Merge pull request #3778 from github/backport-v3.35.0-b8bb9f28b

Merge releases/v4 into releases/v3
Rebuild
2026-05-09 15:20:28 +00:00 · 2026-03-27 17:00:05 +01:00 · 2026-03-27 12:23:35 +00:00 · 2026-03-27 12:18:22 +00:00 · 2026-03-27 12:18:20 +00:00 · 2026-03-27 12:18:20 +00:00
125 changed files with 311181 additions and 33631 deletions
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node24
+  using: node20
  main: index.js
@@ -1,6 +1,6 @@
 name: Verify that the best-effort debug artifact scan completed
 description: Verifies that the best-effort debug artifact scan completed successfully during tests
 runs:
-  using: node24
+  using: node20
  main: index.js
  post: post.js
@@ -1,5 +1,5 @@
 name: "CodeQL config"
-queries:
+queries: 
  - name: Run custom queries
    uses: ./queries
  # Run all extra query suites, both because we want to
@@ -13,5 +13,3 @@ queries:
 paths-ignore:
  - lib
  - tests
-  - "**/*.test.ts"
-  - "**/testing-util.ts"
@@ -1,9 +1,7 @@
 version: 2
 updates:
  - package-ecosystem: npm
-    directories:
-      - "/"
-      - "/pr-checks"
+    directory: "/"
    schedule:
      interval: weekly
    cooldown:
@@ -60,12 +60,12 @@ jobs:
          setup-kotlin: 'true'
      - uses: ./../action/init
        with:
-          languages: C#,java-kotlin,typescript
+          languages: C#,java-kotlin,swift,typescript
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - name: 'Check languages'
        run: |
-          expected_languages="csharp,java,javascript"
+          expected_languages="csharp,java,swift,javascript"
          actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

          if [ "$expected_languages" != "$actual_languages" ]; then
@@ -59,7 +59,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -71,17 +71,7 @@ jobs:
        id: proxy
        uses: ./../action/start-proxy
        with:
-          registry_secrets: |
-            [
-              {
-                "type": "maven_repository",
-                "url": "https://repo.maven.apache.org/maven2/"
-              },
-              {
-                "type": "maven_repository",
-                "url": "https://repo1.maven.org/maven2"
-              }
-            ]
+          registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

      - name: Print proxy outputs
        run: |
@@ -92,12 +82,5 @@ jobs:
      - name: Fail if proxy outputs are not set
        if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
        run: exit 1
-
-      - name: Fail if proxy_urls does not contain all registries
-        if: |
-          join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-        run: exit 1
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -66,7 +66,6 @@ jobs:
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
        with:
-          languages: cpp,csharp,go,java,javascript,python
          tools: ${{ steps.prepare-test.outputs.tools-url }}
          debug: true
          debug-artifact-name: my-debug-artifacts
@@ -1,106 +0,0 @@
-# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
-# already passed CI before being merged. Therefore if they fail, we should make sure that there
-# wasn't a transient failure by rerunning the failed jobs once before investigating further.
-name: Deflake
-
-on:
-  workflow_run:
-    types: [completed]
-    # Exclude workflows that have significant side effects, like publishing releases. It's OK to
-    # retry CodeQL analysis.
-    workflows:
-      - Check Expected Release Files
-      - Code-Scanning config CLI tests
-      - CodeQL action
-      - Manual Check - go
-      - "PR Check - All-platform bundle"
-      - "PR Check - Analysis kinds"
-      - "PR Check - Analyze: 'ref' and 'sha' from inputs"
-      - "PR Check - autobuild-action"
-      - "PR Check - Autobuild direct tracing (custom working directory)"
-      - "PR Check - Autobuild working directory"
-      - "PR Check - Build mode autobuild"
-      - "PR Check - Build mode manual"
-      - "PR Check - Build mode none"
-      - "PR Check - Build mode rollback"
-      - "PR Check - Bundle: Caching checks"
-      - "PR Check - Bundle: From nightly"
-      - "PR Check - Bundle: From toolcache"
-      - "PR Check - Bundle: Zstandard checks"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
-      - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
-      - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
-      - "PR Check - Config export"
-      - "PR Check - Config input"
-      - "PR Check - Custom source root"
-      - "PR Check - Debug artifact upload"
-      - "PR Check - Debug artifacts after failure"
-      - "PR Check - Diagnostic export"
-      - "PR Check - Export file baseline information"
-      - "PR Check - Extractor ram and threads options test"
-      - "PR Check - Go: Custom queries"
-      - "PR Check - Go: diagnostic when Go is changed after init step"
-      - "PR Check - Go: diagnostic when `file` is not installed"
-      - "PR Check - Go: tracing with autobuilder step"
-      - "PR Check - Go: tracing with custom build steps"
-      - "PR Check - Go: tracing with legacy workflow"
-      - "PR Check - Go: workaround for indirect tracing"
-      - "PR Check - Job run UUID added to SARIF"
-      - "PR Check - Language aliases"
-      - "PR Check - Local CodeQL bundle"
-      - "PR Check - Multi-language repository"
-      - "PR Check - Overlay database init fallback"
-      - "PR Check - Packaging: Action input"
-      - "PR Check - Packaging: Config and input"
-      - "PR Check - Packaging: Config and input passed to the CLI"
-      - "PR Check - Packaging: Config file"
-      - "PR Check - Packaging: Download using registries"
-      - "PR Check - Proxy test"
-      - "PR Check - Remote config file"
-      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
-      - "PR Check - Ruby analysis"
-      - "PR Check - Rust analysis"
-      - "PR Check - Split workflow"
-      - "PR Check - Start proxy"
-      - "PR Check - Submit SARIF after failure"
-      - "PR Check - Swift analysis using a custom build command"
-      - "PR Check - Swift analysis using autobuild"
-      - "PR Check - Test different uses of `upload-sarif`"
-      - "PR Check - Test unsetting environment variables"
-      - "PR Check - Upload-sarif: ref and sha from inputs"
-      - "PR Check - Use a custom `checkout_path`"
-      - PR Checks
-      - Query filters tests
-      - Test that the workaround for python 3.12 on windows works
-
-jobs:
-  rerun-on-failure:
-    name: Rerun failed jobs
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      github.event.workflow_run.run_attempt == 1 &&
-      (
-        github.event.workflow_run.head_branch == 'main' ||
-        startsWith(github.event.workflow_run.head_branch, 'releases/') ||
-        github.event.workflow_run.event == 'merge_group'
-      )
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NAME: ${{ github.event.workflow_run.name }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          echo "Rerunning failed jobs for workflow run ${RUN_ID}"
-          gh run rerun "${RUN_ID}" --failed
-          echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"
@@ -24,7 +24,7 @@ defaults:

 jobs:
  merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    if: github.repository == 'github/codeql-action'
    env:
@@ -131,7 +131,7 @@ jobs:
          echo "::endgroup::"

      - name: Generate token
-        uses: actions/create-github-app-token@v3.1.1
+        uses: actions/create-github-app-token@v3.0.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -29,7 +29,7 @@ defaults:
 jobs:
  prepare:
    name: "Prepare release"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.repository == 'github/codeql-action'

    permissions:
@@ -136,7 +136,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v3.1.1
+        uses: actions/create-github-app-token@v3.0.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -20,7 +20,7 @@ defaults:
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
@@ -57,17 +57,6 @@ jobs:
      - name: Update bundle
        uses: ./.github/actions/update-bundle

-      - name: Set up CodeQL CLI from new bundle
-        id: setup-codeql
-        uses: ./setup-codeql
-        with:
-          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
-
-      - name: Update built-in languages
-        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
-        env:
-          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
-
      - name: Bump Action minor version if new CodeQL minor version series
        id: bump-action-version
        run: |
@@ -26,7 +26,7 @@ jobs:

  update:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
@@ -77,7 +77,7 @@ jobs:

  backport:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -93,7 +93,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@v3.1.1
+      uses: actions/create-github-app-token@v3.0.0
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -11,5 +11,3 @@ build/
 eslint.sarif
 # for local incremental compilation
 tsconfig.tsbuildinfo
-# esbuild metadata file
-meta.json
@@ -19,7 +19,7 @@
    "scope": "javascript, typescript",
    "prefix": "testMacro",
    "body": [
-      "const ${1:nameMacro} = makeMacro({",
+      "const ${1:nameMacro} = test.macro({",
      "  exec: async (t: ExecutionContext<unknown>) => {},",
      "",
      "  title: (providedTitle = \"\") => `${2:common title} - \\${providedTitle}`,",
@@ -2,53 +2,24 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## [UNRELEASED]
-
- Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)
-
-## 4.35.4 - 07 May 2026
-
- Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)
-
-## 4.35.3 - 01 May 2026
-
- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
- Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
- Best-effort connection tests for private registries now use `GET` requests instead of `HEAD` for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. [#3853](https://github.com/github/codeql-action/pull/3853)
- Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
- Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)
-
-## 4.35.2 - 15 Apr 2026
-
- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
- The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
- Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://github.com/github/codeql-action/pull/3794)
- Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
- Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
-
-## 4.35.1 - 27 Mar 2026
-
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
-
-## 4.35.0 - 27 Mar 2026
+## 3.35.0 - 27 Mar 2026

 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
 - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)

-## 4.34.1 - 20 Mar 2026
+## 3.34.1 - 20 Mar 2026

 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)

-## 4.34.0 - 20 Mar 2026
+## 3.34.0 - 20 Mar 2026

 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
 - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
 - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)

-## 4.33.0 - 16 Mar 2026
+## 3.33.0 - 16 Mar 2026

 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)
-
  To opt out of this change:
  - **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
  - **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
@@ -59,11 +30,11 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
 - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

-## 4.32.6 - 05 Mar 2026
+## 3.32.6 - 05 Mar 2026

 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)

-## 4.32.5 - 02 Mar 2026
+## 3.32.5 - 02 Mar 2026

 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
 - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
@@ -73,7 +44,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
 - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)

-## 4.32.4 - 20 Feb 2026
+## 3.32.4 - 20 Feb 2026

 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
 - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
@@ -81,88 +52,88 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
 - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)

-## 4.32.3 - 13 Feb 2026
+## 3.32.3 - 13 Feb 2026

 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

-## 4.32.2 - 05 Feb 2026
+## 3.32.2 - 05 Feb 2026

 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)

-## 4.32.1 - 02 Feb 2026
+## 3.32.1 - 02 Feb 2026

 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
 - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)

-## 4.32.0 - 26 Jan 2026
+## 3.32.0 - 26 Jan 2026

 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425)

-## 4.31.11 - 23 Jan 2026
+## 3.31.11 - 23 Jan 2026

 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409)
 - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415)
 - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318)
 - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403)

-## 4.31.10 - 12 Jan 2026
+## 3.31.10 - 12 Jan 2026

 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393)

-## 4.31.9 - 16 Dec 2025
+## 3.31.9 - 16 Dec 2025

 No user facing changes.

-## 4.31.8 - 11 Dec 2025
+## 3.31.8 - 11 Dec 2025

 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354)

-## 4.31.7 - 05 Dec 2025
+## 3.31.7 - 05 Dec 2025

 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343)

-## 4.31.6 - 01 Dec 2025
+## 3.31.6 - 01 Dec 2025

 No user facing changes.

-## 4.31.5 - 24 Nov 2025
+## 3.31.5 - 24 Nov 2025

 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321)

-## 4.31.4 - 18 Nov 2025
+## 3.31.4 - 18 Nov 2025

 No user facing changes.

-## 4.31.3 - 13 Nov 2025
+## 3.31.3 - 13 Nov 2025

 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
 - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)

-## 4.31.2 - 30 Oct 2025
+## 3.31.2 - 30 Oct 2025

 No user facing changes.

-## 4.31.1 - 30 Oct 2025
+## 3.31.1 - 30 Oct 2025

 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

-## 4.31.0 - 24 Oct 2025
+## 3.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 4.30.9 - 17 Oct 2025
+## 3.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 4.30.8 - 10 Oct 2025
+## 3.30.8 - 10 Oct 2025

 No user facing changes.

-## 4.30.7 - 06 Oct 2025
+## 3.30.7 - 06 Oct 2025

- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
+No user facing changes.

 ## 3.30.6 - 02 Oct 2025

@@ -398,17 +369,13 @@ No user facing changes.
 ## 3.26.12 - 07 Oct 2024

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520)
-
  - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
-
  - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

 ## 3.26.11 - 03 Oct 2024

 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts.
-
  Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then.
-
  This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES.
 - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519)

@@ -531,12 +498,9 @@ No user facing changes.
 ## 3.25.0 - 15 Apr 2024

 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224)
-
  As a result, the following inputs and environment variables are now ignored:
-
  - The `setup-python-dependencies` input to the `init` Action
  - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable
-
  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.
 - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229)
 - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232)
@@ -72,7 +72,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n

 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
@@ -94,6 +94,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
+  using: node20
  main: "../lib/analyze-action.js"
  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node24
+  using: node20
  main: '../lib/autobuild-action.js'
@@ -1,4 +1,4 @@
-import { copyFile, rm, writeFile } from "node:fs/promises";
+import { copyFile, rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

@@ -64,11 +64,7 @@ const onEndPlugin = {

 const context = await esbuild.context({
  // Include upload-lib.ts as an entry point for use in testing environments.
-  entryPoints: globSync([
-    `${SRC_DIR}/*-action.ts`,
-    `${SRC_DIR}/*-action-post.ts`,
-    "src/upload-lib.ts",
-  ]),
+  entryPoints: globSync([`${SRC_DIR}/*-action.ts`, `${SRC_DIR}/*-action-post.ts`, "src/upload-lib.ts"]),
  bundle: true,
  format: "cjs",
  outdir: OUT_DIR,
@@ -78,10 +74,7 @@ const context = await esbuild.context({
  define: {
    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
  },
-  metafile: true,
 });

-const result = await context.rebuild();
-await writeFile(join(__dirname, "meta.json"), JSON.stringify(result.metafile));
-
+await context.rebuild();
 await context.dispose();
@@ -170,6 +170,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
+  using: node20
  main: '../lib/init-action.js'
  post: '../lib/init-action-post.js'
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.4",
-  "cliVersion": "2.25.4",
-  "priorBundleVersion": "codeql-bundle-v2.25.3",
-  "priorCliVersion": "2.25.3"
+  "bundleVersion": "codeql-bundle-v2.25.1",
+  "cliVersion": "2.25.1",
+  "priorBundleVersion": "codeql-bundle-v2.24.3",
+  "priorCliVersion": "2.24.3"
 }
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.35.5",
+  "version": "3.35.0",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -12,7 +12,7 @@
    "ava": "npm run transpile && ava --verbose",
    "test": "npm run ava -- src/",
    "test-debug": "npm run test -- --timeout=20m",
-    "transpile": "tsc --build --verbose tsconfig.json"
+    "transpile": "tsc --build --verbose"
  },
  "license": "MIT",
  "workspaces": [
@@ -29,46 +29,47 @@
    "@actions/http-client": "^3.0.0",
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
-    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-retry": "^8.0.0",
+    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
    "fast-deep-equal": "^3.1.3",
-    "follow-redirects": "^1.16.0",
+    "follow-redirects": "^1.15.11",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
    "js-yaml": "^4.1.1",
-    "jsonschema": "1.5.0",
+    "jsonschema": "1.4.1",
    "long": "^5.3.2",
-    "node-forge": "^1.4.0",
+    "node-forge": "^1.3.3",
    "semver": "^7.7.4",
-    "uuid": "^14.0.0"
+    "uuid": "^13.0.0"
  },
  "devDependencies": {
-    "@ava/typescript": "7.0.0",
-    "@eslint/compat": "^2.0.5",
+    "@ava/typescript": "6.0.0",
+    "@eslint/compat": "^2.0.3",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
    "@octokit/types": "^16.0.0",
    "@types/archiver": "^7.0.0",
    "@types/follow-redirects": "^1.14.4",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.19.39",
+    "@types/node": "^20.19.9",
    "@types/node-forge": "^1.3.14",
    "@types/sarif": "^2.1.7",
    "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.1",
+    "@types/sinon": "^21.0.0",
    "ava": "^7.0.0",
-    "esbuild": "^0.28.0",
-    "eslint": "^9.39.4",
-    "eslint-import-resolver-typescript": "^4.4.4",
+    "esbuild": "^0.27.4",
+    "eslint": "^9.39.2",
+    "eslint-import-resolver-typescript": "^3.8.7",
    "eslint-plugin-github": "^6.0.0",
    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jsdoc": "^62.9.0",
+    "eslint-plugin-jsdoc": "^62.8.0",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^11.1.0",
-    "globals": "^17.5.0",
-    "nock": "^14.0.12",
-    "sinon": "^21.1.2",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.1"
+    "globals": "^17.4.0",
+    "nock": "^14.0.11",
+    "sinon": "^21.0.3",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.1"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -90,7 +91,6 @@
      "semver": ">=6.3.1"
    },
    "brace-expansion@2.0.1": "2.0.2",
-    "glob": "^11.1.0",
-    "undici": "^6.24.0"
+    "glob": "^11.1.0"
  }
 }
@@ -1,13 +0,0 @@
-import * as githubUtils from "@actions/github/lib/utils";
-import { type Octokit } from "@octokit/core";
-import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
-import { type Api } from "@octokit/plugin-rest-endpoint-methods";
-
-/** The type of the Octokit client. */
-export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
-
-/** Constructs an `ApiClient` using `token` for authentication. */
-export function getApiClient(token: string): ApiClient {
-  const opts = githubUtils.getOctokitOptions(token);
-  return new githubUtils.GitHub(opts);
-}
@@ -1,48 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs/promises";
-
-import { BUNDLE_METADATA_FILE } from "./config";
-
-interface InputInfo {
-  bytesInOutput: number;
-}
-
-type Inputs = Record<string, InputInfo>;
-
-interface Output {
-  bytes: number;
-  inputs: Inputs;
-}
-
-interface Metadata {
-  outputs: Record<string, Output>;
-}
-
-function toMB(bytes: number): string {
-  return `${(bytes / (1024 * 1024)).toFixed(2)}MB`;
-}
-
-async function main() {
-  const fileContents = await fs.readFile(BUNDLE_METADATA_FILE);
-  const metadata = JSON.parse(String(fileContents)) as Metadata;
-
-  for (const [outputFile, outputData] of Object.entries(
-    metadata.outputs,
-  ).reverse()) {
-    console.info(`${outputFile}: ${toMB(outputData.bytes)}`);
-
-    for (const [inputName, inputData] of Object.entries(outputData.inputs)) {
-      // Ignore any inputs that make up less than 5% of the output.
-      const percentage = (inputData.bytesInOutput / outputData.bytes) * 100.0;
-      if (percentage < 5.0) continue;
-
-      console.info(`  ${inputName}: ${toMB(inputData.bytesInOutput)}`);
-    }
-  }
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -5,12 +5,12 @@ versions:
 steps:
  - uses: ./../action/init
    with:
-      languages: C#,java-kotlin,typescript
+      languages: C#,java-kotlin,swift,typescript
      tools: ${{ steps.prepare-test.outputs.tools-url }}

