212 from github/mbg/tests/fix-export-variable-2 Do not use `core.exportVariable` in unit tests (2nd attempt)	2026-10-09 17:38:52 +00:00
Mario Campos	45cda5b577	Delete unused `path` import	2026-10-09 08:57:09 -05:00
Michael B. Gale	e57c0e65dd	Fix type inference for `ActionState`	2026-10-09 14:21:47 +01:00
Mario Campos	1ced68ed2f	Do not validate change-note file names or frontmatter Presently, the strict filename or frontmatter are not being used; so we're validating them unnecessarily. So, for now, remove these checks until we decide to either do something with them, or delete the code entirely.	2026-10-08 15:11:43 -05:00
Michael B. Gale	bd97dda6bf	Add and use `__CODEQL_ACTION_TEST_ENV__` in tests	2026-10-08 20:23:37 +01:00
Michael B. Gale	d6196d8703	Rename `exportVariable` wrapper to `exportEnvVar`	2026-10-08 20:06:51 +01:00
Mads Navntoft	5aa5056e2d	Merge pull request #4215 from github/mergeback/v4.38.3-to-main-24c54180 Mergeback v4.38.3 refs/heads/releases/v4 into main	2026-10-08 13:58:42 +00:00
github-actions[bot]	ea60dc6408	Rebuild	2026-10-08 13:01:10 +00:00
github-actions[bot]	ce3f825b1d	Update changelog and version after v4.38.3	2026-10-08 13:01:02 +00:00
Michael B. Gale	ebd711ff66	Deprecate `isInTestMode` in favour of a more clearly named method	2026-10-07 20:12:01 +01:00
Michael B. Gale	75ea4cb2e4	Add `NODE_ENV` as safe environment variable	2026-10-07 20:12:01 +01:00
Michael B. Gale	59ff83ecef	Add basic eslint enforcement	2026-10-07 20:12:01 +01:00
Michael B. Gale	1728f0c676	Add wrapper around `core.exportVariable`	2026-10-07 20:12:00 +01:00
Michael B. Gale	63c5299790	Move `isInTestMode` to `environment.ts`	2026-10-07 20:12:00 +01:00
dependabot[bot]	d5b1e793ce	Bump eslint-plugin-jsdoc from 64.5.4 to 65.0.1 Bumps [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) from 64.5.4 to 65.0.1. - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v64.5.4...v65.0.1) --- updated-dependencies: - dependency-name: eslint-plugin-jsdoc dependency-version: 65.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-07 17:55:31 +00:00