Avoid ESM-specific entry check for now

Avoid using `-latest` runner labels in CI

.editorconfig

@@ -8,3 +8,6 @@ trim_trailing_whitespace = true
 [*.ts]
 indent_style = space
 indent_size = 2
+
+[*.(yml|yaml)]
+indent_size = 2

.github/ISSUE_TEMPLATE/config.yml

@@ -2,4 +2,4 @@ blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
     url: https://support.github.com/request
-    about: Contact Support 
+    about: Contact Support

.github/actions/check-codescanning-config/action.yml

@@ -1,7 +1,7 @@
 name: Check Code-Scanning Config
 description: |
-    Checks the code scanning configuration file generated by the
-    action to ensure it contains the expected contents
+  Checks the code scanning configuration file generated by the
+  action to ensure it contains the expected contents
 inputs:
   languages:
     required: false
@@ -52,7 +52,7 @@ runs:
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/codescanning-config-cli-test
       env:
-        CODEQL_ACTION_TEST_MODE: 'true'
+        CODEQL_ACTION_TEST_MODE: "true"
 
     - name: Install dependencies
       shell: bash
@@ -62,7 +62,7 @@ runs:
       working-directory: ${{ github.action_path }}
       shell: bash
       env:
-        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
+        EXPECTED_CONFIG_FILE_CONTENTS: "${{ inputs.expected-config-file-contents }}"
       run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
     - name: Clean up
       shell: bash

.github/actions/prepare-mergeback-branch/action.yml

@@ -92,8 +92,7 @@ runs:
           Please do the following:
 
           - [ ] Approve running the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
-                selected rather than "Squash and merge" or "Rebase and merge".
+          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is selected rather than "Squash and merge" or "Rebase and merge".
         EOF
         )
 

.github/actions/prepare-test/action.yml

@@ -6,11 +6,11 @@ inputs:
     required: true
   use-all-platform-bundle:
     description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
+    default: "false"
     required: false
   setup-kotlin:
     description: "If true, we setup kotlin"
-    default: 'true'
+    default: "true"
     required: true
 outputs:
   tools-url:
@@ -73,7 +73,10 @@ runs:
           exit 1
         fi
 
-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
+    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
-        version: 1.8.21
+        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
+        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
+        # version on the `ubuntu-latest` runners and CodeQL.
+        version: 2.1.20

.github/actions/query-filter-test/action.yml

@@ -54,7 +54,7 @@ runs:
     - name: Check SARIF
       uses: ./../action/.github/actions/check-sarif
       with:
-        sarif-file:  ${{ inputs.sarif-file }}
+        sarif-file: ${{ inputs.sarif-file }}
         queries-run: ${{ inputs.queries-run}}
         queries-not-run: ${{ inputs.queries-not-run}}
     - name: Cleanup after test

.github/actions/release-branches/action.yml

@@ -1,11 +1,11 @@
-name: 'Release branches'
-description: 'Determine branches for release & backport'
+name: "Release branches"
+description: "Determine branches for release & backport"
 inputs:
   major_version:
-    description: 'The version as extracted from the package.json file'
+    description: "The version as extracted from the package.json file"
     required: true
   latest_tag:
-    description: 'The most recent tag published to the repository'
+    description: "The most recent tag published to the repository"
     required: true
 outputs:
   backport_source_branch:

.github/actions/release-initialise/action.yml

@@ -1,41 +1,29 @@
-name: 'Prepare release job'
-description: 'Prepare for updating a release branch'
+name: "Prepare release job"
+description: "Prepare for updating a release branch"
 
 runs:
   using: "composite"
   steps:
-
     - name: Dump environment
       run: env
       shell: bash
 
     - name: Dump GitHub context
       env:
-        GITHUB_CONTEXT: '${{ toJson(github) }}'
+        GITHUB_CONTEXT: "${{ toJson(github) }}"
       run: echo "$GITHUB_CONTEXT"
       shell: bash
 
     - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
-        cache: 'npm'
+        cache: "npm"
 
     - name: Install JavaScript dependencies
       shell: bash
       run: npm ci
 
-    - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: '3.12'
-
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install PyGithub==2.3.0 requests
-      shell: bash
-
     - name: Update git config
       run: |
         git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

.github/copilot-instructions.md

@@ -1,14 +1,46 @@
 # CodeQL Action - Copilot Instructions
 
+The CodeQL Action is used in GitHub Actions workflows to run CodeQL scans using the CodeQL CLI.
+
+## Overview
+
+- The repository contains two TypeScript projects.
+- The main TypeScript codebase is in the `src` directory, with accompanying unit tests in `.test.ts` files in the same directory.
+- The main codebase is compiled to bundled JavaScript code, which is also contained in the repository in the `lib` directory.
+- A secondary TypeScript codebase with scripts that are only used for development purposes or by CI is in the `pr-checks` directory. This codebase is not compiled to bundled JavaScript. It is executed directly with `tsx`, which handles compilation internally.
+
+## Review instructions
+
+- Prioritise identifying critical issues, such as logic bugs, over comments on documentation or typos.
+- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Never word suggestions as commands or using the imperative. Examples of what you should never write: "Preserve that non-fatal behaviour here" or "Please preserve that non-fatal behaviour here".
+- When writing feedback, assume that the PR author is competent and is able to understand whether the point you are making is valid or not, why you are raising it, and how to best address it. While you can suggest how to address a point you are making, don't phrase it as a requirement or assume that it is the only solution.
+- Always word your comments constructively as suggestions for improvements, for example: "It would make sense to ..." or "Could you add ...?" or "Would it make sense to ...?"
+- If you want to comment on a change that you believe will fail a CI check, do not present the CI failure you expect as a fact. Instead, write that you think a change "may" lead to a failure in CI. Suggest that, if such a failure manifests, the changes you are commenting on may be the place responsible for the failure and are worth looking at.
+- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one or prefix your comment with "Minor: ".
+- If a change is a net improvement, for example because it improves on an existing limitation of existing code, do not complain about pre-existing problems that remain. You may comment on them, but you should make it clear that the thing you are commenting on is not new by writing e.g. "Not new in this PR, but [..]" followed by your description of the issue and a suggestion that it could be improved at the same time with e.g. "Consider whether this is worth addressing as part of this PR as well."
+
 ## Generated code
 
-The CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from.
+The main codebase of the CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from. The secondary TypeScript codebase has sources in the `pr-checks` directory, which are executed directly with `tsx` and not compiled to JavaScript in the `lib` folder.
 
 GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that start with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.
 
+## Feature flags
+
+Some functionality in the code may be gated behind feature flags, which are controlled server-side. If the functionality that is gated behind them is user-facing, then this should be documented in a change note at the time that the gated functionality is added. See `CHANGELOG.md` for existing notes that mention "experimental" for examples. These typically include information about when users may expect to see the feature rolled out.
+
+When a feature flag that gates some functionality is removed, this does not need to be documented in a change note since the feature is already rolled out and the notes for the release which introduced the feature already describe it. The only exception is functionality which will start having an effect on GHES as a result of the feature flag removal:
+
+- Most functionality gated behind feature flags does not affect GHES.
+- We can make functionality available on GHES by setting `defaultValue` to `true` first and waiting for this to have had an effect on GHES. No change note is needed if a feature flag is removed where `defaultValue` was `true`.
+- When removing a feature flag where `defaultValue` was `false` and the functionality starts to affect GHES, a change note may be appropriate.
+
 ## Release process
 
+Changes that are merged to the `main` branch are not used in production straight away. Instead, changes from `main` must first be released using the release process, which has to be manually triggered by a staff member. Therefore, it is possible for further changes to be made to the code after some changes have been merged to `main` but before they are released. Once the release process automation is started, a series of PRs are automatically generated:
+
 - A release-PR is a PR which matches all of the following patterns:
+
   - PR title starts with the exact prefix: `Merge main into releases/v`
     - Equivalent regex: `^Merge main into releases\/v`
   - AND head (source) branch matches the update-branch pattern:
@@ -17,5 +49,5 @@ GitHub Actions workflows in the `.github/workflows` directory whose filenames st
     - Regex: `^releases\/v` (e.g. `releases/v3`)
 
 - Consider all files in release-PRs to have already been reviewed and do not review them, except for the following two files:
-    - `CHANGELOG.md`
-    - `package.json`
+  - `CHANGELOG.md`
+  - `package.json`

.github/dependabot.yml

@@ -8,8 +8,6 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
-      exclude:
-        - "@actions/*"
     labels:
       - Rebuild
     # Ignore incompatible dependency updates
@@ -18,6 +16,14 @@ updates:
       # This might be fixed when we move to eslint v9.
       - dependency-name: "eslint-plugin-import"
         versions: [">=2.30.0"]
+
+      # Some of our dependencies are lagging behind with support for new versions of
+      # `undici` which is why we have to override it in `package.json`. Dependabot
+      # workflows fail when they try to update a dependency that is explicitly
+      # overriden. Since this happens somewhat routinely at the moment, we are
+      # excluding `undici` here and have to manually update it when needed.
+      - dependency-name: "undici"
+        versions: [">=7.30.1"]
     groups:
       npm-minor:
         patterns:
@@ -28,13 +34,11 @@ updates:
   - package-ecosystem: github-actions
     directories:
       - "/.github/workflows"
-      - "/.github/actions"
+      - "/.github/actions/*/"
     schedule:
       interval: weekly
     cooldown:
       default-days: 7
-      exclude:
-        - "actions/*"
     labels:
       - Rebuild
     groups:

.github/instructions/release-merge.instructions.md

@@ -0,0 +1,16 @@
+---
+applyTo: "CHANGELOG.md,src/defaults.json,lib/defaults.json,src/api-compatibility.json"
+---
+
+# Merging release, mergeback, and backport PRs
+
+The release process creates a cascade of PRs (`main` → `releases/vN`, then
+`releases/vN` → `main` mergeback, then `releases/vN` → `releases/v(N-1)`
+backport). These PRs reliably touch `CHANGELOG.md`, `src/defaults.json` /
+`lib/defaults.json` (bundle/CLI version bump), and `src/api-compatibility.json`.
+
+Such PRs **must be merged with a merge commit**. Never squash or rebase, as
+that breaks the branch linkage the release automation relies on.
+
+When arming auto-merge on these PRs, use `--merge` (e.g. `gh pr merge --merge`),
+not `--squash` or `--rebase`.