  - name: "Check languages"
    run: |
-      expected_languages="csharp,java,javascript"
+      expected_languages="csharp,java,swift,javascript"
      actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

      if [ "$expected_languages" != "$actual_languages" ]; then
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+    uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -16,17 +16,7 @@ steps:
    id: proxy
    uses: ./../action/start-proxy
    with:
-      registry_secrets: |
-        [
-          {
-            "type": "maven_repository",
-            "url": "https://repo.maven.apache.org/maven2/"
-          },
-          {
-            "type": "maven_repository",
-            "url": "https://repo1.maven.org/maven2"
-          }
-        ]
+      registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

  - name: Print proxy outputs
    run: |
@@ -37,10 +27,3 @@ steps:
  - name: Fail if proxy outputs are not set
    if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
    run: exit 1
-
-  - name: Fail if proxy_urls does not contain all registries
-    if: |
-      join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-    run: exit 1
@@ -8,16 +8,3 @@ export const PR_CHECKS_DIR = __dirname;

 /** The path of the file configuring which checks shouldn't be required. */
 export const PR_CHECK_EXCLUDED_FILE = path.join(PR_CHECKS_DIR, "excluded.yml");
-
-/** The path to the esbuild metadata file. */
-export const BUNDLE_METADATA_FILE = path.join(PR_CHECKS_DIR, "..", "meta.json");
-
-/** The `src` directory. */
-const SOURCE_ROOT = path.join(PR_CHECKS_DIR, "..", "src");
-
-/** The path to the built-in languages file. */
-export const BUILTIN_LANGUAGES_FILE = path.join(
-  SOURCE_ROOT,
-  "languages",
-  "builtin.json",
-);
@@ -10,7 +10,7 @@
    "yaml": "^2.8.3"
  },
  "devDependencies": {
-    "@types/node": "^20.19.39",
+    "@types/node": "^20.19.9",
    "tsx": "^4.21.0"
  }
 }
@@ -5,9 +5,12 @@
 import * as fs from "fs";
 import { parseArgs } from "node:util";

+import * as githubUtils from "@actions/github/lib/utils";
+import { type Octokit } from "@octokit/core";
+import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
+import { type Api } from "@octokit/plugin-rest-endpoint-methods";
 import * as yaml from "yaml";

-import { type ApiClient, getApiClient } from "./api-client";
 import {
  OLDEST_SUPPORTED_MAJOR_VERSION,
  PR_CHECK_EXCLUDED_FILE,
@@ -46,6 +49,15 @@ function loadExclusions(): Exclusions {
  ) as Exclusions;
 }

+/** The type of the Octokit client. */
+type ApiClient = Octokit & Api & { paginate: PaginateInterface };
+
+/** Constructs an `ApiClient` using `token` for authentication. */
+function getApiClient(token: string): ApiClient {
+  const opts = githubUtils.getOctokitOptions(token);
+  return new githubUtils.GitHub(opts);
+}
+
 /**
 * Represents information about a check run. We track the `app_id` that generated the check,
 * because the API will require it in addition to the name in the future.
@@ -5,7 +5,7 @@ import * as path from "path";

 import * as yaml from "yaml";

-import { BuiltInLanguage } from "../src/languages";
+import { KnownLanguage } from "../src/languages";

 /** Known workflow input names. */
 enum KnownInputName {
@@ -91,8 +91,8 @@ interface LanguageSetup {
  steps: Step[];
 }

-/** Describes partial mappings from built-in languages to their specific setup information. */
-type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
+/** Describes partial mappings from known languages to their specific setup information. */
+type LanguageSetups = Partial<Record<KnownLanguage, LanguageSetup>>;

 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
@@ -125,7 +125,7 @@ const defaultLanguageVersions = {
  java: "17",
  python: "3.13",
  csharp: "9.x",
-} as const satisfies Partial<Record<BuiltInLanguage, string>>;
+} as const satisfies Partial<Record<KnownLanguage, string>>;

 /** A mapping from known input names to their specifications. */
 const inputSpecs: WorkflowInputs = {
@@ -364,7 +364,7 @@ function getSetupSteps(checkSpecification: JobSpecification): {
  const inputs: Array<Set<KnownInputName>> = [];
  const steps: Step[] = [];

-  for (const language of Object.values(BuiltInLanguage).sort()) {
+  for (const language of Object.values(KnownLanguage).sort()) {
    const setupSpec = languageSetups[language];

    if (
@@ -3,7 +3,6 @@
  "compilerOptions": {
    /* Basic Options */
    "lib": ["esnext"],
-    "module": "preserve",
    "rootDir": "..",
    "sourceMap": false,
    "noEmit": true,
@@ -1,131 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
- * Updates src/languages/builtin.json by querying the CodeQL CLI for:
- * - Languages that have default queries (via codeql-extractor.yml)
- * - Language aliases (via `codeql resolve languages --format=betterjson --extractor-include-aliases`)
- *
- * Usage:
- *   npx tsx pr-checks/update-builtin-languages.ts [path-to-codeql]
- *
- * If no path is given, falls back to "codeql".
- */
-
-import { execFileSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import * as yaml from "yaml";
-
-import { EnvVar } from "../src/environment";
-
-import { BUILTIN_LANGUAGES_FILE } from "./config";
-
-/** Resolve all known language extractor directories. */
-function resolveLanguages(codeqlPath: string): Record<string, string[]> {
-  return JSON.parse(
-    execFileSync(codeqlPath, ["resolve", "languages", "--format=json"], {
-      encoding: "utf8",
-      env: {
-        ...process.env,
-        [EnvVar.EXPERIMENTAL_FEATURES]: "true", // include experimental languages
-      },
-    }),
-  ) as Record<string, string[]>;
-}
-
-/**
- * Return the sorted list of languages whose extractors ship default queries.
- *
- * @param extractorDirs - Map from language to list of extractor directories
- */
-function findLanguagesWithDefaultQueries(
-  extractorDirs: Record<string, string[]>,
-): string[] {
-  const languages: string[] = [];
-
-  for (const [language, dirs] of Object.entries(extractorDirs)) {
-    if (dirs.length !== 1) {
-      throw new Error(
-        `Expected exactly one extractor directory for language '${language}', but found ${dirs.length}: ${dirs.join(
-          ", ",
-        )}`,
-      );
-    }
-
-    const extractorYmlPath = path.join(dirs[0], "codeql-extractor.yml");
-
-    if (!fs.existsSync(extractorYmlPath)) {
-      throw new Error(
-        `Extractor YAML not found for language '${language}' at expected path: ${extractorYmlPath}`,
-      );
-    }
-
-    const extractorYml = yaml.parse(fs.readFileSync(extractorYmlPath, "utf8"));
-    const defaultQueries: unknown[] | undefined = extractorYml.default_queries;
-
-    if (Array.isArray(defaultQueries) && defaultQueries.length > 0) {
-      console.log(
-        `  ✅ ${language}: included (default queries: ${JSON.stringify(defaultQueries)})`,
-      );
-      languages.push(language);
-    } else {
-      console.log(`  ❌ ${language}: excluded (no default queries)`);
-    }
-  }
-
-  return languages.sort();
-}
-
-/**
- * Resolve language aliases from the CodeQL CLI, keeping only those whose
- * target is in the given set of included languages.
- */
-function resolveAliases(
-  codeqlPath: string,
-  includedLanguages: Set<string>,
-): Record<string, string> {
-  const betterjsonOutput = JSON.parse(
-    execFileSync(
-      codeqlPath,
-      [
-        "resolve",
-        "languages",
-        "--format=betterjson",
-        "--extractor-include-aliases",
-      ],
-      { encoding: "utf8" },
-    ),
-  );
-
-  return Object.fromEntries(
-    Object.entries((betterjsonOutput.aliases ?? {}) as Record<string, string>)
-      .filter(([, target]) => includedLanguages.has(target))
-      .sort(([a], [b]) => a.localeCompare(b)),
-  );
-}
-
-/** Write the built-in languages data to disk. */
-function writeBuiltinLanguages(
-  languages: string[],
-  aliases: Record<string, string>,
-): void {
-  const content = `${JSON.stringify({ languages, aliases }, null, 2)}\n`;
-  fs.mkdirSync(path.dirname(BUILTIN_LANGUAGES_FILE), { recursive: true });
-  fs.writeFileSync(BUILTIN_LANGUAGES_FILE, content);
-
-  console.log(`\nWrote ${BUILTIN_LANGUAGES_FILE}`);
-  console.log(`  Languages: ${languages.join(", ")}`);
-  console.log(`  Aliases: ${Object.keys(aliases).join(", ")}`);
-}
-
-function main(): void {
-  const codeqlPath = process.argv[2] || "codeql";
-
-  const extractorDirs = resolveLanguages(codeqlPath);
-  const languages = findLanguagesWithDefaultQueries(extractorDirs);
-  const aliases = resolveAliases(codeqlPath, new Set(languages));
-  writeBuiltinLanguages(languages, aliases);
-}
-
-main();
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node24
+  using: node20
  main: '../lib/resolve-environment-action.js'
@@ -19,25 +19,6 @@ inputs:
      If not specified, the Action will check in several places until it finds
      the CodeQL tools.
    required: false
-  languages:
-    description: >-
-      A comma-separated list of CodeQL languages that will be analyzed in subsequent
-      `github/codeql-action/init` and `github/codeql-action/analyze` invocations. If specified, the
-      Action may use this list to select a CodeQL CLI version that is best suited to analyzing those
-      languages, for example by preferring a version that has a cached overlay-base database for the
-      specified languages. This input is not remembered and must also be passed to
-      `github/codeql-action/init`.
-    required: false
-  analysis-kinds:
-    description: >-
-      [Internal] A comma-separated list of analysis kinds that subsequent
-      `github/codeql-action/init` invocations will enable. If specified, the Action may use this
-      list to select a CodeQL CLI version that is best suited to those analysis kinds. This input is
-      not remembered and must also be passed to `github/codeql-action/init`.
-
-      Available options are the same as for the `analysis-kinds` input on the `init` Action.
-    default: 'code-scanning'
-    required: true
  token:
    description: GitHub token to use for authenticating with this instance of GitHub.
    default: ${{ github.token }}
@@ -54,5 +35,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node24
+  using: node20
  main: '../lib/setup-codeql-action.js'
@@ -30,9 +30,9 @@ import {
 } from "./dependency-caching";
 import { EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
-import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay/caching";
+import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay";
 import { getRepositoryNwo } from "./repository";
 import * as statusReport from "./status-report";
 import {
@@ -135,13 +135,9 @@ function hasBadExpectErrorInput(): boolean {
 function doesGoExtractionOutputExist(config: Config): boolean {
  const golangDbDirectory = util.getCodeQLDatabasePath(
    config,
-    BuiltInLanguage.go,
-  );
-  const trapDirectory = path.join(
-    golangDbDirectory,
-    "trap",
-    BuiltInLanguage.go,
+    KnownLanguage.go,
  );
+  const trapDirectory = path.join(golangDbDirectory, "trap", KnownLanguage.go);
  return (
    fs.existsSync(trapDirectory) &&
    fs
@@ -173,7 +169,7 @@ function doesGoExtractionOutputExist(config: Config): boolean {
 * whether any extraction output already exists for Go.
 */
 async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
-  if (!config.languages.includes(BuiltInLanguage.go)) {
+  if (!config.languages.includes(KnownLanguage.go)) {
    return;
  }
  if (config.buildMode) {
@@ -186,7 +182,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
    logger.debug("Won't run Go autobuild since it has already been run.");
    return;
  }
-  if (dbIsFinalized(config, BuiltInLanguage.go, logger)) {
+  if (dbIsFinalized(config, KnownLanguage.go, logger)) {
    logger.debug(
      "Won't run Go autobuild since there is already a finalized database for Go.",
    );
@@ -209,7 +205,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  logger.debug(
    "Running Go autobuild because extraction output (TRAP files) for Go code has not been found.",
  );
-  await runAutobuild(config, BuiltInLanguage.go, logger);
+  await runAutobuild(config, KnownLanguage.go, logger);
 }

 async function run(startedAt: Date) {
@@ -14,7 +14,7 @@ import {
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
 import { Feature } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
  setupTests,
@@ -41,7 +41,7 @@ test.serial("status report fields", async (t) => {
    const threadsFlag = "";
    sinon.stub(uploadLib, "validateSarifFileSchema");

-    for (const language of Object.values(BuiltInLanguage)) {
+    for (const language of Object.values(KnownLanguage)) {
      const codeql = createStubCodeQL({
        databaseRunQueries: async () => {},
        databaseInterpretResults: async (
@@ -130,13 +130,13 @@ test.serial("status report fields", async (t) => {
 test("resolveQuerySuiteAlias", (t) => {
  // default query suite names should resolve to something language-specific ending in `.qls`.
  for (const suite of defaultSuites) {
-    const resolved = resolveQuerySuiteAlias(BuiltInLanguage.go, suite);
+    const resolved = resolveQuerySuiteAlias(KnownLanguage.go, suite);
    t.assert(
      path.extname(resolved) === ".qls",
      "Resolved default suite doesn't end in .qls",
    );
    t.assert(
-      resolved.indexOf(BuiltInLanguage.go) >= 0,
+      resolved.indexOf(KnownLanguage.go) >= 0,
      "Resolved default suite doesn't contain language name",
    );
  }
@@ -145,12 +145,12 @@ test("resolveQuerySuiteAlias", (t) => {
  const names = ["foo", "bar", "codeql/go-queries@1.0"];

  for (const name of names) {
-    t.deepEqual(resolveQuerySuiteAlias(BuiltInLanguage.go, name), name);
+    t.deepEqual(resolveQuerySuiteAlias(KnownLanguage.go, name), name);
  }
 });

 test("addSarifExtension", (t) => {
-  for (const language of Object.values(BuiltInLanguage)) {
+  for (const language of Object.values(KnownLanguage)) {
    t.deepEqual(addSarifExtension(CodeScanning, language), `${language}.sarif`);
    t.deepEqual(
      addSarifExtension(CodeQuality, language),
@@ -21,9 +21,9 @@ import {
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import type * as sarif from "./sarif";
 import { DatabaseCreationTimings, EventReport } from "./status-report";
 import { endTracingForCluster } from "./tracer-config";
@@ -41,7 +41,7 @@ export class CodeQLAnalysisError extends Error {
  }
 }

-type BuiltInLanguageKey = keyof typeof BuiltInLanguage;
+type KnownLanguageKey = keyof typeof KnownLanguage;

 type RunQueriesDurationStatusReport = {
  /**
@@ -50,12 +50,12 @@ type RunQueriesDurationStatusReport = {
   * The "builtin" designation is now outdated with the move to CLI config parsing: this is the time
   * taken to run _all_ the queries.
   */
-  [L in BuiltInLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
 };

 type InterpretResultsDurationStatusReport = {
  /** Time taken in ms to interpret results for the language (or undefined if this language was not analyzed). */
-  [L in BuiltInLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
 };

 export interface QueriesStatusReport
@@ -115,12 +115,12 @@ export async function runExtraction(

    if (await shouldExtractLanguage(codeql, config, language)) {
      logger.startGroup(`Extracting ${language}`);
-      if (language === BuiltInLanguage.python) {
+      if (language === KnownLanguage.python) {
        await setupPythonExtractor(logger);
      }
      if (config.buildMode) {
        if (
-          language === BuiltInLanguage.cpp &&
+          language === KnownLanguage.cpp &&
          config.buildMode === BuildMode.Autobuild
        ) {
          await setupCppAutobuild(codeql, logger);
@@ -131,14 +131,14 @@ export async function runExtraction(
        // a stable path that caches can be restored into and that we can cache at the
        // end of the workflow (i.e. that does not get removed when the scratch directory is).
        if (
-          language === BuiltInLanguage.java &&
+          language === KnownLanguage.java &&
          config.buildMode === BuildMode.None
        ) {
          process.env["CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_DEPENDENCY_DIR"] =
            getJavaTempDependencyDir();
        }
        if (
-          language === BuiltInLanguage.csharp &&
+          language === KnownLanguage.csharp &&
          config.buildMode === BuildMode.None &&
          (await features.getValue(Feature.CsharpCacheBuildModeNone))
        ) {
@@ -251,9 +251,16 @@ export async function setupDiffInformedQueryRun(
        diffRanges,
        checkoutPath,
      );
-      logger.info(
-        `Successfully created diff range extension pack at ${packDir}.`,
-      );
+      if (packDir === undefined) {
+        logger.warning(
+          "Cannot create diff range extension pack for diff-informed queries; " +
+            "reverting to performing full analysis.",
+        );
+      } else {
+        logger.info(
+          `Successfully created diff range extension pack at ${packDir}.`,
+        );
+      }
      return packDir;
    },
  );
@@ -307,13 +314,18 @@ extensions:
 * @param ranges The file line ranges, as returned by
 * `getPullRequestEditedDiffRanges`.
 * @param checkoutPath The path at which the repository was checked out.
- * @returns The absolute path of the directory containing the extension pack.
+ * @returns The absolute path of the directory containing the extension pack, or
+ * `undefined` if no extension pack was created.
 */
 function writeDiffRangeDataExtensionPack(
  logger: Logger,
-  ranges: DiffThunkRange[],
+  ranges: DiffThunkRange[] | undefined,
  checkoutPath: string,
-): string {
+): string | undefined {
+  if (ranges === undefined) {
+    return undefined;
+  }
+
  if (ranges.length === 0) {
    // An empty diff range means that there are no added or modified lines in
    // the pull request. But the `restrictAlertsTo` extensible predicate
@@ -686,7 +698,7 @@ export async function warnIfGoInstalledAfterInit(

      addDiagnostic(
        config,
-        BuiltInLanguage.go,
+        KnownLanguage.go,
        makeDiagnostic(
          "go/workflow/go-installed-after-codeql-init",
          "Go was installed after the `codeql-action/init` Action was run",
@@ -128,8 +128,6 @@ export async function getGitHubVersionFromApi(