.github/workflows/__all-platform-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26-xlarge
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: All-platform bundle
     if: github.triggering_actor != 'dependabot[bot]'
@@ -69,13 +69,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'true'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "true"
+          setup-kotlin: "true"
       - id: init
         uses: ./../action/init
         with:

.github/workflows/__analysis-kinds.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,28 +34,28 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
             analysis-kinds: risk-assessment
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds
@@ -67,14 +67,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: javascript
@@ -82,24 +82,24 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
-          post-processed-sarif-path: '${{ runner.temp }}/post-processed'
+          post-processed-sarif-path: "${{ runner.temp }}/post-processed"
 
       - name: Upload SARIF files
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: '${{ runner.temp }}/results/*.sarif'
+          path: "${{ runner.temp }}/results/*.sarif"
           retention-days: 7
 
       - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: '${{ runner.temp }}/post-processed'
+          path: "${{ runner.temp }}/post-processed"
           retention-days: 7
           if-no-files-found: error
 
@@ -107,16 +107,16 @@ jobs:
         if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
-          EXPECT_PRESENT: 'false'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          EXPECT_PRESENT: "false"
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
-          EXPECT_PRESENT: 'true'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
+          EXPECT_PRESENT: "true"
         with:
           script: ${{ env.CHECK_SCRIPT }}
     env:

.github/workflows/__analyze-ref-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -91,7 +91,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__autobuild-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -44,11 +44,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: autobuild-action
     if: github.triggering_actor != 'dependabot[bot]'
@@ -59,9 +59,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Prepare test
@@ -69,8 +69,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: csharp
@@ -78,12 +78,12 @@ jobs:
       - uses: ./../action/autobuild
         env:
           # Explicitly disable the CLR tracer.
-          COR_ENABLE_PROFILING: ''
-          COR_PROFILER: ''
-          COR_PROFILER_PATH_64: ''
-          CORECLR_ENABLE_PROFILING: ''
-          CORECLR_PROFILER: ''
-          CORECLR_PROFILER_PATH_64: ''
+          COR_ENABLE_PROFILING: ""
+          COR_PROFILER: ""
+          COR_PROFILER_PATH_64: ""
+          CORECLR_ENABLE_PROFILING: ""
+          CORECLR_PROFILER: ""
+          CORECLR_PROFILER_PATH_64: ""
       - uses: ./../action/analyze
       - name: Check database
         run: |

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
 defaults:
   run:
     shell: bash
@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     if: github.triggering_actor != 'dependabot[bot]'
@@ -61,9 +61,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
@@ -72,8 +72,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__autobuild-working-dir.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Autobuild working directory
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__build-mode-autobuild.yml

@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
 defaults:
   run:
     shell: bash
@@ -44,13 +44,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Build mode autobuild
     if: github.triggering_actor != 'dependabot[bot]'
@@ -61,9 +61,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -92,7 +92,7 @@ jobs:
         id: init
         with:
           build-mode: autobuild
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-manual.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode manual
     if: github.triggering_actor != 'dependabot[bot]'
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -80,13 +80,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           build-mode: manual
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-none.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode none
     if: github.triggering_actor != 'dependabot[bot]'
@@ -47,19 +47,19 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__build-mode-rollback.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Build mode rollback
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -63,7 +63,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__bundle-from-nightly.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From nightly'
+name: "PR Check - Bundle: From nightly"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-    name: 'Bundle: From nightly'
+    name: "Bundle: From nightly"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - id: init
         uses: ./../action/init
         env:

.github/workflows/__bundle-from-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From toolcache'
+name: "PR Check - Bundle: From toolcache"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: toolcache
-    name: 'Bundle: From toolcache'
+    name: "Bundle: From toolcache"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -45,39 +45,37 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Check toolcache contains CodeQL
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            if (allCodeqlVersions.length === 0) {
-              throw new Error(`CodeQL could not be found in the toolcache`);
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed
+
       - id: setup-codeql
         uses: ./../action/setup-codeql
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-            if (allCodeqlVersions.length === 0) {
-              throw new Error('CodeQL not found in toolcache');
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__bundle-toolcache.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: Caching checks'
+name: "PR Check - Bundle: Caching checks"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
-    name: 'Bundle: Caching checks'
+    name: "Bundle: Caching checks"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -49,55 +49,48 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-            fs.rmdirSync(codeqlPath, { recursive: true });
-      - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts clear
+
       - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            if (allCodeqlVersions.length !== 0) {
-              throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
-            }
-            console.log('No versions of CodeQL found in the toolcache');
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts absent
+
       - id: init
         uses: ./../action/init
         with:
-          languages: javascript
+          # Request multiple languages so this check uses the combined bundle.
+          languages: javascript,python
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+
       - uses: ./../action/analyze
         with:
           output: ${{ runner.temp }}/results
           upload-database: false
+
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-            if (allCodeqlVersions.length === 0) {
-              throw new Error('CodeQL not found in toolcache');
-            }
-            if (allCodeqlVersions.length > 1) {
-              throw new Error('Multiple CodeQL versions found in toolcache');
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed -n 1
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__bundle-zstd.yml

@@ -1,120 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: 'PR Check - Bundle: Zstandard checks'
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-zstd-${{github.ref}}
-jobs:
-  bundle-zstd:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
-    name: 'Bundle: Zstandard checks'
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-            if (codeqlPath !== undefined) {
-              fs.rmdirSync(codeqlPath, { recursive: true });
-            }
-      - id: init
-        uses: ./../action/init
-        with:
-          languages: javascript
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - uses: ./../action/analyze
-        with:
-          output: ${{ runner.temp }}/results
-          upload-database: false
-      - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.os }}-zstd-bundle.sarif
-          path: ${{ runner.temp }}/results/javascript.sarif
-          retention-days: 7
-      - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
-        with:
-          script: |
-            const fs = require('fs');
-
-            const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
-            const run = sarif.runs[0];
-
-            const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
-            const downloadTelemetryNotifications = toolExecutionNotifications.filter(n =>
-              n.descriptor.id === 'codeql-action/bundle-download-telemetry'
-            );
-            if (downloadTelemetryNotifications.length !== 1) {
-              core.setFailed(
-                'Expected exactly one reporting descriptor in the ' +
-                  `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-                  `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` +
-                  `${JSON.stringify(toolExecutionNotifications)}.`
-              );
-            }
-
-            const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl;
-            console.log(`Found tools URL: ${toolsUrl}`);
-
-            const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst';
-
-            if (!toolsUrl.endsWith(expectedExtension)) {
-              core.setFailed(
-                `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.`
-              );
-            }
-    env:
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Clean up database cluster directory
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Add a file to the database cluster directory
         run: |
           mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
@@ -62,7 +62,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__config-export.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Config export
     if: github.triggering_actor != 'dependabot[bot]'
@@ -47,14 +47,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: javascript
@@ -62,18 +62,18 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check config properties appear in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
         with:
           script: |
             const fs = require('fs');

.github/workflows/__config-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Config input
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,12 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test
@@ -58,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Copy queries into workspace
         run: |
           cp -a ../action/queries .

.github/workflows/__cpp-deptrace-disabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)'
+name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    name: "C/C++: disabling autoinstalling dependencies (Linux)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -49,14 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)'
+name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    name: "C/C++: autoinstalling dependencies is skipped (macOS)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -47,14 +47,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cpp-deptrace-enabled.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: autoinstalling dependencies (Linux)'
+name: "PR Check - C/C++: autoinstalling dependencies (Linux)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'C/C++: autoinstalling dependencies (Linux)'
+    name: "C/C++: autoinstalling dependencies (Linux)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -49,14 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__diagnostics-export.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Diagnostic export
     if: github.triggering_actor != 'dependabot[bot]'
@@ -47,14 +47,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -73,64 +82,21 @@ jobs:
             --ready-for-status-page
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
+
       - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
-        with:
-          script: |
-            const fs = require('fs');
-
-            function checkStatusPageNotification(n) {
-              const expectedMessage = 'Plaintext message';
-              if (n.message.text !== expectedMessage) {
-                core.setFailed(`Expected the status page diagnostic to have the message '${expectedMessage}', but found '${n.message.text}'.`);
-              }
-              if (n.locations.length !== 1) {
-                core.setFailed(`Expected the status page diagnostic to have exactly 1 location, but found ${n.locations.length}.`);
-              }
-            }
-
-            const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
-            const run = sarif.runs[0];
-
-            const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
-            const statusPageNotifications = toolExecutionNotifications.filter(n =>
-              n.descriptor.id === 'lang/diagnostics/example' && n.properties?.visibility?.statusPage
-            );
-            if (statusPageNotifications.length !== 1) {
-              core.setFailed(
-                'Expected exactly one status page reporting descriptor for this diagnostic in the ' +
-                  `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-                  `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-                  `${JSON.stringify(toolExecutionNotifications)}.`
-              );
-            }
-            checkStatusPageNotification(statusPageNotifications[0]);
-
-            const notifications = run.tool.driver.notifications;
-            const diagnosticNotification = notifications.filter(n =>
-              n.id === 'lang/diagnostics/example' && n.name === 'lang/diagnostics/example' &&
-                n.fullDescription.text === 'Diagnostic name'
-            );
-            if (diagnosticNotification.length !== 1) {
-              core.setFailed(
-                'Expected exactly one notification for this diagnostic in the ' +
-                  `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-                  `${diagnosticNotification.length}. All notifications: ` +
-                  `${JSON.stringify(notifications)}.`
-              );
-            }
-
-            core.info('Finished diagnostic export test');
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+        run: |
+          cd ../action
+          npx tsx ./pr-checks/check-diagnostics.ts
     env:
       CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__diagnostics-without-db.yml

@@ -0,0 +1,143 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Diagnostic export without database
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: diagnostics-without-db-${{github.ref}}
+jobs:
+  diagnostics-without-db:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-26.04
+            version: linked
+    name: Diagnostic export without database
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      # We deliberately need to make this step fail before the database is initialised, but after
+      # some diagnostic has been produced. The simplest way to do that right now is to:
+      #
+      # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
+      #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
+      # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
+      #
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
+      - name: Initialise failing analysis
+        id: init
+        uses: ./../action/init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_FORCE_NIGHTLY: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        uses: ./analyze
+        # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
+        # above, we manually disable it with an `if` condition. Having this step is required
+        # for the init post-action because it checks the workflow definition for e.g. the
+        # `category` input. Without this step, that part of the init post-action would fail.
+        if: false
+        with:
+          category: "/test-codeql-version:${{ matrix.version }}"
+
+      - name: Check diagnostics appear on disk
+        env:
+          DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
+        run: |
+          cd ../action
+          npx tsx ./pr-checks/diagnostics-without-db.ts
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  diagnostics-without-db-validation:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - diagnostics-without-db
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
+          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__export-file-baseline-information.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Export file baseline information
     if: github.triggering_actor != 'dependabot[bot]'
@@ -69,13 +69,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -84,23 +84,28 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+          # To balance speed and coverage, analyze only JavaScript but use the combined bundle so
+          # baseline information is reported for every language in the multi-language repository. A
+          # custom configuration prevents per-language bundles from being used.
+          config: |
+            paths-ignore: []
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check results
         run: |

.github/workflows/__extractor-ram-threads.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Extractor ram and threads options test
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: java

.github/workflows/__global-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Proxy test
     if: github.triggering_actor != 'dependabot[bot]'
@@ -47,25 +47,53 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'false'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "false"
+      - name: Block direct internet access to force proxy usage
+        run: |
+          apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1
+          PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+          echo "Squid proxy IP: $PROXY_IP"
+          # Allow all traffic to the proxy container
+          iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT
+          # Allow DNS resolution
+          iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+          iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+          # Allow loopback
+          iptables -A OUTPUT -o lo -j ACCEPT
+          # Allow already-established connections (from checkout/prepare-test)
+          iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          # Block all other outbound HTTP and HTTPS, ensuring direct access fails
+          iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
+          iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
+          echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy"
+
+      - name: Set proxy environment variables
+        shell: bash
+        run: |
+          echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
+          echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
+          echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
+          echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
+
       - uses: ./../action/init
         with:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+
       - uses: ./../action/analyze
     env:
-      https_proxy: http://squid-proxy:3128
       CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true
       CODEQL_ACTION_TEST_MODE: true
     container:
       image: ubuntu:22.04
+      options: --cap-add=NET_ADMIN
     services:
       squid-proxy:
         image: ubuntu/squid:latest

.github/workflows/__go-custom-queries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: Custom queries'
+name: "PR Check - Go: Custom queries"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Go: Custom queries'
+    name: "Go: Custom queries"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -67,13 +67,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -93,5 +93,5 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: diagnostic when Go is changed after init step'
+name: "PR Check - Go: diagnostic when Go is changed after init step"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -44,9 +44,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-    name: 'Go: diagnostic when Go is changed after init step'
+    name: "Go: diagnostic when Go is changed after init step"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,9 +55,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -66,26 +66,26 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       # Deliberately change Go after the `init` step
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.20'
+          go-version: "1.20"
       - name: Build code
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: diagnostic when `file` is not installed'
+name: "PR Check - Go: diagnostic when `file` is not installed"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -44,9 +44,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-    name: 'Go: diagnostic when `file` is not installed'
+    name: "Go: diagnostic when `file` is not installed"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,9 +55,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove `file` program
         run: |
           echo $(which file)
@@ -81,12 +81,12 @@ jobs:
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
         with:
           script: |
             const fs = require('fs');

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: workaround for indirect tracing'
+name: "PR Check - Go: workaround for indirect tracing"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -44,9 +44,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-    name: 'Go: workaround for indirect tracing'
+    name: "Go: workaround for indirect tracing"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,9 +55,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with autobuilder step'
+name: "PR Check - Go: tracing with autobuilder step"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -44,29 +44,29 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.19.4
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
+            version: stable-v2.25.6
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with autobuilder step'
+    name: "Go: tracing with autobuilder step"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -75,9 +75,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -106,5 +106,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with custom build steps'
+name: "PR Check - Go: tracing with custom build steps"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -44,29 +44,29 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.19.4
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
+            version: stable-v2.25.6
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with custom build steps'
+    name: "Go: tracing with custom build steps"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -75,9 +75,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with legacy workflow'
+name: "PR Check - Go: tracing with legacy workflow"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -44,29 +44,29 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.19.4
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
+            version: stable-v2.25.6
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with legacy workflow'
+    name: "Go: tracing with legacy workflow"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -75,9 +75,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -100,5 +100,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__go.yml

@@ -19,10 +19,10 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 jobs:
   go-custom-queries:
-    name: 'Go: Custom queries'
+    name: "Go: Custom queries"
     permissions:
       contents: read
       security-events: read
@@ -31,7 +31,7 @@ jobs:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-diagnostic:
-    name: 'Go: diagnostic when Go is changed after init step'
+    name: "Go: diagnostic when Go is changed after init step"
     permissions:
       contents: read
       security-events: read
@@ -39,7 +39,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-no-file-program:
-    name: 'Go: diagnostic when `file` is not installed'
+    name: "Go: diagnostic when `file` is not installed"
     permissions:
       contents: read
       security-events: read
@@ -47,7 +47,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround:
-    name: 'Go: workaround for indirect tracing'
+    name: "Go: workaround for indirect tracing"
     permissions:
       contents: read
       security-events: read
@@ -55,7 +55,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-autobuilder:
-    name: 'Go: tracing with autobuilder step'
+    name: "Go: tracing with autobuilder step"
     permissions:
       contents: read
       security-events: read
@@ -63,7 +63,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-custom-build-steps:
-    name: 'Go: tracing with custom build steps'
+    name: "Go: tracing with custom build steps"
     permissions:
       contents: read
       security-events: read
@@ -71,7 +71,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-legacy-workflow:
-    name: 'Go: tracing with legacy workflow'
+    name: "Go: tracing with legacy workflow"
     permissions:
       contents: read
       security-events: read

.github/workflows/__init-with-registries.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Download using registries'
+name: "PR Check - Packaging: Download using registries"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,13 +34,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Download using registries'
+    name: "Packaging: Download using registries"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -49,18 +49,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Init with registries
         uses: ./../action/init
         with:
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: ./.github/codeql/codeql-config-registries.yml
           languages: javascript

.github/workflows/__javascript-source-root.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Custom source root
     if: github.triggering_actor != 'dependabot[bot]'
@@ -49,14 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Move codeql-action
         run: |
           mkdir ../new-source-root

.github/workflows/__job-run-uuid-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Job run UUID added to SARIF
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -60,19 +60,19 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check results
         run: |
           cd "$RUNNER_TEMP/results"
           actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
-          if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
-            echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
+          if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then
+            echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'."
             exit 1
           else
             echo "Found job run UUID '$actual'."