  // Doesn't strictly have to be the meta endpoint as we're only
  // using the response headers which are available on every request.
-  //
-  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
  const response = await apiClient.rest.meta.get();

@@ -166,9 +164,6 @@ export async function getGitHubVersion(): Promise<GitHubVersion> {

 /**
 * Get the path of the currently executing workflow relative to the repository root.
- *
- * See https://docs.github.com/en/rest/actions/workflow-runs#get-a-workflow-run
- * and https://docs.github.com/en/rest/actions/workflows#get-a-workflow.
 */
 export async function getWorkflowRelativePath(): Promise<string> {
  const repo_nwo = getRepositoryNwo();
@@ -257,13 +252,9 @@ export interface ActionsCacheItem {
  size_in_bytes?: number;
 }

-/**
- * List all Actions cache entries starting with the provided key prefix and matching the provided ref.
- *
- * See https://docs.github.com/en/rest/actions/cache#list-github-actions-caches-for-a-repository.
- */
+/** List all Actions cache entries matching the provided key and ref. */
 export async function listActionsCaches(
-  keyPrefix: string,
+  key: string,
  ref?: string,
 ): Promise<ActionsCacheItem[]> {
  const repositoryNwo = getRepositoryNwo();
@@ -273,17 +264,13 @@ export async function listActionsCaches(
    {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
-      key: keyPrefix,
+      key,
      ref,
    },
  );
 }

-/**
- * Delete an Actions cache item by its ID.
- *
- * See https://docs.github.com/en/rest/actions/cache#delete-a-github-actions-cache-for-a-repository-using-a-cache-id.
- */
+/** Delete an Actions cache item by its ID. */
 export async function deleteActionsCache(id: number) {
  const repositoryNwo = getRepositoryNwo();

@@ -294,11 +281,7 @@ export async function deleteActionsCache(id: number) {
  });
 }

-/**
- * Retrieve all custom repository properties.
- *
- * See https://docs.github.com/en/rest/repos/custom-properties#get-all-custom-property-values-for-a-repository.
- */
+/** Retrieve all custom repository properties. */
 export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
  return getApiClient().request("GET /repos/:owner/:repo/properties/values", {
    owner: repositoryNwo.owner,
@@ -1 +1 @@
-{"maximumVersion": "3.21", "minimumVersion": "3.16"}
+{"maximumVersion": "3.21", "minimumVersion": "3.14"}
@@ -141,12 +141,7 @@ test("scanArtifactsForTokens handles files without tokens", async (t) => {
  }
 });

-// This test is slow (extracts and scans a zip artifact), so by default we only run it in CI. Set
-// RUN_SLOW_TESTS=1 to run it locally.
-if (
-  os.platform() !== "win32" &&
-  (process.env.CI === "true" || process.env.RUN_SLOW_TESTS === "1")
-) {
+if (os.platform() !== "win32") {
  test("scanArtifactsForTokens finds token in debug artifacts", async (t) => {
    t.timeout(15000); // 15 seconds
    const messages: LoggedMessage[] = [];
@@ -156,10 +156,6 @@ async function scanArchiveFile(
    );
  }

-  if (process.platform === "win32") {
-    throw new Error("Scanning archives is not supported on Windows.");
-  }
-
  const result: ScanResult = {
    scannedFiles: 0,
    findings: [],
@@ -7,7 +7,7 @@ import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
 import { EnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
 import { asyncFilter, BuildMode } from "./util";
@@ -72,7 +72,7 @@ export async function determineAutobuildLanguages(
   * version of the CodeQL Action.
   */
  const autobuildLanguagesWithoutGo = autobuildLanguages.filter(
-    (l) => l !== BuiltInLanguage.go,
+    (l) => l !== KnownLanguage.go,
  );

  const languages: Language[] = [];
@@ -84,7 +84,7 @@ export async function determineAutobuildLanguages(
  // If Go is requested, run the Go autobuilder last to ensure it doesn't
  // interfere with the other autobuilder.
  if (autobuildLanguages.length !== autobuildLanguagesWithoutGo.length) {
-    languages.push(BuiltInLanguage.go);
+    languages.push(KnownLanguage.go);
  }

  logger.debug(`Will autobuild ${languages.join(" and ")}.`);
@@ -156,7 +156,7 @@ export async function runAutobuild(
 ) {
  logger.startGroup(`Attempting to automatically build ${language} code`);
  const codeQL = await getCodeQL(config.codeQLCmd);
-  if (language === BuiltInLanguage.cpp) {
+  if (language === KnownLanguage.cpp) {
    await setupCppAutobuild(codeQL, logger);
  }
  if (config.buildMode) {
@@ -164,7 +164,7 @@ export async function runAutobuild(
  } else {
    await codeQL.runAutobuild(config, language);
  }
-  if (language === BuiltInLanguage.go) {
+  if (language === KnownLanguage.go) {
    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
  }
  logger.endGroup();
@@ -299,20 +299,6 @@ test("wrapCliConfigurationError - swift build failed", (t) => {
  t.true(wrappedError instanceof ConfigurationError);
 });

-test("wrapCliConfigurationError - swift incompatible os", (t) => {
-  const commandError = new CommandInvocationError(
-    "codeql",
-    ["swift/tools/autobuild.sh"],
-    1,
-    "2026-04-01 18:35:00 EST ERRO [extractor/main] [incompatible-os] Currently, Swift analysis is only supported on macOS. (IncompatibleOs.cpp:26)",
-  );
-  const cliError = new CliError(commandError);
-
-  const wrappedError = wrapCliConfigurationError(cliError);
-
-  t.true(wrappedError instanceof ConfigurationError);
-});
-
 test("wrapCliConfigurationError - pack cannot be found", (t) => {
  const commandError = new CommandInvocationError(
    "codeql",
@@ -144,7 +144,6 @@ export enum CliConfigErrorCategory {
  OutOfMemoryOrDisk = "OutOfMemoryOrDisk",
  PackCannotBeFound = "PackCannotBeFound",
  PackMissingAuth = "PackMissingAuth",
-  SwiftIncompatibleOs = "SwiftIncompatibleOs",
  SwiftBuildFailed = "SwiftBuildFailed",
  UnsupportedBuildMode = "UnsupportedBuildMode",
 }
@@ -282,12 +281,6 @@ const cliErrorsConfig: Record<CliConfigErrorCategory, CliErrorConfiguration> = {
      ),
    ],
  },
-  [CliConfigErrorCategory.SwiftIncompatibleOs]: {
-    cliErrorMessageCandidates: [
-      new RegExp("\\[incompatible-os\\]"),
-      new RegExp("Swift analysis is only supported on macOS"),
-    ],
-  },
  [CliConfigErrorCategory.UnsupportedBuildMode]: {
    cliErrorMessageCandidates: [
      new RegExp(
@@ -21,7 +21,7 @@ import {
 import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -33,7 +33,6 @@ import {
  mockBundleDownloadApi,
  makeVersionInfo,
  createTestConfig,
-  makeMacro,
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
@@ -47,7 +46,7 @@ test.beforeEach(() => {
  initializeEnvironment("1.2.3");

  stubConfig = createTestConfig({
-    languages: [BuiltInLanguage.cpp],
+    languages: [KnownLanguage.cpp],
  });
 });

@@ -71,10 +70,8 @@ async function installIntoToolcache({
    tmpDir,
    util.GitHubVariant.GHES,
    cliVersion !== undefined
-      ? { enabledVersions: [{ cliVersion, tagName }] }
+      ? { cliVersion, tagName }
      : SAMPLE_DEFAULT_CLI_VERSION,
-    undefined, // rawLanguages
-    false, // useOverlayAwareDefaultCliVersion
    createFeatures([]),
    getRunnerLogger(true),
    false,
@@ -118,7 +115,7 @@ async function stubCodeql(): Promise<codeql.CodeQL> {
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
  sinon
    .stub(codeqlObject, "isTracedLanguage")
-    .withArgs(BuiltInLanguage.cpp)
+    .withArgs(KnownLanguage.cpp)
    .resolves(true);
  return codeqlObject;
 }
@@ -146,8 +143,6 @@ test.serial(
          tmpDir,
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
-          undefined, // rawLanguages
-          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
          false,
@@ -180,8 +175,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -221,8 +214,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -273,8 +264,6 @@ for (const {
          tmpDir,
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
-          undefined, // rawLanguages
-          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
          false,
@@ -295,11 +284,11 @@ for (const {
 for (const toolcacheVersion of [
  // Test that we use the tools from the toolcache when `SAMPLE_DEFAULT_CLI_VERSION` is requested
  // and `SAMPLE_DEFAULT_CLI_VERSION-` is in the toolcache.
-  SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
-  `${SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion}-20230101`,
+  SAMPLE_DEFAULT_CLI_VERSION.cliVersion,
+  `${SAMPLE_DEFAULT_CLI_VERSION.cliVersion}-20230101`,
 ]) {
  test.serial(
-    `uses tools from toolcache when ${SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion} is requested and ` +
+    `uses tools from toolcache when ${SAMPLE_DEFAULT_CLI_VERSION.cliVersion} is requested and ` +
      `${toolcacheVersion} is installed`,
    async (t) => {
      const features = createFeatures([]);
@@ -319,16 +308,11 @@ for (const toolcacheVersion of [
          tmpDir,
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
-          undefined, // rawLanguages
-          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
          false,
        );
-        t.is(
-          result.toolsVersion,
-          SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
-        );
+        t.is(result.toolsVersion, SAMPLE_DEFAULT_CLI_VERSION.cliVersion);
        t.is(result.toolsSource, ToolsSource.Toolcache);
        t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined);
        t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined);
@@ -358,15 +342,9 @@ test.serial(
        tmpDir,
        util.GitHubVariant.GHES,
        {
-          enabledVersions: [
-            {
-              cliVersion: defaults.cliVersion,
-              tagName: defaults.bundleVersion,
-            },
-          ],
+          cliVersion: defaults.cliVersion,
+          tagName: defaults.bundleVersion,
        },
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -406,15 +384,9 @@ test.serial(
        tmpDir,
        util.GitHubVariant.GHES,
        {
-          enabledVersions: [
-            {
-              cliVersion: defaults.cliVersion,
-              tagName: defaults.bundleVersion,
-            },
-          ],
+          cliVersion: defaults.cliVersion,
+          tagName: defaults.bundleVersion,
        },
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -454,8 +426,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -497,8 +467,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -572,7 +540,7 @@ test.serial("getExtraOptions throws for bad content", (t) => {
 });

 // Test macro for ensuring different variants of injected augmented configurations
-const injectedConfigMacro = makeMacro({
+const injectedConfigMacro = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    augmentationProperties: AugmentationProperties,
@@ -622,8 +590,9 @@ const injectedConfigMacro = makeMacro({
    `databaseInitCluster() injected config: ${providedTitle}`,
 });

-injectedConfigMacro.serial(
+test.serial(
  "basic",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
  },
@@ -631,8 +600,9 @@ injectedConfigMacro.serial(
  {},
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected packs from input",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    packsInput: ["xxx", "yyy"],
@@ -643,8 +613,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected packs from input with existing packs combines",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    packsInputCombines: true,
@@ -664,8 +635,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected packs from input with existing packs overrides",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    packsInput: ["xxx", "yyy"],
@@ -683,8 +655,9 @@ injectedConfigMacro.serial(
 );

 // similar, but with queries
-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@@ -702,8 +675,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input overrides",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@@ -725,8 +699,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input combines",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -752,8 +727,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input combines 2",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -773,8 +749,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries and packs, but empty",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -791,8 +768,9 @@ injectedConfigMacro.serial(
  {},
 );

-injectedConfigMacro.serial(
+test.serial(
  "repo property queries have the highest precedence",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -812,8 +790,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "repo property queries combines with queries input",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: false,
@@ -838,8 +817,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "repo property queries combines everything else",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -976,8 +956,7 @@ test.serial("runTool summarizes autobuilder errors", async (t) => {
  sinon.stub(io, "which").resolves("");

  await t.throwsAsync(
-    async () =>
-      await codeqlObject.runAutobuild(stubConfig, BuiltInLanguage.java),
+    async () => await codeqlObject.runAutobuild(stubConfig, KnownLanguage.java),
    {
      instanceOf: util.ConfigurationError,
      message:
@@ -1003,8 +982,7 @@ test.serial("runTool truncates long autobuilder errors", async (t) => {
  sinon.stub(io, "which").resolves("");

  await t.throwsAsync(
-    async () =>
-      await codeqlObject.runAutobuild(stubConfig, BuiltInLanguage.java),
+    async () => await codeqlObject.runAutobuild(stubConfig, KnownLanguage.java),
    {
      instanceOf: util.ConfigurationError,
      message:
@@ -24,8 +24,11 @@ import {
 import { isAnalyzingDefaultBranch } from "./git-utils";
 import { Language } from "./languages";
 import { Logger } from "./logging";
-import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import {
+  OverlayDatabaseMode,
+  writeBaseDatabaseOidsFile,
+  writeOverlayChangesFile,
+} from "./overlay";
 import * as setupCodeql from "./setup-codeql";
 import { ZstdAvailability } from "./tar";
 import { ToolsDownloadStatusReport } from "./tools-download";
@@ -282,17 +285,17 @@ const CODEQL_MINIMUM_VERSION = "2.17.6";
 /**
 * This version will shortly become the oldest version of CodeQL that the Action will run with.
 */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";

 /**
 * This is the version of GHES that was most recently deprecated.
 */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";

 /**
 * This is the deprecation date for the version of GHES that was most recently deprecated.
 */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";

 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
@@ -305,8 +308,6 @@ const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 * @param tempDir
 * @param variant
 * @param defaultCliVersion
- * @param rawLanguages Raw set of languages.
- * @param useOverlayAwareDefaultCliVersion Whether to select an overlay-aware default CLI version.
 * @param features Information about the features that are enabled.
 * @param logger
 * @param checkVersion Whether to check that CodeQL CLI meets the minimum
@@ -319,8 +320,6 @@ export async function setupCodeQL(
  tempDir: string,
  variant: util.GitHubVariant,
  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  useOverlayAwareDefaultCliVersion: boolean,
  features: FeatureEnablement,
  logger: Logger,
  checkVersion: boolean,
@@ -344,8 +343,6 @@ export async function setupCodeQL(
      tempDir,
      variant,
      defaultCliVersion,
-      rawLanguages,
-      useOverlayAwareDefaultCliVersion,
      features,
      logger,
    );
@@ -18,11 +18,10 @@ import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
 import * as gitUtils from "./git-utils";
 import { GitVersionInfo } from "./git-utils";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { getRunnerLogger } from "./logging";
-import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
+import { CODEQL_OVERLAY_MINIMUM_VERSION, OverlayDatabaseMode } from "./overlay";
 import { OverlayDisabledReason } from "./overlay/diagnostics";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import * as overlayStatus from "./overlay/status";
 import { parseRepositoryNwo } from "./repository";
 import {
@@ -34,7 +33,6 @@ import {
  LoggedMessage,
  mockCodeQLVersion,
  createTestConfig,
-  makeMacro,
 } from "./testing-utils";
 import {
  GitHubVariant,
@@ -216,7 +214,7 @@ test.serial("load code quality config", async (t) => {
    // And the config we expect it to result in
    const expectedConfig = createTestConfig({
      analysisKinds: [AnalysisKind.CodeQuality],
-      languages: [BuiltInLanguage.actions],
+      languages: [KnownLanguage.actions],
      // This gets set because we only have `AnalysisKind.CodeQuality`
      computedConfig: {
        "disable-default-queries": true,
@@ -269,7 +267,7 @@ test.serial(

      const expectedConfig = createTestConfig({
        analysisKinds: [AnalysisKind.CodeQuality],
-        languages: [BuiltInLanguage.javascript],
+        languages: [KnownLanguage.javascript],
        codeQLCmd: codeql.getPath(),
        computedConfig,
        dbLocation: path.resolve(tempDir, "codeql_databases"),
@@ -519,7 +517,7 @@ test.serial("load non-empty input", async (t) => {