.github/workflows/__language-aliases.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Language aliases
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,20 +45,20 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: C#,java-kotlin,typescript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: 'Check languages'
+      - name: "Check languages"
         run: |
           expected_languages="csharp,java,javascript"
           actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

.github/workflows/__linux-arm64.yml

@@ -0,0 +1,106 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Linux Arm64
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+    inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: ">=1.21.0"
+  workflow_call:
+    inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: ">=1.21.0"
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+jobs:
+  linux-arm64:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04-arm
+            version: nightly-latest
+    name: Linux Arm64
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
+      - uses: ./../action/init
+        with:
+          languages: ${{ env.LANGUAGES }}
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Build code
+        run: ./build.sh
+      - uses: ./../action/analyze
+        with:
+          upload-database: false
+      - name: Assert databases exist
+        run: |
+          cd "$RUNNER_TEMP/codeql_databases"
+          for lang in ${LANGUAGES//,/ }; do
+            if [[ ! -d "$lang" ]]; then
+              echo "Did not find a database for $lang"
+              exit 1
+            fi
+            echo "Found database for $lang"
+          done
+    env:
+      LANGUAGES: cpp,csharp,go,java,javascript,python,ruby
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__local-bundle.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Local CodeQL bundle
     if: github.triggering_actor != 'dependabot[bot]'
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst

.github/workflows/__multi-language-autodetect.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,41 +54,41 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.19.4
-          - os: macos-15-xlarge
-            version: stable-v2.19.4
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.21.4
           - os: macos-15-xlarge
             version: stable-v2.21.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.22.4
           - os: macos-15-xlarge
             version: stable-v2.22.4
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.23.9
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.23.9
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: stable-v2.24.3
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: stable-v2.24.3
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
+            version: stable-v2.25.6
+          - os: macos-26-xlarge
+            version: stable-v2.25.6
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Multi-language repository
     if: github.triggering_actor != 'dependabot[bot]'
@@ -99,13 +99,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -114,15 +114,16 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Install Python 3.13 for older CLI versions
-        # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
+      - name: Install Python 3.13.15 for older CLI versions
+        # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
+        # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: '3.13'
+          python-version: "3.13.15"
 
       - name: Use Xcode 16
         # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
@@ -132,7 +133,7 @@ jobs:
       - uses: ./../action/init
         id: init
         with:
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 

.github/workflows/__overlay-init-fallback.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,9 +34,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Overlay database init fallback
     if: github.triggering_actor != 'dependabot[bot]'
@@ -47,14 +47,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: actions # Any language without overlay support will do

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config and input passed to the CLI'
+name: "PR Check - Packaging: Config and input passed to the CLI"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config and input passed to the CLI'
+    name: "Packaging: Config and input passed to the CLI"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -69,21 +69,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test
@@ -91,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config and input'
+name: "PR Check - Packaging: Config and input"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config and input'
+    name: "Packaging: Config and input"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -69,21 +69,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test
@@ -91,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-config-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config file'
+name: "PR Check - Packaging: Config file"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config file'
+    name: "Packaging: Config file"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -69,21 +69,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test
@@ -91,18 +93,18 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging.yml'
+          config-file: ".github/codeql/codeql-config-packaging.yml"
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results

.github/workflows/__packaging-inputs-js.yml

@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Action input'
+name: "PR Check - Packaging: Action input"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Action input'
+    name: "Packaging: Action input"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -69,21 +69,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
           cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
       - name: Install dependencies
         run: npm ci
       - name: Prepare test
@@ -91,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging2.yml'
+          config-file: ".github/codeql/codeql-config-packaging2.yml"
           languages: javascript
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
 
       - name: Check results
         uses: ./../action/.github/actions/check-sarif

.github/workflows/__per-language-bundle-validation.yml

@@ -0,0 +1,175 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Per-language bundles
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: per-language-bundle-validation-${{github.ref}}
+jobs:
+  per-language-bundle-validation:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            os: ubuntu-26.04
+            version: linked
+            expected-extractors: actions javascript
+          - language: cpp
+            os: ubuntu-26.04
+            version: linked
+            build-mode: manual
+            build-command: gcc -o main main.c
+          - language: csharp
+            os: ubuntu-26.04
+            version: linked
+            build-mode: none
+          - language: go
+            os: ubuntu-26.04
+            version: linked
+            build-mode: autobuild
+          - language: java
+            os: ubuntu-26.04
+            version: linked
+            build-mode: none
+          - language: javascript
+            os: ubuntu-26.04
+            version: linked
+          - language: python
+            os: ubuntu-26.04
+            version: linked
+          - language: ruby
+            os: ubuntu-26.04
+            version: linked
+          - language: rust
+            os: ubuntu-26.04
+            version: linked
+          - language: swift
+            os: macos-26-xlarge
+            version: linked
+            build-mode: autobuild
+    name: Per-language bundles
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
+      - name: Remove CodeQL from toolcache
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts clear
+      - uses: ./../action/init
+        id: init
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix['build-mode'] }}
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check that the bundle contains only the expected extractors
+        env:
+          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
+          LANGUAGE: ${{ matrix.language }}
+          EXPECTED_EXTRACTORS: ${{ matrix['expected-extractors'] || matrix.language }}
+        run: |
+          extractors="$("$CODEQL_PATH" resolve languages --format=json | jq -r 'keys[]')"
+          echo "Extractors in the bundle:"
+          echo "$extractors"
+          echo "Expected: $EXPECTED_EXTRACTORS"
+
+          for expected in $EXPECTED_EXTRACTORS; do
+            if ! echo "$extractors" | grep -qx "$expected"; then
+              echo "::error::The ${LANGUAGE} bundle does not contain the ${expected} extractor."
+              exit 1
+            fi
+          done
+
+          # If the bundle contained extractors beyond those the language needs, then it would not
+          # have been trimmed, and this job would be silently validating the combined bundle.
+          for other in actions cpp csharp go java javascript python ruby rust swift; do
+            if echo "$EXPECTED_EXTRACTORS" | grep -qw "$other"; then
+              continue
+            fi
+            if echo "$extractors" | grep -qx "$other"; then
+              echo "::error::The ${LANGUAGE} bundle also contains the ${other} extractor, so it is not trimmed."
+              exit 1
+            fi
+          done
+      - name: Check that the bundle was not added to the toolcache
+        env:
+          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
+        run: |
+          # A bundle that is missing most of its extractors must never be left in the toolcache,
+          # where a later job analyzing a different language could pick it up. Per-language bundles
+          # must instead be extracted under the runner's temporary directory.
+          echo "CodeQL is at $CODEQL_PATH"
+          if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
+            echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
+            exit 1
+          fi
+          if [[ "$CODEQL_PATH" != "$RUNNER_TEMP"/* ]]; then
+            echo "::error::Expected the per-language bundle to be extracted under $RUNNER_TEMP, but found it at $CODEQL_PATH."
+            exit 1
+          fi
+      - name: Build code
+        if: matrix['build-command']
+        run: ${{ matrix['build-command'] }}
+      - uses: ./../action/analyze
+        id: analysis
+        with:
+          upload-database: false
+      - name: Check that a database was created for the language
+        env:
+          DB_LOCATIONS: ${{ steps.analysis.outputs.db-locations }}
+          LANGUAGE: ${{ matrix.language }}
+        run: |
+          database="$(echo "$DB_LOCATIONS" | jq -r --arg lang "$LANGUAGE" '.[$lang] // empty')"
+          if [ -z "$database" ] || [ ! -d "$database" ]; then
+            echo "::error::No CodeQL database was created for ${LANGUAGE}."
+            echo "Databases: $DB_LOCATIONS"
+            exit 1
+          fi
+          echo "Created a ${LANGUAGE} database at ${database}."
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__remote-config.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Remote config file
     if: github.triggering_actor != 'dependabot[bot]'
@@ -67,13 +67,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__resolve-environment-action.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Resolve environment
     if: github.triggering_actor != 'dependabot[bot]'
@@ -49,14 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go,javascript-typescript

.github/workflows/__rubocop-multi-language.yml

@@ -1,74 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - RuboCop multi-language
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}
-jobs:
-  rubocop-multi-language:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: default
-    name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
-        with:
-          ruby-version: 2.6
-      - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
-      - name: Install dependencies
-        run: bundle install
-      - name: RuboCop run
-        run: |
-          bash -c "
-            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-            [[ $? -ne 2 ]]
-          "
-      - uses: ./../action/upload-sarif
-        with:
-          sarif_file: rubocop.sarif
-    env:
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__ruby.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,17 +34,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest
+          - os: macos-26
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: Ruby analysis
     if: github.triggering_actor != 'dependabot[bot]'
@@ -55,14 +55,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: ruby

.github/workflows/__rust.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,15 +34,15 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.19.4
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
+            version: stable-v2.20.7
+          - os: ubuntu-26.04
             version: stable-v2.22.1
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Rust analysis
     if: github.triggering_actor != 'dependabot[bot]'
@@ -53,14 +53,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: rust

.github/workflows/__split-workflow.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,17 +54,17 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: macos-latest
+          - os: macos-26
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
-          - os: macos-latest
+          - os: macos-26
             version: nightly-latest
     name: Split workflow
     if: github.triggering_actor != 'dependabot[bot]'
@@ -75,13 +75,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -90,11 +90,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +103,7 @@ jobs:
       - uses: ./../action/analyze
         with:
           skip-queries: true
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Assert No Results
@@ -114,7 +114,7 @@ jobs:
           fi
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Assert Results
         run: |

.github/workflows/__start-proxy.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: macos-latest
+          - os: macos-26
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: Start proxy
     if: github.triggering_actor != 'dependabot[bot]'
@@ -49,14 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Setup proxy for registries
         id: proxy
         uses: ./../action/start-proxy
@@ -101,5 +101,5 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
     env:
-      CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
+      CODEQL_ACTION_PROXY_API_REQUESTS: "true"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__submit-sarif-failure.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,11 +34,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Submit SARIF after failure
     if: github.triggering_actor != 'dependabot[bot]'
@@ -49,15 +49,15 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./init
         with:
           languages: javascript
@@ -71,10 +71,12 @@ jobs:
         run: exit 1
       - uses: ./analyze
         # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-        # above, we manually disable it with an `if` condition.
+        # above, we manually disable it with an `if` condition. Having this step is required
+        # for the init post-action because it checks the workflow definition for e.g. the
+        # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
     env:
       CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
       CODEQL_ACTION_UPLOAD_FAILED_SARIF: true