    // And the config we expect it to parse to
    const expectedConfig = createTestConfig({
-      languages: [BuiltInLanguage.javascript],
+      languages: [KnownLanguage.javascript],
      buildMode: BuildMode.None,
      originalUserInput: userConfig,
      computedConfig: userConfig,
@@ -893,10 +891,10 @@ const mockRepositoryNwo = parseRepositoryNwo("owner/repo");
      betterResolveLanguages: (options) =>
        Promise.resolve({
          aliases: {
-            "c#": BuiltInLanguage.csharp,
-            c: BuiltInLanguage.cpp,
-            kotlin: BuiltInLanguage.java,
-            typescript: BuiltInLanguage.javascript,
+            "c#": KnownLanguage.csharp,
+            c: KnownLanguage.cpp,
+            kotlin: KnownLanguage.java,
+            typescript: KnownLanguage.javascript,
          },
          extractors: {
            cpp: [stubExtractorEntry],
@@ -945,12 +943,12 @@ const mockRepositoryNwo = parseRepositoryNwo("owner/repo");
 for (const { displayName, language, feature } of [
  {
    displayName: "Java",
-    language: BuiltInLanguage.java,
+    language: KnownLanguage.java,
    feature: Feature.DisableJavaBuildlessEnabled,
  },
  {
    displayName: "C#",
-    language: BuiltInLanguage.csharp,
+    language: KnownLanguage.csharp,
    feature: Feature.DisableCsharpBuildless,
  },
 ]) {
@@ -970,7 +968,7 @@ for (const { displayName, language, feature } of [
    const messages: LoggedMessage[] = [];
    const buildMode = await configUtils.parseBuildModeInput(
      "none",
-      [BuiltInLanguage.python],
+      [KnownLanguage.python],
      createFeatures([feature]),
      getRecordingLogger(messages),
    );
@@ -1006,7 +1004,6 @@ interface OverlayDatabaseModeTestSetup {
  codeqlVersion: string;
  gitRoot: string | undefined;
  gitVersion: GitVersionInfo | undefined;
-  hasSubmodules: boolean;
  codeScanningConfig: UserConfig;
  diskUsage: DiskUsage | undefined;
  memoryFlagValue: number;
@@ -1020,11 +1017,13 @@ const defaultOverlayDatabaseModeTestSetup: OverlayDatabaseModeTestSetup = {
  isPullRequest: false,
  isDefaultBranch: false,
  buildMode: BuildMode.None,
-  languages: [BuiltInLanguage.javascript],
+  languages: [KnownLanguage.javascript],
  codeqlVersion: CODEQL_OVERLAY_MINIMUM_VERSION,
  gitRoot: "/some/git/root",
-  gitVersion: new GitVersionInfo("2.39.0", "2.39.0"),
-  hasSubmodules: false,
+  gitVersion: new GitVersionInfo(
+    gitUtils.GIT_MINIMUM_VERSION_FOR_OVERLAY,
+    gitUtils.GIT_MINIMUM_VERSION_FOR_OVERLAY,
+  ),
  codeScanningConfig: {},
  diskUsage: {
    numAvailableBytes: 50_000_000_000,
@@ -1035,9 +1034,10 @@ const defaultOverlayDatabaseModeTestSetup: OverlayDatabaseModeTestSetup = {
  repositoryProperties: {},
 };

-const checkOverlayEnablementMacro = makeMacro({
+const checkOverlayEnablementMacro = test.macro({
  exec: async (
    t: ExecutionContext,
+    _title: string,
    setupOverrides: Partial<OverlayDatabaseModeTestSetup>,
    expected:
      | {
@@ -1091,7 +1091,7 @@ const checkOverlayEnablementMacro = makeMacro({
        sinon
          .stub(codeql, "isTracedLanguage")
          .callsFake(async (lang: Language) => {
-            return lang === BuiltInLanguage.java;
+            return [KnownLanguage.java].includes(lang as KnownLanguage);
          });

        // Mock git root detection
@@ -1099,9 +1099,6 @@ const checkOverlayEnablementMacro = makeMacro({
          sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
        }

-        // Mock submodule detection
-        sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules);
-
        // Mock default branch detection
        sinon
          .stub(gitUtils, "isAnalyzingDefaultBranch")
@@ -1131,10 +1128,11 @@ const checkOverlayEnablementMacro = makeMacro({
      }
    });
  },
-  title: (title) => `checkOverlayEnablement: ${title}`,
+  title: (_, title) => `checkOverlayEnablement: ${title}`,
 });

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Environment variable override - Overlay",
  {
    overlayDatabaseEnvVar: "overlay",
@@ -1145,7 +1143,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Environment variable override - OverlayBase",
  {
    overlayDatabaseEnvVar: "overlay-base",
@@ -1156,7 +1155,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Environment variable override - None",
  {
    overlayDatabaseEnvVar: "none",
@@ -1166,7 +1166,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Ignore invalid environment variable",
  {
    overlayDatabaseEnvVar: "invalid-mode",
@@ -1176,10 +1177,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Ignore feature flag when analyzing non-default branch",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
  },
  {
@@ -1187,10 +1189,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch when feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isDefaultBranch: true,
  },
@@ -1200,14 +1203,15 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch when feature enabled with custom analysis",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    codeScanningConfig: {
      packs: ["some-custom-pack@1.0.0"],
-    },
+    } as UserConfig,
    isDefaultBranch: true,
  },
  {
@@ -1216,10 +1220,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch when code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1232,10 +1237,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if runner disk space is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1251,10 +1257,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if we can't determine runner disk space",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1267,10 +1274,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if runner disk space is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1288,10 +1296,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1308,10 +1317,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1329,10 +1339,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1348,10 +1359,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if memory flag is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1364,10 +1376,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if memory flag is too low but CodeQL >= 2.24.3",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1382,10 +1395,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if memory flag is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1400,10 +1414,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when cached status indicates previous failure",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisJavascript,
@@ -1417,10 +1432,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when cached status indicates previous failure",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisJavascript,
@@ -1434,17 +1450,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with disable-default-queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      "disable-default-queries": true,
-    },
+    } as UserConfig,
    isDefaultBranch: true,
  },
  {
@@ -1452,17 +1469,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with packs",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      packs: ["some-custom-pack@1.0.0"],
-    },
+    } as UserConfig,
    isDefaultBranch: true,
  },
  {
@@ -1470,17 +1488,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      queries: [{ uses: "some-query.ql" }],
-    },
+    } as UserConfig,
    isDefaultBranch: true,
  },
  {
@@ -1488,17 +1507,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with query-filters",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      "query-filters": [{ include: { "security-severity": "high" } }],
-    },
+    } as UserConfig,
    isDefaultBranch: true,
  },
  {
@@ -1506,10 +1526,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when only language-specific feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisJavascript],
    isDefaultBranch: true,
  },
@@ -1518,10 +1539,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when only code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisCodeScanningJavascript],
    isDefaultBranch: true,
  },
@@ -1530,10 +1552,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when language-specific feature disabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis],
    isDefaultBranch: true,
  },
@@ -1542,10 +1565,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay analysis on PR when feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
  },
@@ -1555,14 +1579,15 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay analysis on PR when feature enabled with custom analysis",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    codeScanningConfig: {
      packs: ["some-custom-pack@1.0.0"],
-    },
+    } as UserConfig,
    isPullRequest: true,
  },
  {
@@ -1571,10 +1596,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay analysis on PR when code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1587,10 +1613,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR if runner disk space is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1606,10 +1633,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay analysis on PR if runner disk space is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1627,10 +1655,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR if we can't determine runner disk space",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1643,10 +1672,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR if memory flag is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1659,10 +1689,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay analysis on PR if memory flag is too low but CodeQL >= 2.24.3",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1677,10 +1708,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay analysis on PR if memory flag is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1695,17 +1727,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with disable-default-queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      "disable-default-queries": true,
-    },
+    } as UserConfig,
    isPullRequest: true,
  },
  {
@@ -1713,17 +1746,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with packs",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      packs: ["some-custom-pack@1.0.0"],
-    },
+    } as UserConfig,
    isPullRequest: true,
  },
  {
@@ -1731,17 +1765,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      queries: [{ uses: "some-query.ql" }],
-    },
+    } as UserConfig,
    isPullRequest: true,
  },
  {
@@ -1749,17 +1784,18 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with query-filters",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
    ],
    codeScanningConfig: {
      "query-filters": [{ include: { "security-severity": "high" } }],
-    },
+    } as UserConfig,
    isPullRequest: true,
  },
  {
@@ -1767,10 +1803,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when only language-specific feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
  },
@@ -1779,10 +1816,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when only code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisCodeScanningJavascript],
    isPullRequest: true,
  },
@@ -1791,10 +1829,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis on PR when language-specific feature disabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis],
    isPullRequest: true,
  },
@@ -1803,7 +1842,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay PR analysis by env",
  {
    overlayDatabaseEnvVar: "overlay",
@@ -1814,7 +1854,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay PR analysis by env on a runner with low disk space",
  {
    overlayDatabaseEnvVar: "overlay",
@@ -1826,10 +1867,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay PR analysis by feature flag",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
  },
@@ -1839,31 +1881,34 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Fallback due to autobuild with traced language",
  {
    overlayDatabaseEnvVar: "overlay",
    buildMode: BuildMode.Autobuild,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleBuildMode,
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Fallback due to no build mode with traced language",
  {
    overlayDatabaseEnvVar: "overlay",
    buildMode: undefined,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleBuildMode,
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Fallback due to old CodeQL version",
  {
    overlayDatabaseEnvVar: "overlay",
@@ -1874,7 +1919,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Fallback due to missing git root",
  {
    overlayDatabaseEnvVar: "overlay",
@@ -1885,47 +1931,35 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
-  "Fallback due to old git version with submodules",
+test.serial(
+  checkOverlayEnablementMacro,
+  "Fallback due to old git version",
  {
    overlayDatabaseEnvVar: "overlay",
-    gitVersion: new GitVersionInfo("2.34.1", "2.34.1"), // Above 2.11.0 but below 2.36.0
-    hasSubmodules: true,
+    gitVersion: new GitVersionInfo("2.10.0", "2.10.0"), // Version below required 2.11.0
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleGit,
  },
 );

-checkOverlayEnablementMacro.serial(
-  "Fallback when git version cannot be determined and repo has submodules",
+test.serial(
+  checkOverlayEnablementMacro,
+  "Fallback when git version cannot be determined",
  {
    overlayDatabaseEnvVar: "overlay",
    gitVersion: undefined,
-    hasSubmodules: true,
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleGit,
  },
 );

-checkOverlayEnablementMacro.serial(
-  "Overlay enabled when git version cannot be determined and repo has no submodules",
-  {
-    overlayDatabaseEnvVar: "overlay",
-    gitVersion: undefined,
-    hasSubmodules: false,
-  },
-  {
-    overlayDatabaseMode: OverlayDatabaseMode.Overlay,
-    useOverlayDatabaseCaching: false,
-  },
-);
-
-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay when disabled via repository property",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
    repositoryProperties: {
@@ -1937,10 +1971,11 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Overlay not disabled when repository property is false",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
    repositoryProperties: {
@@ -1953,7 +1988,8 @@ checkOverlayEnablementMacro.serial(
  },
 );

-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "Environment variable override takes precedence over repository property",
  {
    overlayDatabaseEnvVar: "overlay",
@@ -1968,8 +2004,9 @@ checkOverlayEnablementMacro.serial(
 );

 // Exercise language-specific overlay analysis features code paths
-for (const language in BuiltInLanguage) {
-  checkOverlayEnablementMacro.serial(
+for (const language in KnownLanguage) {
+  test.serial(
+    checkOverlayEnablementMacro,
    `Check default overlay analysis feature for ${language}`,
    {
      languages: [language],
@@ -1986,10 +2023,11 @@ for (const language in BuiltInLanguage) {
 // overlay analysis enabled, even when the base overlay feature flag is on.
 // Using swift here as it doesn't currently have overlay support — update this if
 // swift gains overlay support.
-checkOverlayEnablementMacro.serial(
+test.serial(
+  checkOverlayEnablementMacro,
  "No overlay analysis for language without per-language overlay feature flag",
  {
-    languages: [BuiltInLanguage.swift],
+    languages: [KnownLanguage.swift],
    features: [Feature.OverlayAnalysis],
    isPullRequest: true,
  },
@@ -43,19 +43,17 @@ import {
  getGeneratedFiles,
  getGitRoot,
  getGitVersionOrThrow,
-  GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES,
+  GIT_MINIMUM_VERSION_FOR_OVERLAY,
  GitVersionInfo,
-  hasSubmodules,
  isAnalyzingDefaultBranch,
 } from "./git-utils";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
-import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
+import { CODEQL_OVERLAY_MINIMUM_VERSION, OverlayDatabaseMode } from "./overlay";
 import {
  addOverlayDisablementDiagnostics,
  OverlayDisabledReason,
 } from "./overlay/diagnostics";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { shouldSkipOverlayAnalysis } from "./overlay/status";
 import { RepositoryNwo } from "./repository";
 import { ToolsFeature } from "./tools-features";
@@ -274,10 +272,10 @@ async function getSupportedLanguageMap(
  for (const extractor of Object.keys(resolveResult.extractors)) {
    // If the CLI supports resolving languages with default queries, use these
    // as the set of supported languages. Otherwise, require the language to be
-    // a built-in language.
+    // a known language.
    if (
      resolveSupportedLanguagesUsingCli ||
-      BuiltInLanguage[extractor] !== undefined
+      KnownLanguage[extractor] !== undefined
    ) {
      supportedLanguages[extractor] = extractor;
    }
@@ -407,7 +405,6 @@ export async function getLanguages(
  return languages;
 }

-/** Parses the `languages` input into a list of languages without checking if they are supported by CodeQL. */
 export function getRawLanguagesNoAutodetect(
  languagesInput: string | undefined,
 ): string[] {
@@ -948,7 +945,7 @@ async function validateOverlayDatabaseMode(
      await Promise.all(
        languages.map(
          async (l) =>
-            l !== BuiltInLanguage.go && // Workaround to allow overlay analysis for Go with any build
+            l !== KnownLanguage.go && // Workaround to allow overlay analysis for Go with any build
            // mode, since it does not yet support BMN. The Go autobuilder and/or extractor will
            // ensure that overlay-base databases are only created for supported Go build setups,
            // and that we'll fall back to full databases in other cases.
@@ -972,8 +969,7 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
  }
-  const gitRoot = await getGitRoot(sourceRoot);
-  if (gitRoot === undefined) {
+  if ((await getGitRoot(sourceRoot)) === undefined) {
    logger.warning(
      `Cannot build an ${overlayDatabaseMode} database because ` +
        `the source root "${sourceRoot}" is not inside a git repository. ` +
@@ -981,26 +977,21 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.NoGitRoot);
  }
-  if (hasSubmodules(gitRoot)) {
-    if (gitVersion === undefined) {
-      logger.warning(
-        `Cannot build an ${overlayDatabaseMode} database because ` +
-          "the repository has submodules and the Git version could not be determined. " +
-          "Falling back to creating a normal full database instead.",
-      );
-      return new Failure(OverlayDisabledReason.IncompatibleGit);
-    }
-    if (
-      !gitVersion.isAtLeast(GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES)
-    ) {
-      logger.warning(
-        `Cannot build an ${overlayDatabaseMode} database because ` +
-          "the repository has submodules and the installed Git version is older " +
-          `than ${GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES}. ` +
-          "Falling back to creating a normal full database instead.",
-      );
-      return new Failure(OverlayDisabledReason.IncompatibleGit);
-    }
+  if (gitVersion === undefined) {
+    logger.warning(
+      `Cannot build an ${overlayDatabaseMode} database because ` +
+        "the Git version could not be determined. " +
+        "Falling back to creating a normal full database instead.",
+    );
+    return new Failure(OverlayDisabledReason.IncompatibleGit);
+  }
+  if (!gitVersion.isAtLeast(GIT_MINIMUM_VERSION_FOR_OVERLAY)) {
+    logger.warning(
+      `Cannot build an ${overlayDatabaseMode} database because ` +
+        `the installed Git version is older than ${GIT_MINIMUM_VERSION_FOR_OVERLAY}. ` +
+        "Falling back to creating a normal full database instead.",
+    );
+    return new Failure(OverlayDisabledReason.IncompatibleGit);
  }

  return new Success({
@@ -1037,13 +1028,13 @@ async function setCppTrapCachingEnvironmentVariables(
  config: Config,
  logger: Logger,
 ): Promise<void> {
-  if (config.languages.includes(BuiltInLanguage.cpp)) {
+  if (config.languages.includes(KnownLanguage.cpp)) {
    const envVar = "CODEQL_EXTRACTOR_CPP_TRAP_CACHING";
    if (process.env[envVar]) {
      logger.info(
        `Environment variable ${envVar} already set, leaving it unchanged.`,
      );
-    } else if (config.trapCaches[BuiltInLanguage.cpp]) {
+    } else if (config.trapCaches[KnownLanguage.cpp]) {
      logger.info("Enabling TRAP caching for C/C++.");
      core.exportVariable(envVar, "true");
    } else {
@@ -1540,7 +1531,7 @@ export async function parseBuildModeInput(
  }

  if (
-    languages.includes(BuiltInLanguage.csharp) &&
+    languages.includes(KnownLanguage.csharp) &&
    (await features.getValue(Feature.DisableCsharpBuildless))
  ) {
    logger.warning(
@@ -1550,7 +1541,7 @@ export async function parseBuildModeInput(
  }

  if (
-    languages.includes(BuiltInLanguage.java) &&
+    languages.includes(KnownLanguage.java) &&
    (await features.getValue(Feature.DisableJavaBuildlessEnabled))
  ) {
    logger.warning(
@@ -1,13 +1,12 @@
 import test, { ExecutionContext } from "ava";

 import { RepositoryProperties } from "../feature-flags/properties";
-import { BuiltInLanguage, Language } from "../languages";
+import { KnownLanguage, Language } from "../languages";
 import { getRunnerLogger } from "../logging";
 import {
  checkExpectedLogMessages,
  getRecordingLogger,
  LoggedMessage,
-  makeMacro,
 } from "../testing-utils";
 import { ConfigurationError, prettyPrintPack } from "../util";

@@ -16,7 +15,7 @@ import * as dbConfig from "./db-config";
 /**
 * Test macro for ensuring the packs block is valid
 */
-const parsePacksMacro = makeMacro({
+const parsePacksMacro = test.macro({
  exec: (
    t: ExecutionContext<unknown>,
    packsInput: string,
@@ -34,7 +33,7 @@ const parsePacksMacro = makeMacro({
 /**
 * Test macro for testing when the packs block is invalid
 */
-const parsePacksErrorMacro = makeMacro({
+const parsePacksErrorMacro = test.macro({
  exec: (
    t: ExecutionContext<unknown>,
    packsInput: string,
@@ -50,42 +49,45 @@ const parsePacksErrorMacro = makeMacro({
 /**
 * Test macro for testing when the packs block is invalid
 */
-const invalidPackNameMacro = makeMacro({
-  exec: (t: ExecutionContext, arg: string) =>
-    parsePacksErrorMacro.fn(
+const invalidPackNameMacro = test.macro({
+  exec: (t: ExecutionContext, name: string) =>
+    parsePacksErrorMacro.exec(
      t,
-      arg,
-      [BuiltInLanguage.cpp],
-      new RegExp(`^"${arg}" is not a valid pack$`),
+      name,
+      [KnownLanguage.cpp],
+      new RegExp(`^"${name}" is not a valid pack$`),
    ),
  title: (_providedTitle: string | undefined, arg: string | undefined) =>
    `Invalid pack string: ${arg}`,
 });

-parsePacksMacro("no packs", "", [], undefined);
-parsePacksMacro("two packs", "a/b,c/d@1.2.3", [BuiltInLanguage.cpp], {
-  [BuiltInLanguage.cpp]: ["a/b", "c/d@1.2.3"],
+test("no packs", parsePacksMacro, "", [], undefined);
+test("two packs", parsePacksMacro, "a/b,c/d@1.2.3", [KnownLanguage.cpp], {
+  [KnownLanguage.cpp]: ["a/b", "c/d@1.2.3"],
 });
-parsePacksMacro(
+test(
  "two packs with spaces",
+  parsePacksMacro,
  " a/b , c/d@1.2.3 ",
-  [BuiltInLanguage.cpp],
+  [KnownLanguage.cpp],
  {
-    [BuiltInLanguage.cpp]: ["a/b", "c/d@1.2.3"],
+    [KnownLanguage.cpp]: ["a/b", "c/d@1.2.3"],
  },
 );
-parsePacksErrorMacro(
+test(
  "two packs with language",
+  parsePacksErrorMacro,
  "a/b,c/d@1.2.3",
-  [BuiltInLanguage.cpp, BuiltInLanguage.java],
+  [KnownLanguage.cpp, KnownLanguage.java],
  new RegExp(
    "Cannot specify a 'packs' input in a multi-language analysis. " +
      "Use a codeql-config.yml file instead and specify packs by language.",
  ),
 );

-parsePacksMacro(
+test(
  "packs with other valid names",
+  parsePacksMacro,
  [
    // ranges are ok
    "c/d@1.0",
@@ -104,9 +106,9 @@ parsePacksMacro(
    // (globbing is not done)
    "c/d@1.2.3:+*)_(",
  ].join(","),
-  [BuiltInLanguage.cpp],
+  [KnownLanguage.cpp],
  {
-    [BuiltInLanguage.cpp]: [
+    [KnownLanguage.cpp]: [
      "c/d@1.0",
      "c/d@~1.0.0",
      "c/d@~1.0.0:a/b",
@@ -121,23 +123,23 @@ parsePacksMacro(
  },
 );

-invalidPackNameMacro.test("c"); // all packs require at least a scope and a name
-invalidPackNameMacro.test("c-/d");
-invalidPackNameMacro.test("-c/d");
-invalidPackNameMacro.test("c/d_d");
-invalidPackNameMacro.test("c/d@@");
-invalidPackNameMacro.test("c/d@1.0.0:");
-invalidPackNameMacro.test("c/d:");
-invalidPackNameMacro.test("c/d:/a");
-invalidPackNameMacro.test("@1.0.0:a");
-invalidPackNameMacro.test("c/d@../a");
-invalidPackNameMacro.test("c/d@b/../a");
-invalidPackNameMacro.test("c/d:z@1");
+test(invalidPackNameMacro, "c"); // all packs require at least a scope and a name
+test(invalidPackNameMacro, "c-/d");
+test(invalidPackNameMacro, "-c/d");
+test(invalidPackNameMacro, "c/d_d");
+test(invalidPackNameMacro, "c/d@@");
+test(invalidPackNameMacro, "c/d@1.0.0:");
+test(invalidPackNameMacro, "c/d:");
+test(invalidPackNameMacro, "c/d:/a");
+test(invalidPackNameMacro, "@1.0.0:a");
+test(invalidPackNameMacro, "c/d@../a");
+test(invalidPackNameMacro, "c/d@b/../a");
+test(invalidPackNameMacro, "c/d:z@1");

 /**
 * Test macro for pretty printing pack specs
 */
-const packSpecPrettyPrintingMacro = makeMacro({
+const packSpecPrettyPrintingMacro = test.macro({
  exec: (t: ExecutionContext, packStr: string, packObj: dbConfig.Pack) => {
    const parsed = dbConfig.parsePacksSpecification(packStr);
    t.deepEqual(parsed, packObj, "parsed pack spec is correct");
@@ -161,35 +163,36 @@ const packSpecPrettyPrintingMacro = makeMacro({
  ) => `Prettyprint pack spec: '${packStr}'`,
 });

-packSpecPrettyPrintingMacro.test("a/b", {
+test(packSpecPrettyPrintingMacro, "a/b", {
  name: "a/b",
  version: undefined,
  path: undefined,
 });
-packSpecPrettyPrintingMacro.test("a/b@~1.2.3", {
+test(packSpecPrettyPrintingMacro, "a/b@~1.2.3", {
  name: "a/b",
  version: "~1.2.3",
  path: undefined,
 });
-packSpecPrettyPrintingMacro.test("a/b@~1.2.3:abc/def", {
+test(packSpecPrettyPrintingMacro, "a/b@~1.2.3:abc/def", {
  name: "a/b",
  version: "~1.2.3",
  path: "abc/def",
 });
-packSpecPrettyPrintingMacro.test("a/b:abc/def", {
+test(packSpecPrettyPrintingMacro, "a/b:abc/def", {
  name: "a/b",
  version: undefined,
  path: "abc/def",
 });
-packSpecPrettyPrintingMacro.test("    a/b:abc/def    ", {
+test(packSpecPrettyPrintingMacro, "    a/b:abc/def    ", {
  name: "a/b",
  version: undefined,
  path: "abc/def",
 });

-const calculateAugmentationMacro = makeMacro({
+const calculateAugmentationMacro = test.macro({
  exec: async (
    t: ExecutionContext,
+    _title: string,
    rawPacksInput: string | undefined,
    rawQueriesInput: string | undefined,
    languages: Language[],
@@ -204,25 +207,27 @@ const calculateAugmentationMacro = makeMacro({
    );
    t.deepEqual(actualAugmentationProperties, expectedAugmentationProperties);
  },
-  title: (title) => `Calculate Augmentation: ${title}`,
+  title: (_, title) => `Calculate Augmentation: ${title}`,
 });

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "All empty",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
  },
 );

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "With queries",
  undefined,
  " a, b , c, d",
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -230,11 +235,12 @@ calculateAugmentationMacro(
  },
 );

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "With queries combining",
  undefined,
  "   +   a, b , c, d ",
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -243,11 +249,12 @@ calculateAugmentationMacro(
  },
 );

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "With packs",
  "   codeql/a , codeql/b   , codeql/c  , codeql/d  ",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -255,11 +262,12 @@ calculateAugmentationMacro(
  },
 );

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "With packs combining",
  "   +   codeql/a, codeql/b, codeql/c, codeql/d",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -268,11 +276,12 @@ calculateAugmentationMacro(
  },
 );

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "With repo property queries",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {
    "github-codeql-extra-queries": "a, b, c, d",
  },
@@ -285,11 +294,12 @@ calculateAugmentationMacro(
  },
 );

-calculateAugmentationMacro(
+test(
+  calculateAugmentationMacro,
  "With repo property queries combining",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {
    "github-codeql-extra-queries": "+ a, b, c, d",
  },
@@ -302,9 +312,10 @@ calculateAugmentationMacro(
  },
 );

-const calculateAugmentationErrorMacro = makeMacro({
+const calculateAugmentationErrorMacro = test.macro({
  exec: async (
    t: ExecutionContext,
+    _title: string,
    rawPacksInput: string | undefined,
    rawQueriesInput: string | undefined,
    languages: Language[],
@@ -322,48 +333,53 @@ const calculateAugmentationErrorMacro = makeMacro({
      { message: expectedError },
    );
  },
-  title: (title) => `Calculate Augmentation Error: ${title}`,
+  title: (_, title) => `Calculate Augmentation Error: ${title}`,
 });

-calculateAugmentationErrorMacro(
+test(
+  calculateAugmentationErrorMacro,
  "Plus (+) with nothing else (queries)",
  undefined,
  "   +   ",
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  /The workflow property "queries" is invalid/,
 );

-calculateAugmentationErrorMacro(
+test(
+  calculateAugmentationErrorMacro,
  "Plus (+) with nothing else (packs)",
  "   +   ",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  /The workflow property "packs" is invalid/,
 );

-calculateAugmentationErrorMacro(
+test(
+  calculateAugmentationErrorMacro,
  "Plus (+) with nothing else (repo property queries)",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {
    "github-codeql-extra-queries": "    + ",
  },
  /The repository property "github-codeql-extra-queries" is invalid/,
 );

-calculateAugmentationErrorMacro(
+test(
+  calculateAugmentationErrorMacro,
  "Packs input with multiple languages",
  "   +  a/b, c/d ",
  undefined,
-  [BuiltInLanguage.javascript, BuiltInLanguage.java],
+  [KnownLanguage.javascript, KnownLanguage.java],
  {},
  /Cannot specify a 'packs' input in a multi-language analysis/,
 );

-calculateAugmentationErrorMacro(
+test(
+  calculateAugmentationErrorMacro,
  "Packs input with no languages",
  "   +  a/b, c/d ",
  undefined,
@@ -372,11 +388,12 @@ calculateAugmentationErrorMacro(
  /No languages specified/,
 );

-calculateAugmentationErrorMacro(
+test(
+  calculateAugmentationErrorMacro,
  "Invalid packs",
  " a-pack-without-a-scope ",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  /"a-pack-without-a-scope" is not a valid pack/,
 );
@@ -12,7 +12,7 @@ import { createStubCodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { cleanupAndUploadDatabases } from "./database-upload";
 import * as gitUtils from "./git-utils";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { RepositoryNwo } from "./repository";
 import {
  checkExpectedLogMessages,
@@ -45,7 +45,7 @@ const testApiDetails: GitHubApiDetails = {

 function getTestConfig(tmpDir: string): Config {
  return createTestConfig({
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    dbLocation: tmpDir,
  });
 }
@@ -12,7 +12,7 @@ import { Config } from "./config-utils";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { Logger, withGroupAsync } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import { RepositoryNwo } from "./repository";
 import * as util from "./util";
 import { asHTTPError, bundleDb, CleanupLevel, parseGitHubUrl } from "./util";
@@ -263,7 +263,7 @@ export function getArtifactSuffix(matrix: string | undefined): string {
    try {
      const matrixObject = JSON.parse(matrix);
      if (json.isObject(matrixObject)) {
-        for (const matrixKey of Object.keys(matrixObject).sort())
+        for (const matrixKey of Object.keys(matrixObject as object).sort())
          suffix += `-${matrixObject[matrixKey]}`;
      } else {
        core.warning("User-specified `matrix` input is not an object.");
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.4",
-  "cliVersion": "2.25.4",
-  "priorBundleVersion": "codeql-bundle-v2.25.3",
-  "priorCliVersion": "2.25.3"
+  "bundleVersion": "codeql-bundle-v2.25.1",
+  "cliVersion": "2.25.1",
+  "priorBundleVersion": "codeql-bundle-v2.24.3",
+  "priorCliVersion": "2.24.3"
 }
@@ -27,7 +27,7 @@ import {
  CacheStoreResult,
 } from "./dependency-caching";
 import { Feature } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import {
  setupTests,
  createFeatures,
@@ -179,7 +179,7 @@ test("checkHashPatterns - logs when no patterns match", async (t) => {
  const result = await checkHashPatterns(
    codeql,
    features,
-    BuiltInLanguage.csharp,
+    KnownLanguage.csharp,
    config,
    "download",
    getRecordingLogger(messages),
@@ -208,7 +208,7 @@ test("checkHashPatterns - returns patterns when patterns match", async (t) => {
    const result = await checkHashPatterns(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      config,
      "upload",
      getRecordingLogger(messages),
@@ -270,7 +270,7 @@ test.serial(
    const keyWithFeature = await cacheKey(
      codeql,
      createFeatures([Feature.CsharpNewCacheKey]),
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      // Patterns don't matter here because we have stubbed `hashFiles` to always return a specific hash above.
      [],
    );
@@ -288,12 +288,12 @@ test.serial(
    const result = await downloadDependencyCaches(
      codeql,
      createFeatures([]),
-      [BuiltInLanguage.csharp],
+      [KnownLanguage.csharp],
      logger,
    );
    const statusReport = result.statusReport;
    t.is(statusReport.length, 1);
-    t.is(statusReport[0].language, BuiltInLanguage.csharp);
+    t.is(statusReport[0].language, KnownLanguage.csharp);
    t.is(statusReport[0].hit_kind, CacheHitKind.Miss);
    t.deepEqual(result.restoredKeys, []);
    t.assert(restoreCacheStub.calledOnce);
@@ -316,7 +316,7 @@ test.serial(
    const keyWithFeature = await cacheKey(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      // Patterns don't matter here because we have stubbed `hashFiles` to always return a specific hash above.
      [],
    );
@@ -334,14 +334,14 @@ test.serial(
    const result = await downloadDependencyCaches(
      codeql,
      features,
-      [BuiltInLanguage.csharp],
+      [KnownLanguage.csharp],
      logger,
    );

    // Check that the status report for telemetry indicates that one cache was restored with an exact match.
    const statusReport = result.statusReport;
    t.is(statusReport.length, 1);
-    t.is(statusReport[0].language, BuiltInLanguage.csharp);
+    t.is(statusReport[0].language, KnownLanguage.csharp);
    t.is(statusReport[0].hit_kind, CacheHitKind.Exact);

    // Check that the restored key has been returned.
@@ -380,7 +380,7 @@ test.serial(
    const keyWithFeature = await cacheKey(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      // Patterns don't matter here because we have stubbed `hashFiles` to always return a specific hash above.
      [],
    );
@@ -398,14 +398,14 @@ test.serial(
    const result = await downloadDependencyCaches(
      codeql,
      features,
-      [BuiltInLanguage.csharp],
+      [KnownLanguage.csharp],
      logger,
    );

    // Check that the status report for telemetry indicates that one cache was restored with a partial match.
    const statusReport = result.statusReport;
    t.is(statusReport.length, 1);
-    t.is(statusReport[0].language, BuiltInLanguage.csharp);
+    t.is(statusReport[0].language, KnownLanguage.csharp);
    t.is(statusReport[0].hit_kind, CacheHitKind.Partial);

    // Check that the restored key has been returned.
@@ -426,7 +426,7 @@ test("uploadDependencyCaches - skips upload for a language with no cache config"
  const logger = getRecordingLogger(messages);
  const features = createFeatures([]);
  const config = createTestConfig({
-    languages: [BuiltInLanguage.actions],
+    languages: [KnownLanguage.actions],
  });

  const result = await uploadDependencyCaches(codeql, features, config, logger);
@@ -444,7 +444,7 @@ test.serial(
    const logger = getRecordingLogger(messages);
    const features = createFeatures([]);
    const config = createTestConfig({
-      languages: [BuiltInLanguage.go],
+      languages: [KnownLanguage.go],
    });

    const makePatternCheckStub = sinon.stub(internal, "makePatternCheck");
@@ -457,7 +457,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.go);
+    t.is(result[0].language, KnownLanguage.go);
    t.is(result[0].result, CacheStoreResult.NoHash);
  },
 );
@@ -483,12 +483,12 @@ test.serial(
    const primaryCacheKey = await cacheKey(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      CSHARP_BASE_PATTERNS,
    );

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
      dependencyCachingRestoredKeys: [primaryCacheKey],
    });

@@ -499,7 +499,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.csharp);
+    t.is(result[0].language, KnownLanguage.csharp);
    t.is(result[0].result, CacheStoreResult.Duplicate);
  },
 );
@@ -525,7 +525,7 @@ test.serial(
    sinon.stub(cachingUtils, "getTotalCacheSize").resolves(0);

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
    });

    const result = await uploadDependencyCaches(
@@ -535,7 +535,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.csharp);
+    t.is(result[0].language, KnownLanguage.csharp);
    t.is(result[0].result, CacheStoreResult.Empty);

    checkExpectedLogMessages(t, messages, [
@@ -566,7 +566,7 @@ test.serial(
    sinon.stub(actionsCache, "saveCache").resolves();