.github/workflows/__swift-autobuild.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest-xlarge
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Swift analysis using autobuild
     if: github.triggering_actor != 'dependabot[bot]'
@@ -45,14 +45,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__swift-custom-build.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,11 +54,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
+          - os: macos-26-xlarge
             version: linked
-          - os: macos-latest
+          - os: macos-26-xlarge
             version: default
-          - os: macos-latest
+          - os: macos-26-xlarge
             version: nightly-latest
     name: Swift analysis using a custom build command
     if: github.triggering_actor != 'dependabot[bot]'
@@ -69,13 +69,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -107,5 +107,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__unset-environment.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,9 +54,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: nightly-latest
     name: Test unsetting environment variables
     if: github.triggering_actor != 'dependabot[bot]'
@@ -67,13 +67,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__unsupported-macos.yml

@@ -0,0 +1,135 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Unsupported macOS
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: unsupported-macos-${{github.ref}}
+jobs:
+  unsupported-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: xcode-27
+            version: linked
+          - os: xcode-27
+            version: nightly-latest
+    name: Unsupported macOS
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
+      - name: Check xcode_select_link
+        run: |
+          readlink /private/var/db/xcode_select_link
+          file -h /private/var/db/xcode_select_link
+
+      - uses: ./../action/init
+        id: init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
+          CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+        # can't cope with that unless we introduce a different testing environment. Since this step
+        # would just fail on `xcode-27` anyway, we just skip it instead.
+        if: false
+        uses: ./analyze
+        with:
+          category: "/test-codeql-version:${{ matrix.version }}"
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  unsupported-macos-sarif-checks:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - unsupported-macos
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     if: github.triggering_actor != 'dependabot[bot]'
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -92,12 +92,12 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           upload: never
       - uses: ./../action/upload-sarif
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-sarif.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,13 +54,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-scanning
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-quality
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`
@@ -72,13 +72,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -87,8 +87,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -99,8 +99,8 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           upload: never
           output: ${{ runner.temp }}/results
 
@@ -109,15 +109,15 @@ jobs:
         uses: ./../action/upload-sarif
         id: upload-sarif
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
-      - name: 'Fail for missing output from `upload-sarif` step for `code-scanning`'
+      - name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
-      - name: 'Fail for missing output from `upload-sarif` step for `code-quality`'
+      - name: "Fail for missing output from `upload-sarif` step for `code-quality`"
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -126,12 +126,12 @@ jobs:
         id: upload-single-sarif-code-scanning
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
-      - name: 'Fail for missing output from `upload-single-sarif-code-scanning` step'
+      - name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
         run: exit 1
       - name: Upload single SARIF file for Code Quality
@@ -139,12 +139,12 @@ jobs:
         id: upload-single-sarif-code-quality
         if: contains(matrix.analysis-kinds, 'code-quality')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
-      - name: 'Fail for missing output from `upload-single-sarif-code-quality` step'
+      - name: "Fail for missing output from `upload-single-sarif-code-quality` step"
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -156,12 +156,12 @@ jobs:
         id: upload-single-non-sarif
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
-      - name: 'Fail for missing output from `upload-single-non-sarif` step'
+      - name: "Fail for missing output from `upload-single-non-sarif` step"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
     env:

.github/workflows/__with-checkout-path.yml

@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             version: linked
     name: Use a custom `checkout_path`
     if: github.triggering_actor != 'dependabot[bot]'
@@ -66,13 +66,13 @@ jobs:
     steps:
       # This ensures we don't accidentally use the original checkout for any part of the test.
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -81,8 +81,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.
@@ -91,7 +91,7 @@ jobs:
           rm -rf ./* .github .git
       # Check out the actions repo again, but at a different location.
       # choose an arbitrary SHA so that we can later test that the commit_oid is not from main
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
           path: x/y/z/some-path

.github/workflows/check-expected-release-files.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout CodeQL Action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check Expected Release Files
         run: |
           bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")"

.github/workflows/codeql.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Sunday.
-    - cron: '30 1 * * 0'
+    - cron: "30 1 * * 0"
   workflow_dispatch:
 
 defaults:
@@ -22,7 +22,7 @@ jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
   check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       versions: ${{ steps.compare.outputs.versions }}
 
@@ -32,41 +32,41 @@ jobs:
       security-events: read
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - name: Set up default CodeQL bundle
-      id: setup-default
-      uses: ./setup-codeql
-    - name: Set up linked CodeQL bundle
-      id: setup-linked
-      uses: ./setup-codeql
-      with:
-        tools: linked
-    - name: Compare default and linked CodeQL bundle versions
-      id: compare
-      env:
-        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-      run: |
-        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up default CodeQL bundle
+        id: setup-default
+        uses: ./setup-codeql
+      - name: Set up linked CodeQL bundle
+        id: setup-linked
+        uses: ./setup-codeql
+        with:
+          tools: linked
+      - name: Compare default and linked CodeQL bundle versions
+        id: compare
+        env:
+          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+        run: |
+          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
 
-        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-        # required status check.
-        #
-        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-        # the same as running with `tools: null`.
-        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-          VERSIONS_JSON='[null]'
-        else
-          VERSIONS_JSON='[null, "linked"]'
-        fi
+          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+          # required status check.
+          #
+          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+          # the same as running with `tools: null`.
+          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+            VERSIONS_JSON='[null]'
+          else
+            VERSIONS_JSON='[null, "linked"]'
+          fi
 
-        # Output a JSON-encoded list with the distinct versions to test against.
-        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+          # Output a JSON-encoded list with the distinct versions to test against.
+          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
 
   analyze-javascript:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -74,7 +74,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
+        os:
+          - ubuntu-22.04
+          - ubuntu-24.04
+          - windows-2022
+          - windows-2025
+          - macos-14-xlarge
+          - macos-15-xlarge
         tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
     runs-on: ${{ matrix.os }}
 
@@ -83,58 +89,57 @@ jobs:
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - name: Initialize CodeQL
-      uses: ./init
-      id: init
-      with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config-javascript.yml
-        tools: ${{ matrix.tools }}
-    # confirm steps.init.outputs.codeql-path points to the codeql binary
-    - name: Print CodeQL Version
-      run: >
-        "$CODEQL" version --format=json
-      env:
-        CODEQL: ${{steps.init.outputs.codeql-path}}
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        id: init
+        with:
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config-javascript.yml
+          tools: ${{ matrix.tools }}
+      # confirm steps.init.outputs.codeql-path points to the codeql binary
+      - name: Print CodeQL Version
+        run: >
+          "$CODEQL" version --format=json
+        env:
+          CODEQL: ${{steps.init.outputs.codeql-path}}
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:javascript"
+          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     strategy:
       fail-fast: false
       matrix:
         include:
           - language: actions
-          - language: python
 
     permissions:
       contents: read
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - name: Initialize CodeQL
-      uses: ./init
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: none
-        config: >
-          paths-ignore:
-            - lib
-            - tests
-          queries:
-            - uses: security-and-quality
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:${{ matrix.language }}"
-        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config: >
+            paths-ignore:
+              - lib
+              - tests
+            queries:
+              - uses: security-and-quality
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}

.github/workflows/codescanning-config-cli.yml

@@ -10,13 +10,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -41,186 +41,187 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
-          version: linked
-        - os: ubuntu-latest
-          version: default
-        - os: ubuntu-latest
-          version: nightly-latest
+          - os: ubuntu-26.04
+            version: linked
+          - os: ubuntu-26.04
+            version: default
+          - os: ubuntu-26.04
+            version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
     name: Code Scanning Configuration tests
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Set up Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: 24
-        cache: 'npm'
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: "npm"
 
-    - name: Install dependencies
-      run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
 
-    - name: Empty file
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: "{}"
-        languages: javascript
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Empty file
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: "{}"
+          # Request multiple languages so later checks can reuse the combined bundle.
+          languages: javascript,python
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Packs from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+      - name: Packs from input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
             }
-          }
-        languages: javascript
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: javascript
+          packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Queries and packs from config overriden by input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql/javascript-queries"]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Packs from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+            }
+          languages: javascript
+          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Queries and packs from config merging with input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Queries from input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+            }
+          languages: javascript
+          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Multi-language packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-              "ruby": ["codeql/ruby-queries"]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript,ruby
-        config-file-test: .github/codeql/multi-language-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Queries from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Other config properties
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "name": "Config using all properties",
-            "packs": ["codeql/javascript-queries" ],
-            "disable-default-queries": true,
-            "paths-ignore": ["xxx"],
-            "paths": ["yyy"]
-          }
-        languages: javascript
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/other-config-properties.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Queries and packs from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+              }
+            }
+          languages: javascript
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config overriden by input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+              "packs": ["codeql/javascript-queries"]
+            }
+          languages: javascript
+          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: codeql/javascript-queries
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config merging with input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
+              },
+              "queries": [
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+              ]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: + codeql/javascript-queries
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Multi-language packs from config
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
+                "ruby": ["codeql/ruby-queries"]
+              },
+              "queries": [
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+              ]
+            }
+          languages: javascript,ruby
+          config-file-test: .github/codeql/multi-language-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Other config properties
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "name": "Config using all properties",
+              "packs": ["codeql/javascript-queries" ],
+              "disable-default-queries": true,
+              "paths-ignore": ["xxx"],
+              "paths": ["yyy"]
+            }
+          languages: javascript
+          packs: + codeql/javascript-queries
+          config-file-test: .github/codeql/other-config-properties.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/debug-artifacts-failure-safe.yml

@@ -6,13 +6,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -30,10 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.3
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
     name: Upload debug artifacts after failure in analyze
     continue-on-error: true
     env:
@@ -43,24 +43,29 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
+
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
@@ -86,12 +91,13 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       - name: Check expected artifacts exist
         run: |
+          VERSIONS="stable-v2.20.7 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             echo "Artifacts from version $version:"

.github/workflows/debug-artifacts-safe.yml

@@ -5,13 +5,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -29,10 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.3
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -41,22 +41,27 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: ubuntu-latest
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
+
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
@@ -79,13 +84,13 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       - name: Check expected artifacts exist
         run: |
-          VERSIONS="stable-v2.20.3 default linked nightly-latest"
+          VERSIONS="stable-v2.20.7 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             pushd "./my-debug-artifacts-${version//./}"

.github/workflows/deflake.yml

@@ -60,7 +60,6 @@ on:
       - "PR Check - Proxy test"
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
       - "PR Check - Ruby analysis"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"

.github/workflows/post-release-mergeback.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       baseBranch:
-        description: 'The base branch to merge into'
+        description: "The base branch to merge into"
         default: main
         required: false
 
@@ -24,7 +24,7 @@ defaults:
 
 jobs:
   merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     if: github.repository == 'github/codeql-action'
     env:
@@ -41,19 +41,19 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "${GITHUB_CONTEXT}"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          fetch-depth: 0 # ensure we have all tags and can push commits
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: '3.12'
+          cache: "npm"
+
+      - name: Install JavaScript dependencies
+        run: npm ci
 
       - name: Update git config
         run: |
@@ -127,14 +127,14 @@ jobs:
         env:
           PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
         run: |
-          python .github/workflows/script/prepare_changelog.py CHANGELOG.md > $PARTIAL_CHANGELOG
+          npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG"
 
           echo "::group::Partial CHANGELOG"
           cat $PARTIAL_CHANGELOG
           echo "::endgroup::"
 
       - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/pr-checks.yml

@@ -2,6 +2,9 @@ name: PR Checks
 
 on:
   push:
+    branches:
+      - "main"
+      - "releases/v*"
   pull_request:
   merge_group:
     types: [checks_requested]
@@ -22,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-26, windows-2025]
         node-version: [20, 24]
     permissions:
       contents: read
@@ -39,13 +42,19 @@ jobs:
         if: runner.os == 'Windows'
         run: git config --global core.autocrlf false
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          cache: "npm"
+
+      # Install a new enough version of `npm` to understand `min-release-age`
+      # that is still compatible with Node 20.
+      - name: Install newer npm
+        if: matrix.node-version == 20
+        run: npm install -g npm@11.19.1
 
       - name: Install dependencies
         run: |
@@ -55,19 +64,24 @@ jobs:
           npm ci
 
       - name: Verify compiled JS up to date
-        run: .github/workflows/script/check-js.sh
+        run: npx tsx pr-checks/check-unchanged.ts --language javascript
 
       - name: Run unit tests
         if: always()
         run: npm test
 
       - name: Lint
-        if: always() && matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-2025'
         run: npm run lint-ci
 
       - name: Upload sarif
         uses: ./upload-sarif
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
+        # The merge queue deletes its `gh-readonly-queue` ref as soon as the queue entry resolves,
+        # so uploading against it races with that deletion. Both the `merge_group` run and the
+        # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
+        # rather than the event. The same results are uploaded by the `pull_request` run and again
+        # by the `push` run on `main`.
+        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -79,7 +93,7 @@ jobs:
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
 
     concurrency:
@@ -88,18 +102,29 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Check for incorrect addresses in package-lock.json
+        run: |
+          if git grep -nE '(pkgs\.visualstudio\.com|pkgs\.dev\.azure\.com|packagefeedproxy\.microsoft\.io)' -- \
+              'package-lock.json'; then
+            echo "::error::package-lock.json contains internal package feed URLs. Replace them with public registry URLs."
+            exit 1
+          fi
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         id: install-deps
         run: npm ci
 
+      - name: Verify YAML is correctly formatted
+        run: npx tsx pr-checks/check-unchanged.ts --language yaml
+
       - name: Verify PR checks up to date
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
@@ -109,6 +134,10 @@ jobs:
         working-directory: pr-checks
         run: npx tsx --test
 
+      - name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
+        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        run: npx tsx pr-checks/changenotes.ts validate
+
       - name: Verify all Actions use the same Node version
         id: head-version
         run: |
@@ -122,12 +151,11 @@ jobs:
 
       - name: Fetch base commit
         id: fetch-base
-        # Forks and Dependabot PRs don't have permission to write comments, so skip the repo size
-        # check in those cases.
+        # Skip this (and subsequent steps) if the PR originates from a fork, since this workflow
+        # won't have the necessary permissions to post comments on the PR.
         if: >-
           github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.event.pull_request.user.login != 'dependabot[bot]'
+          github.event.pull_request.head.repo.full_name == github.repository
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -152,20 +180,20 @@ jobs:
 
       - name: Upload repo size comment
         if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: repo-size-comment
           path: ${{ runner.temp }}/repo-size/
           if-no-files-found: error
 
-      - name: 'Backport: Check out base ref'
+      - name: "Backport: Check out base ref"
         id: checkout-base
         if: ${{ startsWith(github.head_ref, 'backport-') }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.base_ref }}
 
-      - name: 'Backport: Verify Node versions unchanged'
+      - name: "Backport: Verify Node versions unchanged"
         if: steps.checkout-base.outcome == 'success'
         env:
           HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}
@@ -186,7 +214,7 @@ jobs:
     if: >-
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
+      github.actor != 'dependabot[bot]' &&
       needs.other-checks.result == 'success'
     permissions:
       contents: read
@@ -200,7 +228,7 @@ jobs:
 
     steps:
       - name: Download repo size comment
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: repo-size-comment
           path: repo-size-comment

.github/workflows/pr-dequeued.yml

@@ -0,0 +1,43 @@
+name: PR dequeued
+
+on:
+  pull_request:
+    types:
+      - dequeued
+
+jobs:
+  notify:
+    name: Notify
+    runs-on: ubuntu-slim
+
+    if: github.event.pull_request.merged != true
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Notify that the PR was removed from the merge queue
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REASON: ${{ github.event.reason }}
+        run: |
+          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
+          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
+          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
+          enqueuer=$(gh api graphql \
+            -F number="$PR_NUMBER" \
+            -f query='
+              query($number: Int!) {
+                repository(owner: "github", name: "codeql-action") {
+                  pullRequest(number: $number) {
+                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
+                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
+                    }
+                  }
+                }
+              }' \
+            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
+          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
+            "Please resolve any issues if required and enqueue the PR again." |
+            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

.github/workflows/prepare-release.yml

@@ -28,8 +28,8 @@ defaults:
 
 jobs:
   prepare:
-    name: "Prepare release"
-    runs-on: ubuntu-latest
+    name: "Release info"
+    runs-on: ubuntu-26.04
     if: github.repository == 'github/codeql-action'
 
     permissions:
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Need full history for calculation of diffs
 

.github/workflows/publish-immutable-action.yml

@@ -1,10 +1,10 @@
-name: 'Publish Immutable Action Version'
+name: "Publish Immutable Action Version"
 
 on:
   push:
     tags:
       # Match version tags, but not the major version tags.
-      - 'v[0-9]+.**'
+      - "v[0-9]+.**"
 
 defaults:
   run:
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Publish immutable release
         id: publish

.github/workflows/python312-windows.yml

@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Monday.
-    - cron: '0 0 * * 1'
+    - cron: "0 0 * * 1"
   workflow_dispatch:
 
 concurrency:
@@ -29,25 +29,25 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: windows-latest
+    runs-on: windows-2025
 
     steps:
-    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-      with:
-        python-version: 3.12
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: 3.12
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Prepare test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: default
+      - name: Prepare test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: default
 
-    - name: Initialize CodeQL
-      uses: ./../action/init
-      with:
-        tools: linked
-        languages: python
+      - name: Initialize CodeQL
+        uses: ./../action/init
+        with:
+          tools: linked
+          languages: python
 
-    - name: Analyze
-      uses: ./../action/analyze
+      - name: Analyze
+        uses: ./../action/analyze

.github/workflows/query-filters.yml

@@ -3,13 +3,13 @@ name: Query filters tests
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -25,51 +25,51 @@ jobs:
     name: Query Filters Tests
     if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
-    - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Install Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: 24
-        cache: npm
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: npm
 
-    - name: Install dependencies
-      run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: linked
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: linked
 
-    - name: Check SARIF for default queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters1.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for default queries with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip
+          queries-not-run: js/path-injection
+          config-file: ./.github/codeql/codeql-config-query-filters1.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Check SARIF for query packs with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters2.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for query packs with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip,javascript/example/empty-or-one-block
+          queries-not-run: js/path-injection
+          config-file: ./.github/codeql/codeql-config-query-filters2.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Check SARIF for query packs and local queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-        config-file: ./.github/codeql/codeql-config-query-filters3.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for query packs and local queries with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
+          queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
+          config-file: ./.github/codeql/codeql-config-query-filters3.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/rebuild.yml