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
    });

    const result = await uploadDependencyCaches(
@@ -576,7 +576,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.csharp);
+    t.is(result[0].language, KnownLanguage.csharp);
    t.is(result[0].result, CacheStoreResult.Stored);
    t.is(result[0].upload_size_bytes, 1024);

@@ -608,7 +608,7 @@ test.serial(
      .throws(new actionsCache.ReserveCacheError("Already in use"));

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
    });

    await t.notThrowsAsync(async () => {
@@ -619,7 +619,7 @@ test.serial(
        logger,
      );
      t.is(result.length, 1);
-      t.is(result[0].language, BuiltInLanguage.csharp);
+      t.is(result[0].language, KnownLanguage.csharp);
      t.is(result[0].result, CacheStoreResult.Duplicate);

      checkExpectedLogMessages(t, messages, ["Not uploading cache for"]);
@@ -647,7 +647,7 @@ test.serial("uploadDependencyCaches - throws other exceptions", async (t) => {
  sinon.stub(actionsCache, "saveCache").throws();

  const config = createTestConfig({
-    languages: [BuiltInLanguage.csharp],
+    languages: [KnownLanguage.csharp],
  });

  await t.throwsAsync(async () => {
@@ -659,7 +659,7 @@ test("getFeaturePrefix - returns empty string if no features are enabled", async
  const codeql = createStubCodeQL({});
  const features = createFeatures([]);

-  for (const knownLanguage of Object.values(BuiltInLanguage)) {
+  for (const knownLanguage of Object.values(KnownLanguage)) {
    const result = await getFeaturePrefix(codeql, features, knownLanguage);
    t.deepEqual(result, "", `Expected no feature prefix for ${knownLanguage}`);
  }
@@ -669,11 +669,7 @@ test("getFeaturePrefix - C# - returns prefix if CsharpNewCacheKey is enabled", a
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpNewCacheKey]);

-  const result = await getFeaturePrefix(
-    codeql,
-    features,
-    BuiltInLanguage.csharp,
-  );
+  const result = await getFeaturePrefix(codeql, features, KnownLanguage.csharp);
  t.notDeepEqual(result, "");
  t.assert(result.endsWith("-"));
  // Check the length of the prefix, which should correspond to `cacheKeyHashLength` + 1 for the trailing `-`.
@@ -684,9 +680,9 @@ test("getFeaturePrefix - non-C# - returns '' if CsharpNewCacheKey is enabled", a
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpNewCacheKey]);

-  for (const knownLanguage of Object.values(BuiltInLanguage)) {
+  for (const knownLanguage of Object.values(KnownLanguage)) {
    // Skip C# since we expect a result for it, which is tested in the previous test.
-    if (knownLanguage === BuiltInLanguage.csharp) {
+    if (knownLanguage === KnownLanguage.csharp) {
      continue;
    }
    const result = await getFeaturePrefix(codeql, features, knownLanguage);
@@ -698,11 +694,7 @@ test("getFeaturePrefix - C# - returns prefix if CsharpCacheBuildModeNone is enab
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpCacheBuildModeNone]);

-  const result = await getFeaturePrefix(
-    codeql,
-    features,
-    BuiltInLanguage.csharp,
-  );
+  const result = await getFeaturePrefix(codeql, features, KnownLanguage.csharp);
  t.notDeepEqual(result, "");
  t.assert(result.endsWith("-"));
  // Check the length of the prefix, which should correspond to `cacheKeyHashLength` + 1 for the trailing `-`.
@@ -713,9 +705,9 @@ test("getFeaturePrefix - non-C# - returns '' if CsharpCacheBuildModeNone is enab
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpCacheBuildModeNone]);

-  for (const knownLanguage of Object.values(BuiltInLanguage)) {
+  for (const knownLanguage of Object.values(KnownLanguage)) {
    // Skip C# since we expect a result for it, which is tested in the previous test.
-    if (knownLanguage === BuiltInLanguage.csharp) {
+    if (knownLanguage === KnownLanguage.csharp) {
      continue;
    }
    const result = await getFeaturePrefix(codeql, features, knownLanguage);
@@ -11,7 +11,7 @@ import { CodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import { getErrorMessage, getRequiredEnvParam } from "./util";

@@ -541,7 +541,7 @@ export async function getFeaturePrefix(
    }
  };

-  if (language === BuiltInLanguage.csharp) {
+  if (language === KnownLanguage.csharp) {
    await addFeatureIfEnabled(Feature.CsharpNewCacheKey);
    await addFeatureIfEnabled(Feature.CsharpCacheBuildModeNone);
  }
@@ -72,13 +72,6 @@ let unwrittenDiagnostics: UnwrittenDiagnostic[] = [];
 */
 let unwrittenDefaultLanguageDiagnostics: DiagnosticMessage[] = [];

-/**
- * Counter used to generate a unique suffix for each diagnostic filename, so that
- * two diagnostics produced within the same millisecond do not overwrite each
- * other on disk.
- */
-let diagnosticCounter = 0;
-
 /**
 * Constructs a new diagnostic message with the specified id and name, as well as optional additional data.
 *
@@ -174,18 +167,10 @@ function writeDiagnostic(
    // Create the directory if it doesn't exist yet.
    mkdirSync(diagnosticsPath, { recursive: true });

-    // Include a monotonically increasing suffix to avoid filename collisions
-    // between diagnostics produced within the same millisecond.
-    const uniqueSuffix = (diagnosticCounter++).toString();
-    // We should only need to remove colons, but to be defensive, only allow a restricted set of
-    // characters.
-    const sanitizedTimestamp = diagnostic.timestamp.replace(
-      /[^a-zA-Z0-9.-]/g,
-      "",
-    );
    const jsonPath = path.resolve(
      diagnosticsPath,
-      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
+      // Remove colons from the timestamp as these are not allowed in Windows filenames.
+      `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}.json`,
    );

    writeFileSync(jsonPath, JSON.stringify(diagnostic));
@@ -16,7 +16,6 @@ import {
  mockCodeQLVersion,
  mockFeatureFlagApiEndpoint,
  setupActionsVars,
-  makeMacro,
 } from "./testing-utils";
 import { GitHubVariant, withTmpDir } from "./util";
 import type { GitHubVersion } from "./util";
@@ -43,9 +42,10 @@ const defaultTestCase: DiffInformedAnalysisTestCase = {
  codeQLVersion: "2.21.0",
 };

-const testShouldPerformDiffInformedAnalysis = makeMacro({
+const testShouldPerformDiffInformedAnalysis = test.macro({
  exec: async (
    t: ExecutionContext,
+    _title: string,
    partialTestCase: Partial<DiffInformedAnalysisTestCase>,
    expectedResult: boolean,
  ) => {
@@ -94,16 +94,18 @@ const testShouldPerformDiffInformedAnalysis = makeMacro({
      getPullRequestBranchesStub.restore();
    });
  },
-  title: (title) => `shouldPerformDiffInformedAnalysis: ${title}`,
+  title: (_, title) => `shouldPerformDiffInformedAnalysis: ${title}`,
 });

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns true in the default test case",
  {},
  true,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns false when feature flag is disabled from the API",
  {
    featureEnabled: false,
@@ -111,7 +113,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  false,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns false when CODEQL_ACTION_DIFF_INFORMED_QUERIES is set to false",
  {
    featureEnabled: true,
@@ -120,7 +123,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  false,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns true when CODEQL_ACTION_DIFF_INFORMED_QUERIES is set to true",
  {
    featureEnabled: false,
@@ -129,7 +133,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  true,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns false for CodeQL version 2.20.0",
  {
    codeQLVersion: "2.20.0",
@@ -137,7 +142,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  false,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns false for invalid GHES version",
  {
    gitHubVersion: {
@@ -148,7 +154,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  false,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns false for GHES version 3.18.5",
  {
    gitHubVersion: {
@@ -159,7 +166,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  false,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns true for GHES version 3.19.0",
  {
    gitHubVersion: {
@@ -170,7 +178,8 @@ testShouldPerformDiffInformedAnalysis.serial(
  true,
 );

-testShouldPerformDiffInformedAnalysis.serial(
+test.serial(
+  testShouldPerformDiffInformedAnalysis,
  "returns false when not a pull request",
  {
    pullRequestBranches: undefined,
@@ -8,7 +8,6 @@ export enum DocUrl {
  CODEQL_BUILD_MODES = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes",
  DEFINE_ENV_VARIABLES = "https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow",
  DELETE_ACTIONS_CACHE_ENTRIES = "https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manage-caches#deleting-cache-entries",
-  PRIVATE_REGISTRY_LOGS = "https://docs.github.com/en/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries",
  SCANNING_ON_PUSH = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push",
  SPECIFY_BUILD_STEPS_MANUALLY = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually",
  SYSTEM_REQUIREMENTS = "https://codeql.github.com/docs/codeql-overview/system-requirements/",
@@ -451,16 +451,12 @@ test.serial(`selects CLI from defaults.json on GHES`, async (t) => {
  await withTmpDir(async (tmpDir) => {
    const features = setUpFeatureFlagTests(tmpDir);

-    const defaultCliVersion = await features.getEnabledDefaultCliVersions(
+    const defaultCliVersion = await features.getDefaultCliVersion(
      GitHubVariant.GHES,
    );
    t.deepEqual(defaultCliVersion, {
-      enabledVersions: [
-        {
-          cliVersion: defaults.cliVersion,
-          tagName: defaults.bundleVersion,
-        },
-      ],
+      cliVersion: defaults.cliVersion,
+      tagName: defaults.bundleVersion,
    });
  });
 });
@@ -486,13 +482,10 @@ for (const variant of [GitHubVariant.DOTCOM, GitHubVariant.GHEC_DR]) {
          false;
        mockFeatureFlagApiEndpoint(200, expectedFeatureEnablement);

-        const defaultCliVersion =
-          await features.getEnabledDefaultCliVersions(variant);
+        const defaultCliVersion = await features.getDefaultCliVersion(variant);
        t.deepEqual(defaultCliVersion, {
-          enabledVersions: [
-            { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-            { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
-          ],
+          cliVersion: "2.20.1",
+          tagName: "codeql-bundle-v2.20.1",
          toolsFeatureFlagsValid: true,
        });
      });
@@ -507,15 +500,10 @@ for (const variant of [GitHubVariant.DOTCOM, GitHubVariant.GHEC_DR]) {
        const expectedFeatureEnablement = initializeFeatures(true);
        mockFeatureFlagApiEndpoint(200, expectedFeatureEnablement);

-        const defaultCliVersion =
-          await features.getEnabledDefaultCliVersions(variant);
+        const defaultCliVersion = await features.getDefaultCliVersion(variant);
        t.deepEqual(defaultCliVersion, {
-          enabledVersions: [
-            {
-              cliVersion: defaults.cliVersion,
-              tagName: defaults.bundleVersion,
-            },
-          ],
+          cliVersion: defaults.cliVersion,
+          tagName: defaults.bundleVersion,
          toolsFeatureFlagsValid: false,
        });
      });
@@ -541,13 +529,10 @@ for (const variant of [GitHubVariant.DOTCOM, GitHubVariant.GHEC_DR]) {
        ] = true;
        mockFeatureFlagApiEndpoint(200, expectedFeatureEnablement);

-        const defaultCliVersion =
-          await features.getEnabledDefaultCliVersions(variant);
+        const defaultCliVersion = await features.getDefaultCliVersion(variant);
        t.deepEqual(defaultCliVersion, {
-          enabledVersions: [
-            { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-            { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
-          ],
+          cliVersion: "2.20.1",
+          tagName: "codeql-bundle-v2.20.1",
          toolsFeatureFlagsValid: true,
        });

@@ -29,32 +29,9 @@ const DEFAULT_VERSION_FEATURE_FLAG_SUFFIX = "_enabled";
 */
 export const CODEQL_VERSION_ZSTD_BUNDLE = "2.19.0";

-const LINKED_CODEQL_VERSION: CodeQLVersionInfo = {
-  cliVersion: defaults.cliVersion,
-  tagName: defaults.bundleVersion,
-};
-
-export interface CodeQLVersionInfo {
-  /** The version number of the CodeQL CLI, e.g. `2.19.0`. */
-  cliVersion: string;
-  /**
-   * The tag name of the CodeQL Bundle associated with this version, e.g. `codeql-bundle-v2.19.0`.
-   */
-  tagName: string;
-}
-
 export interface CodeQLDefaultVersionInfo {
-  /**
-   * CodeQL CLI versions that are enabled as defaults, sorted from highest to lowest.
-   *
-   * Guaranteed to be non-empty. When feature flags are unavailable, this falls back to a single
-   * entry containing the version pinned in `defaults.json`.
-   */
-  enabledVersions: CodeQLVersionInfo[];
-  /**
-   * If accessed, whether the tools feature flags are valid, i.e. contain at least one enabled
-   * version.
-   */
+  cliVersion: string;
+  tagName: string;
  toolsFeatureFlagsValid?: boolean;
 }

@@ -95,19 +72,6 @@ export enum Feature {
  OverlayAnalysisGo = "overlay_analysis_go",
  OverlayAnalysisJava = "overlay_analysis_java",
  OverlayAnalysisJavascript = "overlay_analysis_javascript",
-  /**
-   * When set, chooses the default CodeQL CLI version as the highest version that is both enabled by
-   * feature flags and present as an overlay-base database in the Actions cache for the configured
-   * languages. Falls back to the highest feature flagged version if no intersecting overlay-base
-   * database exists in the cache.
-   */
-  OverlayAnalysisMatchCodeqlVersion = "overlay_analysis_match_codeql_version",
-  /**
-   * Like `OverlayAnalysisMatchCodeqlVersion`, but only logs a diagnostic with the version that
-   * would have been chosen instead of actually changing the default CodeQL CLI version.
-   * `OverlayAnalysisMatchCodeqlVersion` overrides this flag.
-   */
-  OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run",
  OverlayAnalysisPython = "overlay_analysis_python",
  /**
   * Controls whether lower disk space requirements are used for overlay hardware checks.
@@ -121,6 +85,7 @@ export enum Feature {
  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
+  PythonDefaultIsToNotExtractStdlib = "python_default_is_to_not_extract_stdlib",
  QaTelemetryEnabled = "qa_telemetry_enabled",
  /** Note that this currently only disables baseline file coverage information. */
  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
@@ -313,16 +278,6 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
    minimumVersion: undefined,
  },
-  [Feature.OverlayAnalysisMatchCodeqlVersion]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION",
-    minimumVersion: undefined,
-  },
-  [Feature.OverlayAnalysisMatchCodeqlVersionDryRun]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN",
-    minimumVersion: undefined,
-  },
  [Feature.OverlayAnalysisResourceChecksV2]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
@@ -343,6 +298,12 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
    minimumVersion: undefined,
  },
+  [Feature.PythonDefaultIsToNotExtractStdlib]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
+    minimumVersion: undefined,
+    toolsFeature: ToolsFeature.PythonDefaultIsToNotExtractStdlib,
+  },
  [Feature.QaTelemetryEnabled]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -392,12 +353,8 @@ export type FeatureWithoutCLI = {
 }[keyof typeof featureConfig];

 export interface FeatureEnablement {
-  /**
-   * Returns the set of default CodeQL CLI versions to consider, sorted from
-   * highest to lowest. The first entry is the version that the CodeQL Action
-   * will use by default. The list is always non-empty.
-   */
-  getEnabledDefaultCliVersions(
+  /** Gets the default version of the CodeQL tools. */
+  getDefaultCliVersion(
    variant: util.GitHubVariant,
  ): Promise<CodeQLDefaultVersionInfo>;
  getValue(feature: FeatureWithoutCLI): Promise<boolean>;
@@ -421,11 +378,12 @@ export const FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
 class OfflineFeatures implements FeatureEnablement {
  constructor(protected readonly logger: Logger) {}

-  async getEnabledDefaultCliVersions(
+  async getDefaultCliVersion(
    _variant: util.GitHubVariant,
  ): Promise<CodeQLDefaultVersionInfo> {
    return {
-      enabledVersions: [LINKED_CODEQL_VERSION],
+      cliVersion: defaults.cliVersion,
+      tagName: defaults.bundleVersion,
    };
  }

@@ -435,7 +393,7 @@ class OfflineFeatures implements FeatureEnablement {
  getFeatureConfig(feature: Feature): FeatureConfig {
    // Narrow the type to FeatureConfig to avoid type errors. To avoid unsafe use of `as`, we
    // check that the required properties exist using `satisfies`.
-    return featureConfig[feature] satisfies FeatureConfig;
+    return featureConfig[feature] satisfies FeatureConfig as FeatureConfig;
  }

  /**
@@ -567,13 +525,13 @@ class Features extends OfflineFeatures {
    );
  }

-  async getEnabledDefaultCliVersions(
+  async getDefaultCliVersion(
    variant: util.GitHubVariant,
  ): Promise<CodeQLDefaultVersionInfo> {
    if (supportsFeatureFlags(variant)) {
-      return await this.gitHubFeatureFlags.getEnabledDefaultCliVersionsFromFlags();
+      return await this.gitHubFeatureFlags.getDefaultCliVersionFromFlags();
    }
-    return super.getEnabledDefaultCliVersions(variant);
+    return super.getDefaultCliVersion(variant);
  }

  /**
@@ -649,22 +607,16 @@ class GitHubFeatureFlags {
    return version;
  }

-  /**
-   * Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
-   * flags, sorted from highest to lowest. Falls back to the version pinned in
-   * `defaults.json` if no such flags are enabled.
-   */
-  async getEnabledDefaultCliVersionsFromFlags(): Promise<CodeQLDefaultVersionInfo> {
+  async getDefaultCliVersionFromFlags(): Promise<CodeQLDefaultVersionInfo> {
    const response = await this.getAllFeatures();