@@ -12,7 +12,7 @@ defaults:
 jobs:
   rebuild:
     name: Rebuild Action
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
     env:
@@ -24,16 +24,16 @@ jobs:
       pull-requests: write # needed to comment on the PR
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.HEAD_REF }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Remove label
         if: github.event_name == 'pull_request'
@@ -54,32 +54,27 @@ jobs:
         run: |
           git fetch origin "$BASE_BRANCH"
 
-          # Allow merge conflicts in `lib`, since rebuilding should resolve them.
-          git merge "origin/$BASE_BRANCH"
-          MERGE_RESULT=$?
-
-          if [ "$MERGE_RESULT" -eq 0 ]; then
+          # Allow merge conflicts in `lib`, since rebuilding should resolve them. Conflicts leave the
+          # merge in progress, so check for `MERGE_HEAD` to tell them apart from failures that don't.
+          if git merge "origin/$BASE_BRANCH"; then
             echo "Merge succeeded cleanly."
-          elif [ "$MERGE_RESULT" -eq 1 ]; then
-            echo "Merge conflicts detected (exit code $MERGE_RESULT), continuing."
-          else
-            echo "git merge failed with unexpected exit code $MERGE_RESULT."
-            exit 1
-          fi
-
-          if [ "$MERGE_RESULT" -ne 0 ]; then
+          elif git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
+            echo "Merge conflicts detected, continuing."
             echo "merge-in-progress=true" >> $GITHUB_OUTPUT
 
-            # Check for merge conflicts outside of `lib`. Disable git diff's trailing whitespace check
-            # since `node_modules/@types/semver/README.md` fails it.
-            if git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/'; then
+            # Check for merge conflicts outside of `lib`.
+            CONFLICTS_OUTSIDE_LIB=$(git diff --name-only --diff-filter=U | grep --invert-match '^lib/' || true)
+            if [ -n "$CONFLICTS_OUTSIDE_LIB" ]; then
               echo "Merge conflicts were detected outside of the lib directory. Please resolve them manually."
-              git -c core.whitespace=-trailing-space diff --check | grep --invert-match '^lib/' || true
+              echo "$CONFLICTS_OUTSIDE_LIB"
               exit 1
             fi
 
             echo "No merge conflicts found outside the lib directory. We should be able to resolve all of" \
               "these by rebuilding the Action."
+          else
+            echo "git merge failed for a reason other than merge conflicts."
+            exit 1
           fi
 
       - name: Compile TypeScript

.github/workflows/rollback-release.yml

@@ -10,8 +10,7 @@ on:
         required: true
   # Only for dry-runs of changes to the workflow.
   push:
-    # Don't run dry-run on release branches, to avoid an issue where the
-    # "new" tag determined by the "Prepare release" job already exists.
+    # Don't run dry-run on release branches, since that's unnecessary.
     branches-ignore:
       - releases/v*
     paths:
@@ -24,7 +23,7 @@ defaults:
 
 jobs:
   prepare:
-    name: "Prepare release"
+    name: "Prepare"
     if: github.repository == 'github/codeql-action'
 
     permissions:
@@ -35,7 +34,7 @@ jobs:
   rollback:
     name: "Create rollback release"
     if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
 
     # Don't set the deployment environment for test runs
@@ -52,7 +51,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Need full history for calculation of diffs
 
@@ -93,7 +92,7 @@ jobs:
           LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}
           VERSION: "${{ needs.prepare.outputs.version }}"
         run: |
-          python .github/workflows/script/rollback_changelog.py \
+          npx tsx pr-checks/rollback-changelog.ts \
             --target-version "${ROLLBACK_TAG:1}" \
             --rollback-version "${LATEST_TAG:1}" \
             --new-version "$VERSION" > $NEW_CHANGELOG
@@ -107,8 +106,10 @@ jobs:
           # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
           # but use `v0.0.0` for testing.
           ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
-          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
+          # Use `needs.prepare.outputs.version` for actual runs and `v0.0.1` for testing.
+          RELEASE_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.version, 'v0.0.1') }}
+          # Use `needs.prepare.outputs.major_version` for actual runs and `v0` for testing.
+          MAJOR_VERSION_TAG: ${{ case(github.event_name == 'workflow_dispatch', needs.prepare.outputs.major_version, 'v0') }}
         run: |
           git checkout "refs/tags/${ROLLBACK_TAG}"
           git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
@@ -128,7 +129,9 @@ jobs:
           NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
           PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
         run: |
-          python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG > $PARTIAL_CHANGELOG
+          npx tsx pr-checks/prepare-changelog.ts \
+            --changelog="$NEW_CHANGELOG" \
+            --output="$PARTIAL_CHANGELOG"
 
           echo "::group::Partial CHANGELOG"
           cat $PARTIAL_CHANGELOG
@@ -136,7 +139,7 @@ jobs:
 
       - name: Generate token
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -182,4 +185,3 @@ jobs:
           # Setting this to `true` for non-workflow_dispatch events will
           # still push the `branch`, but won't create a corresponding PR
           dry-run: "${{ github.event_name != 'workflow_dispatch' }}"
-

.github/workflows/script/bundle_changelog.py

@@ -1,23 +0,0 @@
-#!/usr/bin/env python3
-import os
-import re
-
-cli_version = os.environ['CLI_VERSION']
-
-# The GitHub Release for the new bundle version.
-bundle_release_url = f"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v{cli_version}"
-# Get the PR number from the PR URL.
-pr_number = os.environ['PR_URL'].split('/')[-1]
-changelog_note = f"- Update default CodeQL bundle version to [{cli_version}]({bundle_release_url}). [#{pr_number}]({os.environ['PR_URL']})"
-
-# If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
-with open('CHANGELOG.md', 'r') as f:
-    changelog = f.read()
-
-changelog = changelog.replace('## [UNRELEASED]\n\nNo user facing changes.', '## [UNRELEASED]\n')
-
-# Add the changelog note to the bottom of the "[UNRELEASED]" section.
-changelog = re.sub(r'\n## (\d+\.\d+\.\d+)', f'{changelog_note}\n\n## \\1', changelog, count=1)
-
-with open('CHANGELOG.md', 'w') as f:
-    f.write(changelog)

.github/workflows/script/check-js.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-# Wipe the lib directory in case there are extra unnecessary files in there
-rm -rf lib
-# Generate the JavaScript files
-npm run-script build
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
-    git status
-
-    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/js.diff"
-    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    # Reset bundled files to allow other checks to test for changes
-    git checkout lib
-
-    # Fail this check
-    exit 1
-fi
-echo "Success: JavaScript files are up to date"

.github/workflows/script/prepare_changelog.py

@@ -1,35 +0,0 @@
-#!/usr/bin/env python3
-import os
-import sys
-
-EMPTY_CHANGELOG = 'No changes.\n\n'
-
-# Prepare the changelog for the new release
-# This function will extract the part of the changelog that
-# we want to include in the new release.
-def extract_changelog_snippet(changelog_file):
-  output = ''
-  if (not os.path.exists(changelog_file)):
-    output = EMPTY_CHANGELOG
-
-  else:
-    with open(changelog_file, 'r') as f:
-      lines = f.readlines()
-
-      # Include only the contents of the first section
-      found_first_section = False
-      for line in lines:
-        if line.startswith('## '):
-          if found_first_section:
-            break
-          found_first_section = True
-        elif found_first_section:
-          output += line
-
-  return output.strip()
-
-
-if len(sys.argv) < 2:
-  raise Exception('Expecting argument: changelog_file')
-changelog_file = sys.argv[1]
-print(extract_changelog_snippet(changelog_file))

.github/workflows/script/rollback_changelog.py

@@ -1,62 +0,0 @@
-import datetime
-import os
-import argparse
-
-EMPTY_CHANGELOG = """# CodeQL Action Changelog
-
-"""
-
-def get_today_string():
-  today = datetime.datetime.today()
-  return '{:%d %b %Y}'.format(today)
-
-# Include everything up to and after the first heading,
-# but not the first heading and body.
-def drop_unreleased_section(lines: list[str]):
-  before_first_section = ''
-  after_first_section = ''
-  found_first_section = False
-  skipped_first_section = False
-
-  for i, line in enumerate(lines):
-    if line.startswith('## ') and not found_first_section:
-      found_first_section = True
-    elif line.startswith('## ') and found_first_section:
-      skipped_first_section = True
-
-    if not found_first_section:
-      before_first_section += line
-    if skipped_first_section:
-      after_first_section += line
-
-  return (before_first_section, after_first_section)
-
-def update_changelog(target_version, rollback_version, new_version):
-  before_first_section = EMPTY_CHANGELOG
-  after_first_section = ''
-
-  if (os.path.exists('CHANGELOG.md')):
-    with open('CHANGELOG.md', 'r') as f:
-      (before_first_section, after_first_section) = drop_unreleased_section(f.readlines())
-
-  newHeader = f'## {new_version} - {get_today_string()}\n'
-
-  print(before_first_section, end="")
-  print(newHeader)
-  print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n")
-  print(after_first_section)
-
-# We expect three version strings as input:
-#
-# - target_version: the version that we are re-releasing as `new_version`
-# - rollback_version: the version that we are rolling back, typically the one that followed `target_version`
-# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version`
-#
-# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5"
-parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.")
-parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.")
-parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.")
-parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.")
-args = parser.parse_args()
-
-update_changelog(args.target_version, args.rollback_version, args.new_version)