-    const sortedCliVersions = Object.entries(response)
+    const enabledFeatureFlagCliVersions = Object.entries(response)
      .map(([f, isEnabled]) =>
        isEnabled ? this.getCliVersionFromFeatureFlag(f) : undefined,
      )
-      .filter((f): f is string => f !== undefined)
-      .sort(semver.rcompare);
+      .filter((f): f is string => f !== undefined);

-    if (sortedCliVersions.length === 0) {
+    if (enabledFeatureFlagCliVersions.length === 0) {
      // We expect at least one default CLI version to be enabled on Dotcom at any time. However if
      // the feature flags are misconfigured, rather than crashing, we fall back to the CLI version
      // shipped with the Action in defaults.json. This has the effect of immediately rolling out
@@ -680,7 +632,8 @@ class GitHubFeatureFlags {
          `shipped with the Action. This is ${defaults.cliVersion}.`,
      );
      const result: CodeQLDefaultVersionInfo = {
-        enabledVersions: [LINKED_CODEQL_VERSION],
+        cliVersion: defaults.cliVersion,
+        tagName: defaults.bundleVersion,
      };
      if (this.hasAccessedRemoteFeatureFlags) {
        result.toolsFeatureFlagsValid = false;
@@ -688,14 +641,17 @@ class GitHubFeatureFlags {
      return result;
    }

+    const maxCliVersion = enabledFeatureFlagCliVersions.reduce(
+      (maxVersion, currentVersion) =>
+        currentVersion > maxVersion ? currentVersion : maxVersion,
+      enabledFeatureFlagCliVersions[0],
+    );
    this.logger.debug(
-      `Derived default CLI version of ${sortedCliVersions[0]} from feature flags.`,
+      `Derived default CLI version of ${maxCliVersion} from feature flags.`,
    );
    return {
-      enabledVersions: sortedCliVersions.map((cliVersion) => ({
-        cliVersion,
-        tagName: `codeql-bundle-v${cliVersion}`,
-      })),
+      cliVersion: maxCliVersion,
+      tagName: `codeql-bundle-v${maxCliVersion}`,
      toolsFeatureFlagsValid: true,
    };
  }
@@ -343,142 +343,75 @@ test.serial("decodeGitFilePath quoted strings", async (t) => {
  );
 });

-test.serial(
-  "getFileOidsUnderPath uses --recurse-submodules when submodules exist",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      fs.writeFileSync(path.join(tmpDir, ".gitmodules"), "");
-      const runGitCommandStub = sinon
-        .stub(gitUtils as any, "runGitCommand")
-        .callsFake(async (_cwd: any, args: any) => {
-          if (args[0] === "rev-parse") {
-            return `${tmpDir}\n`;
-          }
-          return (
-            "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
-            "100644 d89514599a9a99f22b4085766d40af7b99974827 0\tlib/git-utils.js.map\n" +
-            "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts"
-          );
-        });
+test.serial("getFileOidsUnderPath returns correct file mapping", async (t) => {
+  const runGitCommandStub = sinon
+    .stub(gitUtils as any, "runGitCommand")
+    .resolves(
+      "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
+        "100644 d89514599a9a99f22b4085766d40af7b99974827 0\tlib/git-utils.js.map\n" +
+        "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts",
+    );

-      const result = await gitUtils.getFileOidsUnderPath("/fake/path");
+  const result = await gitUtils.getFileOidsUnderPath("/fake/path");

-      t.deepEqual(result, {
-        "lib/git-utils.js": "30d998ded095371488be3a729eb61d86ed721a18",
-        "lib/git-utils.js.map": "d89514599a9a99f22b4085766d40af7b99974827",
-        "src/git-utils.ts": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
-      });
+  t.deepEqual(result, {
+    "lib/git-utils.js": "30d998ded095371488be3a729eb61d86ed721a18",
+    "lib/git-utils.js.map": "d89514599a9a99f22b4085766d40af7b99974827",
+    "src/git-utils.ts": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
+  });

-      // Second call (after getGitRoot) should include --recurse-submodules
-      t.deepEqual(runGitCommandStub.secondCall.args[1], [
-        "ls-files",
-        "--recurse-submodules",
-        "--stage",
-      ]);
-    });
-  },
-);
-
-test.serial(
-  "getFileOidsUnderPath omits --recurse-submodules when no submodules exist",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      const runGitCommandStub = sinon
-        .stub(gitUtils as any, "runGitCommand")
-        .callsFake(async (_cwd: any, args: any) => {
-          if (args[0] === "rev-parse") {
-            return `${tmpDir}\n`;
-          }
-          return (
-            "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
-            "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts"
-          );
-        });
-
-      const result = await gitUtils.getFileOidsUnderPath("/fake/path");
-
-      t.deepEqual(result, {
-        "lib/git-utils.js": "30d998ded095371488be3a729eb61d86ed721a18",
-        "src/git-utils.ts": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
-      });
-
-      // Second call (after getGitRoot) should NOT include --recurse-submodules
-      t.deepEqual(runGitCommandStub.secondCall.args[1], [
-        "ls-files",
-        "--stage",
-      ]);
-    });
-  },
-);
+  t.deepEqual(runGitCommandStub.firstCall.args, [
+    "/fake/path",
+    ["ls-files", "--recurse-submodules", "--stage"],
+    "Cannot list Git OIDs of tracked files.",
+  ]);
+});

 test.serial("getFileOidsUnderPath handles quoted paths", async (t) => {
-  await withTmpDir(async (tmpDir) => {
-    sinon
-      .stub(gitUtils as any, "runGitCommand")
-      .callsFake(async (_cwd: any, args: any) => {
-        if (args[0] === "rev-parse") {
-          return `${tmpDir}\n`;
-        }
-        return (
-          "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/normal-file.js\n" +
-          '100644 d89514599a9a99f22b4085766d40af7b99974827 0\t"lib/file with spaces.js"\n' +
-          '100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\t"lib/file\\twith\\ttabs.js"'
-        );
-      });
+  sinon
+    .stub(gitUtils as any, "runGitCommand")
+    .resolves(
+      "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/normal-file.js\n" +
+        '100644 d89514599a9a99f22b4085766d40af7b99974827 0\t"lib/file with spaces.js"\n' +
+        '100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\t"lib/file\\twith\\ttabs.js"',
+    );

-    const result = await gitUtils.getFileOidsUnderPath("/fake/path");
+  const result = await gitUtils.getFileOidsUnderPath("/fake/path");

-    t.deepEqual(result, {
-      "lib/normal-file.js": "30d998ded095371488be3a729eb61d86ed721a18",
-      "lib/file with spaces.js": "d89514599a9a99f22b4085766d40af7b99974827",
-      "lib/file\twith\ttabs.js": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
-    });
+  t.deepEqual(result, {
+    "lib/normal-file.js": "30d998ded095371488be3a729eb61d86ed721a18",
+    "lib/file with spaces.js": "d89514599a9a99f22b4085766d40af7b99974827",
+    "lib/file\twith\ttabs.js": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
  });
 });

 test.serial("getFileOidsUnderPath handles empty output", async (t) => {
-  await withTmpDir(async (tmpDir) => {
-    sinon
-      .stub(gitUtils as any, "runGitCommand")
-      .callsFake(async (_cwd: any, args: any) => {
-        if (args[0] === "rev-parse") {
-          return `${tmpDir}\n`;
-        }
-        return "";
-      });
+  sinon.stub(gitUtils as any, "runGitCommand").resolves("");

-    const result = await gitUtils.getFileOidsUnderPath("/fake/path");
-    t.deepEqual(result, {});
-  });
+  const result = await gitUtils.getFileOidsUnderPath("/fake/path");
+  t.deepEqual(result, {});
 });

 test.serial(
  "getFileOidsUnderPath throws on unexpected output format",
  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      sinon
-        .stub(gitUtils as any, "runGitCommand")
-        .callsFake(async (_cwd: any, args: any) => {
-          if (args[0] === "rev-parse") {
-            return `${tmpDir}\n`;
-          }
-          return (
-            "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
-            "invalid-line-format\n" +
-            "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts"
-          );
-        });
-
-      await t.throwsAsync(
-        async () => {
-          await gitUtils.getFileOidsUnderPath("/fake/path");
-        },
-        {
-          instanceOf: Error,
-          message: 'Unexpected "git ls-files" output: invalid-line-format',
-        },
+    sinon
+      .stub(gitUtils as any, "runGitCommand")
+      .resolves(
+        "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
+          "invalid-line-format\n" +
+          "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts",
      );
-    });
+
+    await t.throwsAsync(
+      async () => {
+        await gitUtils.getFileOidsUnderPath("/fake/path");
+      },
+      {
+        instanceOf: Error,
+        message: 'Unexpected "git ls-files" output: invalid-line-format',
+      },
+    );
  },
 );

@@ -1,6 +1,4 @@
-import * as fs from "fs";
 import * as os from "os";
-import * as path from "path";

 import * as core from "@actions/core";
 import { ExecOptions } from "@actions/exec";
@@ -16,11 +14,11 @@ import {
 import { ConfigurationError, getRequiredEnvParam } from "./util";

 /**
- * Minimum Git version required for overlay analysis in repositories that
- * contain submodules. Support for using the `git ls-files
- * --recurse-submodules` option with `--stage` was added in Git 2.36.0.
+ * Minimum Git version required for overlay analysis. The
+ * `git ls-files --recurse-submodules` option, which is used by
+ * `getFileOidsUnderPath`, was introduced in Git 2.11.0.
 */
-export const GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES = "2.36.0";
+export const GIT_MINIMUM_VERSION_FOR_OVERLAY = "2.11.0";

 /**
 * Git version information
@@ -247,16 +245,6 @@ export const getGitRoot = async function (
  }
 };

-/**
- * Returns true if the Git repository has submodules registered (i.e. a
- * `.gitmodules` file exists at the repository root).
- *
- * @param gitRoot The root of the Git repository.
- */
-export function hasSubmodules(gitRoot: string): boolean {
-  return fs.existsSync(path.join(gitRoot, ".gitmodules"));
-}
-
 /**
 * Returns the Git OIDs of all tracked files (in the index and in the working
 * tree) that are under the given base path, including files in active
@@ -273,21 +261,11 @@ export const getFileOidsUnderPath = async function (
  // Without the --full-name flag, the path is relative to the current working
  // directory of the git command, which is basePath.
  //
-  // We use --stage rather than --format here because --format was only
-  // introduced in Git 2.38.0, which would limit overlay rollout.
-  //
-  // We only pass --recurse-submodules when the repository actually has
-  // submodules, because the combination of --recurse-submodules and --stage is
-  // only supported since Git 2.36.0.
-  const gitRoot = await getGitRoot(basePath);
-  const mayHaveSubmodules =
-    gitRoot === undefined ? true : hasSubmodules(gitRoot);
-  const args = mayHaveSubmodules
-    ? ["ls-files", "--recurse-submodules", "--stage"]
-    : ["ls-files", "--stage"];
+  // We use --stage rather than --format here because --stage has been available since Git 2.11.0,
+  // while --format was only introduced in Git 2.38.0, which would limit overlay rollout.
  const stdout = await runGitCommand(
    basePath,
-    args,
+    ["ls-files", "--recurse-submodules", "--stage"],
    "Cannot list Git OIDs of tracked files.",
  );

@@ -302,8 +280,8 @@ export const getFileOidsUnderPath = async function (
      const match = line.match(regex);
      if (match) {
        const oid = match[1];
-        const filePath = decodeGitFilePath(match[2]);
-        fileOidMap[filePath] = oid;
+        const path = decodeGitFilePath(match[2]);
+        fileOidMap[path] = oid;
      } else {
        throw new Error(`Unexpected "git ls-files" output: ${line}`);
      }
@@ -12,14 +12,13 @@ import { EnvVar } from "./environment";
 import { Feature } from "./feature-flags";
 import * as initActionPostHelper from "./init-action-post-helper";
 import { getRunnerLogger } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import * as overlayStatus from "./overlay/status";
 import { parseRepositoryNwo } from "./repository";
 import {
  createFeatures,
  createTestConfig,
  DEFAULT_ACTIONS_VARS,
-  makeMacro,
  makeVersionInfo,
  RecordingLogger,
  setupActionsVars,
@@ -602,7 +601,7 @@ async function testFailedSarifUpload(
  uploadFiles.resolves({
    sarifID: "42",
    statusReport: { raw_upload_size_bytes: 20, zipped_upload_size_bytes: 10 },
-  });
+  } as uploadLib.UploadResult);
  const waitForProcessing = sinon.stub(uploadLib, "waitForProcessing");

  const features = [] as Feature[];
@@ -797,7 +796,7 @@ test.serial(
  },
 );

-const skippedUploadTest = makeMacro({
+const skippedUploadTest = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    config: Partial<configUtils.Config>,
@@ -824,8 +823,9 @@ const skippedUploadTest = makeMacro({
    `tryUploadSarifIfRunFailed - skips upload ${providedTitle}`,
 });

-skippedUploadTest.serial(
+test.serial(
  "without CodeQL command",
+  skippedUploadTest,
  // No codeQLCmd
  {
    analysisKinds: [AnalysisKind.RiskAssessment],
@@ -834,8 +834,9 @@ skippedUploadTest.serial(
  "CodeQL command not found",
 );

-skippedUploadTest.serial(
+test.serial(
  "if no language is configured",
+  skippedUploadTest,
  // No explicit language configuration
  {
    analysisKinds: [AnalysisKind.RiskAssessment],
@@ -844,8 +845,9 @@ skippedUploadTest.serial(
  "Unexpectedly, the configuration is not for a single language.",
 );

-skippedUploadTest.serial(
+test.serial(
  "if multiple languages is configured",
+  skippedUploadTest,
  // Multiple explicit languages configured
  {
    analysisKinds: [AnalysisKind.RiskAssessment],
@@ -21,7 +21,7 @@ import * as dependencyCaching from "./dependency-caching";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import {
  createOverlayStatus,
  OverlayStatus,
@@ -58,13 +58,13 @@ import {
  initConfig,
  runDatabaseInitCluster,
 } from "./init";
-import { JavaEnvVars, BuiltInLanguage } from "./languages";
+import { JavaEnvVars, KnownLanguage } from "./languages";
 import { getActionsLogger, Logger, withGroupAsync } from "./logging";
 import {
  downloadOverlayBaseDatabaseFromCache,
  OverlayBaseDatabaseDownloadStats,
-} from "./overlay/caching";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+  OverlayDatabaseMode,
+} from "./overlay";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -298,23 +298,16 @@ async function run(startedAt: Date) {
      );
    }

-    const codeQLDefaultVersionInfo =
-      await features.getEnabledDefaultCliVersions(gitHubVersion.type);
+    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
+      gitHubVersion.type,
+    );
    toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
-    const rawLanguages = configUtils.getRawLanguagesNoAutodetect(
-      getOptionalInput("languages"),
-    );
-    const useOverlayAwareDefaultCliVersion = !!analysisKinds?.includes(
-      AnalysisKind.CodeScanning,
-    );
    const initCodeQLResult = await initCodeQL(
      getOptionalInput("tools"),
      apiDetails,
      getTemporaryDirectory(),
      gitHubVersion.type,
      codeQLDefaultVersionInfo,
-      rawLanguages,
-      useOverlayAwareDefaultCliVersion,
      features,
      logger,
    );
@@ -337,7 +330,7 @@ async function run(startedAt: Date) {
      // requested rust - don't enable it via language autodetection.
      configUtils
        .getRawLanguagesNoAutodetect(getOptionalInput("languages"))
-        .includes(BuiltInLanguage.rust)
+        .includes(KnownLanguage.rust)
    ) {
      const experimental = "2.19.3";
      const publicPreview = "2.22.1";
@@ -396,15 +389,6 @@ async function run(startedAt: Date) {
      logger,
    });

-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
-
    if (repositoryPropertiesResult.isFailure()) {
      addNoLanguageDiagnostic(
        config,
@@ -472,23 +456,18 @@ async function run(startedAt: Date) {
      // necessary preparations. So, in that mode, we would assume that
      // everything is in order and let the analysis fail if that turns out not
      // to be the case.
-      await withGroupAsync(
-        "Checking cache for overlay-base database",
-        async () => {
-          overlayBaseDatabaseStats = await downloadOverlayBaseDatabaseFromCache(
-            codeql,
-            config,
-            logger,
-          );
-          if (!overlayBaseDatabaseStats) {
-            config.overlayDatabaseMode = OverlayDatabaseMode.None;
-            logger.info(
-              "No overlay-base database found in cache, " +
-                `reverting overlay database mode to ${OverlayDatabaseMode.None}.`,
-            );
-          }
-        },
+      overlayBaseDatabaseStats = await downloadOverlayBaseDatabaseFromCache(
+        codeql,
+        config,
+        logger,
      );
+      if (!overlayBaseDatabaseStats) {
+        config.overlayDatabaseMode = OverlayDatabaseMode.None;
+        logger.info(
+          "No overlay-base database found in cache, " +
+            `reverting overlay database mode to ${OverlayDatabaseMode.None}.`,
+        );
+      }
    }

    if (config.overlayDatabaseMode !== OverlayDatabaseMode.Overlay) {
@@ -521,7 +500,16 @@ async function run(startedAt: Date) {
    }

    if (
-      config.languages.includes(BuiltInLanguage.go) &&
+      config.languages.includes(KnownLanguage.swift) &&
+      process.platform === "linux"
+    ) {
+      logger.warning(
+        `Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you.`,
+      );
+    }
+
+    if (
+      config.languages.includes(KnownLanguage.go) &&
      process.platform === "linux"
    ) {
      try {
@@ -579,7 +567,7 @@ async function run(startedAt: Date) {
        if (e instanceof FileCmdNotFoundError) {
          addDiagnostic(
            config,
-            BuiltInLanguage.go,
+            KnownLanguage.go,
            makeDiagnostic(
              "go/workflow/file-program-unavailable",
              "The `file` program is required on Linux, but does not appear to be installed",
@@ -657,6 +645,27 @@ async function run(startedAt: Date) {
      );
    }