.github/workflows/test-codeql-bundle-all.yml

@@ -1,17 +1,17 @@
-name: 'PR Check - CodeQL Bundle All'
+name: "PR Check - CodeQL Bundle All"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -27,9 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
-          version: nightly-latest
-    name: 'CodeQL Bundle All'
+          - os: ubuntu-26.04
+            version: nightly-latest
+    name: "CodeQL Bundle All"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -37,26 +37,26 @@ jobs:
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-        use-all-platform-bundle: true
-    - name: Install .NET
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
-      with:
-        dotnet-version: '9.x'
-    - id: init
-      uses: ./../action/init
-      with:
-        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - name: Build code
-      run: ./build.sh
-    - uses: ./../action/analyze
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: true
+      - name: Install .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "9.x"
+      - id: init
+        uses: ./../action/init
+        with:
+          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
+          languages: cpp,csharp,go,java,javascript,python,ruby
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Build code
+        run: ./build.sh
+      - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/update-bundle.yml

@@ -20,7 +20,7 @@ defaults:
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests
@@ -30,26 +30,21 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "$GITHUB_CONTEXT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Update git config
         run: |
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: '3.12'
-
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
@@ -120,7 +115,7 @@ jobs:
 
       - name: Create changelog note
         run: |
-          python .github/workflows/script/bundle_changelog.py
+          npx tsx pr-checks/bundle-changelog.ts
 
       - name: Push changelog note
         run: |

.github/workflows/update-release-branch.yml

@@ -16,17 +16,17 @@ defaults:
     shell: bash
 
 jobs:
-
   prepare:
-    name: "Prepare release"
+    name: "Prepare"
     permissions:
       contents: read
 
     uses: ./.github/workflows/prepare-release.yml
 
   update:
+    name: "Update release branch"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event_name == 'workflow_dispatch'
     needs: [prepare]
     env:
@@ -38,47 +38,48 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-    - uses: ./.github/actions/release-initialise
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+      - uses: ./.github/actions/release-initialise
 
-    # when the workflow has been manually triggered on main,
-    # we know that we definitely want the release branch to exist
-    - name: Ensure release branch exists
-      run: |
-        echo "MAJOR_VERSION ${MAJOR_VERSION}"
-        RELEASE_BRANCH=releases/${MAJOR_VERSION}
-        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-            echo "Branch $RELEASE_BRANCH already exists"
-            echo ""
-        else
-            echo "Creating $RELEASE_BRANCH branch"
-            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-            git push --set-upstream origin ${RELEASE_BRANCH}
-            git branch --show-current
-            echo ""
-        fi
-        echo "Returning to branch: ${REF_NAME}"
-        git checkout ${REF_NAME}
+      # when the workflow has been manually triggered on main,
+      # we know that we definitely want the release branch to exist
+      - name: Ensure release branch exists
+        run: |
+          echo "MAJOR_VERSION ${MAJOR_VERSION}"
+          RELEASE_BRANCH=releases/${MAJOR_VERSION}
+          if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
+              echo "Branch $RELEASE_BRANCH already exists"
+              echo ""
+          else
+              echo "Creating $RELEASE_BRANCH branch"
+              git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
+              git push --set-upstream origin ${RELEASE_BRANCH}
+              git branch --show-current
+              echo ""
+          fi
+          echo "Returning to branch: ${REF_NAME}"
+          git checkout ${REF_NAME}
 
-    - name: Update current release branch
-      if: github.event_name == 'workflow_dispatch'
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${REF_NAME}
-        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch '${{ env.REF_NAME }}' \
-          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-          --is-primary-release \
-          --conductor ${GITHUB_ACTOR}
+      - name: Update current release branch
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo SOURCE_BRANCH=${REF_NAME}
+          echo TARGET_BRANCH=releases/${MAJOR_VERSION}
+          npx tsx ./pr-checks/update-release-branch.ts \
+            --repository-nwo ${{ github.repository }} \
+            --source-branch '${{ env.REF_NAME }}' \
+            --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
+            --is-primary-release \
+            --conductor ${GITHUB_ACTOR}
 
   backport:
+    name: "Create backport"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     needs: [prepare]
     if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -93,28 +94,28 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-token
-      with:
-        app-id: ${{ vars.AUTOMATION_APP_ID }}
-        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+      - name: Generate token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        id: app-token
+        with:
+          app-id: ${{ vars.AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-        token: ${{ steps.app-token.outputs.token }}
-    - uses: ./.github/actions/release-initialise
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+          token: ${{ steps.app-token.outputs.token }}
+      - uses: ./.github/actions/release-initialise
 
-    - name: Update older release branch
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${SOURCE_BRANCH}
-        echo TARGET_BRANCH=${TARGET_BRANCH}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch ${SOURCE_BRANCH} \
-          --target-branch ${TARGET_BRANCH} \
-          --conductor ${GITHUB_ACTOR}
+      - name: Update older release branch
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo SOURCE_BRANCH=${SOURCE_BRANCH}
+          echo TARGET_BRANCH=${TARGET_BRANCH}
+          npx tsx ./pr-checks/update-release-branch.ts \
+            --repository-nwo ${{ github.repository }} \
+            --source-branch ${SOURCE_BRANCH} \
+            --target-branch ${TARGET_BRANCH} \
+            --conductor ${GITHUB_ACTOR}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -22,28 +22,23 @@ jobs:
       pull-requests: write # needed to create pull request
 
     steps:
-      - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-
       - name: Checkout CodeQL Action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
 
       - name: Checkout Enterprise Releases
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: github/enterprise-releases
-          token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }}
+          token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }}
           path: ${{ github.workspace }}/enterprise-releases/
           sparse-checkout: releases.json
 

.npmrc

@@ -1 +1,2 @@
 lockfile-version=3
+min-release-age=7

.vscode/settings.json

@@ -7,19 +7,28 @@
     // transpiled JavaScript
     "build": true,
     "lib": true,
+
+    // exclude "tests" by default because it causes VSCode to start language-specific extensions
+    // that are not typically needed during development (or indeed may not work correctly)
+    "tests": true
   },
   "search.exclude": {
     "**/node_modules": true,
     "build": true,
-    "lib": true,
+    "lib": true
   },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
   // an intermediate stage where many files are modified. This setting suppresses these warnings.
   "git.ignoreLimitWarning": true,
   // Use the vendored TypeScript version to have a consistent development experience across
   // machines.
-  "typescript.tsdk": "node_modules/typescript/lib",
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
+  "[yaml]": {
+    "editor.tabSize": 2,
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
+  "prettier.prettierPath": "./node_modules/prettier"
 }

CHANGELOG.md

@@ -2,6 +2,66 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## [UNRELEASED]
+
+No user facing changes.
+
+## 4.39.1 - 21 Oct 2026
+
+- Update default CodeQL bundle version to [2.27.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#4256](https://github.com/github/codeql-action/pull/4256)
+
+## 4.39.0 - 15 Oct 2026
+
+- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)
+- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148)
+- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206)
+- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198)
+
+## 4.38.3 - 08 Oct 2026
+
+- _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
+- Update default CodeQL bundle version to [2.27.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2). [#4203](https://github.com/github/codeql-action/pull/4203)
+- Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. [#4184](https://github.com/github/codeql-action/pull/4184)
+
+## 4.38.2 - 24 Sept 2026
+
+- Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)
+
+## 4.38.1 - 18 Sept 2026
+
+- The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://github.com/github/codeql-action/pull/4146)
+
+## 4.38.0 - 09 Sept 2026
+
+- On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. [#4124](https://github.com/github/codeql-action/pull/4124)
+- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
+- Update default CodeQL bundle version to [2.27.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0). [#4129](https://github.com/github/codeql-action/pull/4129)
+
+## 4.37.9 - 26 Aug 2026
+
+- Update default CodeQL bundle version to [2.26.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4). [#4106](https://github.com/github/codeql-action/pull/4106)
+
+## 4.37.8 - 21 Aug 2026
+
+No user facing changes.
+
+## 4.37.7 - 13 Aug 2026
+
+- Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085)
+
+## 4.37.6 - 04 Aug 2026
+
+- Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)
+
+## 4.37.5 - 03 Aug 2026
+
+- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)
+
+## 4.37.4 - 29 Jul 2026
+
+- This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)
+- Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051)
+
 ## 4.37.3 - 22 Jul 2026
 
 No user facing changes.

CONTRIBUTING.md

@@ -53,6 +53,7 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Write tests.
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
+- For user-facing changes, add a change-note file. See [unreleased-change-notes/README.md](unreleased-change-notes/README.md).
 
 ## Releasing (write access required)
 
@@ -60,10 +61,13 @@ Here are a few things you can do that will increase the likelihood of your pull
     This workflow goes through the pull requests that have been merged to `main` since the last release, creates a changelog, then opens a pull request to merge the changes since the last release into the `releases/v3` release branch.
 
     You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
-1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it.
+1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it **with a merge commit** (`gh pr merge --merge`).
 1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
 1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
-1. Approve the mergeback and backport pull request (if applicable) and automerge them.
+1. Approve the mergeback and backport pull request (if applicable) and automerge them **with a merge commit** (`gh pr merge --merge`).
+
+    > [!NOTE]
+    > The release, mergeback, and backport pull requests must always be merged with a merge commit — **never squash or rebase**. The mergeback tags the release using the merge commit of the "Merge main into releases/v3" pull request, so squashing or rebasing breaks tagging and the branch linkage the release automation relies on.
 
 Once the mergeback and backport pull request have been merged, the release is complete.
 

README.md

@@ -72,12 +72,10 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
+| `v4.36.2` | `2.25.6` | Enterprise Server 3.22 | |
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
-| `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
-| `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).