+    if (
+      await codeql.supportsFeature(
+        ToolsFeature.PythonDefaultIsToNotExtractStdlib,
+      )
+    ) {
+      if (process.env["CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB"]) {
+        logger.debug(
+          "CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB is already set, so the Action will not override it.",
+        );
+      } else if (
+        !(await features.getValue(
+          Feature.PythonDefaultIsToNotExtractStdlib,
+          codeql,
+        ))
+      ) {
+        // We are in a situation where the feature flag is not rolled out,
+        // so we need to suppress the new default CLI behavior.
+        core.exportVariable("CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB", "true");
+      }
+    }
+
    // If we are doing a Java `build-mode: none` analysis, then set the environment variable that
    // enables the option in the Java extractor to minimize dependency jars. We also only do this if
    // dependency caching is enabled, since the option is intended to reduce the size of dependency
@@ -673,7 +682,7 @@ async function run(startedAt: Date) {
      (await codeQlVersionAtLeast(codeql, CODEQL_VERSION_JAR_MINIMIZATION)) &&
      config.dependencyCachingEnabled &&
      config.buildMode === BuildMode.None &&
-      config.languages.includes(BuiltInLanguage.java)
+      config.languages.includes(KnownLanguage.java)
    ) {
      core.exportVariable(
        EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS,
@@ -15,14 +15,13 @@ import {
  getFileCoverageInformationEnabled,
  logFileCoverageOnPrsDeprecationWarning,
 } from "./init";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import {
  createFeatures,
  LoggedMessage,
  createTestConfig,
  getRecordingLogger,
  setupTests,
-  makeMacro,
 } from "./testing-utils";
 import { ConfigurationError, withTmpDir } from "./util";

@@ -153,15 +152,16 @@ test("cleanupDatabaseClusterDirectory can disable warning with options", async (
 });

 type PackInfo = {
-  language: BuiltInLanguage;
+  language: KnownLanguage;
  packinfoContents: string | undefined;
  sourceOnlyPack?: boolean;
  qlpackFileName?: string;
 };

-const testCheckPacksForOverlayCompatibility = makeMacro({
+const testCheckPacksForOverlayCompatibility = test.macro({
  exec: async (
    t: ExecutionContext,
+    _title: string,
    {
      cliOverlayVersion,
      languages,
@@ -169,13 +169,13 @@ const testCheckPacksForOverlayCompatibility = makeMacro({
      expectedResult,
    }: {
      cliOverlayVersion: number | undefined;
-      languages: BuiltInLanguage[];
+      languages: KnownLanguage[];
      packs: Record<string, PackInfo>;
      expectedResult: boolean;
    },
  ) => {
    await withTmpDir(async (tmpDir) => {
-      const packDirsByLanguage = new Map<BuiltInLanguage, string[]>();
+      const packDirsByLanguage = new Map<KnownLanguage, string[]>();

      for (const [packName, packInfo] of Object.entries(packs)) {
        const packPath = path.join(tmpDir, packName);
@@ -234,17 +234,18 @@ const testCheckPacksForOverlayCompatibility = makeMacro({
      );
    });
  },
-  title: (title) => `checkPacksForOverlayCompatibility: ${title}`,
+  title: (_, title) => `checkPacksForOverlayCompatibility: ${title}`,
 });

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns false when CLI does not support overlay",
  {
    cliOverlayVersion: undefined,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -252,24 +253,26 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns true when there are no query packs",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {},
    expectedResult: true,
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns true when query pack has not been compiled",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: undefined,
        sourceOnlyPack: true,
      },
@@ -278,14 +281,15 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns true when query pack has expected overlay version",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -293,18 +297,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns true when query packs for all languages to analyze are compatible",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.cpp, BuiltInLanguage.java],
+    languages: [KnownLanguage.cpp, KnownLanguage.java],
    packs: {
      "codeql/cpp-queries": {
-        language: BuiltInLanguage.cpp,
+        language: KnownLanguage.cpp,
        packinfoContents: '{"overlayVersion":2}',
      },
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -312,18 +317,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns true when query pack for a language not analyzed is incompatible",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/cpp-queries": {
-        language: BuiltInLanguage.cpp,
+        language: KnownLanguage.cpp,
        packinfoContents: undefined,
      },
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -331,18 +337,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns false when query pack for a language to analyze is incompatible",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.cpp, BuiltInLanguage.java],
+    languages: [KnownLanguage.cpp, KnownLanguage.java],
    packs: {
      "codeql/cpp-queries": {
-        language: BuiltInLanguage.cpp,
+        language: KnownLanguage.cpp,
        packinfoContents: '{"overlayVersion":1}',
      },
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -350,18 +357,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns false when query pack is missing .packinfo",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: undefined,
      },
    },
@@ -369,18 +377,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns false when query pack has different overlay version",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":1}',
      },
    },
@@ -388,18 +397,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns false when query pack is missing overlayVersion in .packinfo",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: "{}",
      },
    },
@@ -407,18 +417,19 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns false when .packinfo is not valid JSON",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: "this_is_not_valid_json",
      },
    },
@@ -426,14 +437,15 @@ testCheckPacksForOverlayCompatibility(
  },
 );

-testCheckPacksForOverlayCompatibility(
+test(
+  testCheckPacksForOverlayCompatibility,
  "returns true when query pack uses codeql-pack.yml filename",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
        qlpackFileName: "codeql-pack.yml",
      },
@@ -26,7 +26,7 @@ import {
  RepositoryProperties,
  RepositoryPropertyName,
 } from "./feature-flags/properties";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import { ZstdAvailability } from "./tar";
@@ -39,8 +39,6 @@ export async function initCodeQL(
  tempDir: string,
  variant: util.GitHubVariant,
  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  useOverlayAwareDefaultCliVersion: boolean,
  features: FeatureEnablement,
  logger: Logger,
 ): Promise<{
@@ -63,8 +61,6 @@ export async function initCodeQL(
    tempDir,
    variant,
    defaultCliVersion,
-    rawLanguages,
-    useOverlayAwareDefaultCliVersion,
    features,
    logger,
    true,
@@ -239,7 +235,7 @@ export async function checkInstallPython311(
  codeql: CodeQL,
 ) {
  if (
-    languages.includes(BuiltInLanguage.python) &&
+    languages.includes(KnownLanguage.python) &&
    process.platform === "win32" &&
    !(await codeql.getVersion()).features?.supportsPython312
  ) {
@@ -1,46 +0,0 @@
-import test from "ava";
-
-import { setupTests } from "../testing-utils";
-
-import * as json from ".";
-
-setupTests(test);
-
-const testSchema = {
-  requiredKey: json.string,
-};
-
-const optionalSchema = {
-  optionalKey: json.optional(json.string),
-};
-
-test("validateSchema - required properties are required", async (t) => {
-  t.false(json.validateSchema(testSchema, {}));
-  t.false(json.validateSchema(testSchema, { requiredKey: undefined }));
-  t.false(json.validateSchema(testSchema, { requiredKey: null }));
-  t.false(json.validateSchema(testSchema, { requiredKey: 0 }));
-  t.false(json.validateSchema(testSchema, { requiredKey: 123 }));
-  t.false(json.validateSchema(testSchema, { requiredKey: false }));
-  t.false(json.validateSchema(testSchema, { requiredKey: true }));
-  t.false(json.validateSchema(testSchema, { requiredKey: [] }));
-  t.false(json.validateSchema(testSchema, { requiredKey: {} }));
-  t.true(json.validateSchema(testSchema, { requiredKey: "" }));
-  t.true(json.validateSchema(testSchema, { requiredKey: "foo" }));
-});
-
-test("validateSchema - optional properties are optional", async (t) => {
-  // Optional fields may be absent
-  t.true(json.validateSchema(optionalSchema, {}));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: undefined }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: null }));
-
-  // But, if present, should have the expected type
-  t.false(json.validateSchema(optionalSchema, { optionalKey: 0 }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: 123 }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: false }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: true }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: [] }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: {} }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: "" }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: "foo" }));
-});
@@ -36,82 +36,3 @@ export function isStringOrUndefined(
 ): value is string | undefined {
  return value === undefined || isString(value);
 }
-
-/**
- * Represents a field of type `T` in a schema.
- * Carries a validation function and flag indicating whether the field is required or not.
- */
-export type Validator<T> = {
-  validate: (val: unknown) => val is T;
-  required: boolean;
-};
-
-/** Extracts `T` from `Validator<T>`. */
-export type UnwrapValidator<V> = V extends Validator<infer A> ? A : never;
-
-/** A validator for string fields in schemas. */
-export const string = {
-  validate: isString,
-  required: true,
-} as const satisfies Validator<string>;
-
-/** Transforms a validator to be optional. */
-export function optional<T>(validator: Validator<T>) {
-  return {
-    validate: (val: unknown) => {
-      return val === undefined || val === null || validator.validate(val);
-    },
-    required: false,
-  } as const satisfies Validator<T | undefined | null>;
-}
-
-/** Represents an arbitrary object schema. */
-export type Schema = Record<string, Validator<any>>;
-
-/** Extracts the required keys from `S`. */
-export type RequiredKeys<S extends Schema> = {
-  [K in keyof S]: S[K]["required"] extends true ? K : never;
-}[keyof S];
-
-/** Extracts optional keys from `S`. */
-export type OptionalKeys<S extends Schema> = {
-  [K in keyof S]: S[K]["required"] extends true ? never : K;
-}[keyof S];
-
-/** Constructs an object type corresponding to a schema. */
-export type FromSchema<S extends Schema> = {
-  [K in RequiredKeys<S>]: UnwrapValidator<S[K]>;
-} & { [K in OptionalKeys<S>]?: UnwrapValidator<S[K]> };
-
-/**
- * Validates that `obj` satisfies at least `schema`. Additional keys are accepted.
- *
- * @param schema The schema to validate against.
- * @param obj The object to validate.
- * @returns Asserts that `obj` is of the `schema`'s type if validation is successful.
- */
-export function validateSchema<S extends Schema>(
-  schema: S,
-  obj: UnvalidatedObject<any>,
-): obj is FromSchema<S> {
-  for (const [key, validator] of Object.entries(schema)) {
-    const hasKey = key in obj;
-
-    // If the property is required, but absent, fail.
-    if (validator.required && !hasKey) {
-      return false;
-    }
-
-    // If the property is required, but undefined or null, fail.
-    if (validator.required && (obj[key] === undefined || obj[key] === null)) {
-      return false;
-    }
-
-    // If the property is present, validate it.
-    if (hasKey && !validator.validate(obj[key])) {
-      return false;
-    }
-  }
-
-  return true;
-}
@@ -1,106 +0,0 @@
-import { ExecutionContext } from "ava";
-
-import * as json from ".";
-
-/**
- * Constructs an object based on `schema` for unit tests.
- * Assumes that all keys in `schema` have string values.
- *
- * @param includeOptional Whether to include optional properties.
- * @param schema The schema to base the object on.
- * @returns An object that satisfies `schema`.
- */
-export function makeFromSchema<S extends json.Schema>(
-  includeOptional: boolean,
-  schema: S,
-): json.FromSchema<S> {
-  const result = {};
-  for (const [key, validator] of Object.entries(schema)) {
-    if (!validator.required && !includeOptional) {
-      continue;
-    }
-    result[key] = `value-for-${key}`;
-  }
-  return result as json.FromSchema<S>;
-}
-
-/** Options for `withSchemaMatrix`. */
-export interface SchemaMatrixOptions {
-  /** Whether cases where the properties are entirely absent should be excluded. */
-  excludeAbsent?: boolean;
-}
-
-/**
- * Constructs a test matrix of possible objects for `schema`: all required properties
- * plus all permutations of possible states for the optional properties.
- *
- * @param schema The schema to construct a test matrix for.
- * @param body The test body to call with each value from the test matrix.
- */
-export function withSchemaMatrix<S extends json.Schema>(
-  t: ExecutionContext<any>,
-  schema: S,
-  opts: SchemaMatrixOptions,
-  body: (value: json.FromSchema<S>) => void,
-): void {
-  // Construct a base object that includes all required properties.
-  const required = makeFromSchema(false, schema);
-
-  // Identify optional properties.
-  const optionalKeys: Array<keyof S> = [];
-
-  for (const [key, validator] of Object.entries(schema)) {
-    if (!validator.required) {
-      optionalKeys.push(key);
-    }
-  }
-
-  const optionalValues = (key: keyof S) => [
-    null,
-    undefined,
-    `value-for-${String(key)}`,
-  ];
-
-  // Constructs an array of test objects, starting with `required` and combining it with all
-  // possible states of each optional property. For example, with default settings:
-  //
-  // For { requiredKey: string }, we get: `[{ requiredKey: "some-string-value" }]`
-  //
-  // For { requiredKey: string, optionalKey?: string }, we get:
-  // [ { requiredKey: "some-string-value" },
-  //   { requiredKey: "some-string-value", optionalKey: undefined },
-  //   { requiredKey: "some-string-value", optionalKey: null },
-  //   { requiredKey: "some-string-value", optionalKey: "some-value" },
-  // ]
-  const permutations = (keys: Array<keyof S>) => {
-    if (keys.length === 0) return [required];
-
-    const bases = permutations(keys.slice(1));
-    const result: Array<json.FromSchema<S>> = [];
-
-    const optionalKey = keys[0];
-    for (const base of bases) {
-      if (!opts.excludeAbsent) {
-        // Optional keys can be absent entirely.
-        result.push(base);
-      }
-
-      // Or be present and have one of the `optionalValues`.
-      for (const optionalValue of optionalValues(optionalKey)) {
-        result.push({ ...base, [optionalKey]: optionalValue });
-      }
-    }
-    return result;
-  };
-
-  // Call `body` for all test cases.
-  const testCases = permutations(optionalKeys);
-  for (const testCase of testCases) {
-    try {
-      body(testCase);
-    } catch (err) {
-      t.log(testCase);
-      throw err;
-    }
-  }
-}
@@ -0,0 +1,29 @@
+/** A language to analyze with CodeQL. */
+export type Language = string;
+
+/**
+ * A language supported by CodeQL that is treated specially by the Action.
+ *
+ * This is not an exhaustive list of languages supported by CodeQL and new
+ * languages do not need to be added here.
+ */
+export enum KnownLanguage {
+  actions = "actions",
+  cpp = "cpp",
+  csharp = "csharp",
+  go = "go",
+  java = "java",
+  javascript = "javascript",
+  python = "python",
+  ruby = "ruby",
+  rust = "rust",
+  swift = "swift",
+}
+
+/** Java-specific environment variable names that we may care about. */
+export enum JavaEnvVars {
+  JAVA_HOME = "JAVA_HOME",
+  JAVA_TOOL_OPTIONS = "JAVA_TOOL_OPTIONS",
+  JDK_JAVA_OPTIONS = "JDK_JAVA_OPTIONS",
+  _JAVA_OPTIONS = "_JAVA_OPTIONS",
+}
@@ -1,25 +0,0 @@
-{
-  "languages": [
-    "actions",
-    "cpp",
-    "csharp",
-    "go",
-    "java",
-    "javascript",
-    "python",
-    "ruby",
-    "rust",
-    "swift"
-  ],
-  "aliases": {
-    "c": "cpp",
-    "c-c++": "cpp",
-    "c-cpp": "cpp",
-    "c#": "csharp",
-    "c++": "cpp",
-    "java-kotlin": "java",
-    "javascript-typescript": "javascript",
-    "kotlin": "java",
-    "typescript": "javascript"
-  }
-}
@@ -1,46 +0,0 @@
-import test from "ava";
-
-import { setupTests } from "../testing-utils";
-
-import knownLanguagesData from "./builtin.json";
-
-import { isBuiltInLanguage, BuiltInLanguage, parseBuiltInLanguage } from ".";
-
-setupTests(test);
-
-test("parseBuiltInLanguage", (t) => {
-  // Exact matches
-  t.is(parseBuiltInLanguage("csharp"), BuiltInLanguage.csharp);
-  t.is(parseBuiltInLanguage("cpp"), BuiltInLanguage.cpp);
-  t.is(parseBuiltInLanguage("go"), BuiltInLanguage.go);
-  t.is(parseBuiltInLanguage("java"), BuiltInLanguage.java);
-  t.is(parseBuiltInLanguage("javascript"), BuiltInLanguage.javascript);
-  t.is(parseBuiltInLanguage("python"), BuiltInLanguage.python);
-  t.is(parseBuiltInLanguage("rust"), BuiltInLanguage.rust);
-
-  // Aliases
-  t.is(parseBuiltInLanguage("  \t\nCsHaRp\t\t"), BuiltInLanguage.csharp);
-  t.is(parseBuiltInLanguage("c"), BuiltInLanguage.cpp);
-  t.is(parseBuiltInLanguage("c++"), BuiltInLanguage.cpp);
-  t.is(parseBuiltInLanguage("kotlin"), BuiltInLanguage.java);
-  t.is(parseBuiltInLanguage("typescript"), BuiltInLanguage.javascript);
-
-  // spaces and case-insensitivity
-  t.is(parseBuiltInLanguage("  \t\nkOtLin\t\t"), BuiltInLanguage.java);
-
-  // Not matches
-  t.is(parseBuiltInLanguage(BuiltInLanguage.python), BuiltInLanguage.python);
-  t.is(parseBuiltInLanguage("foo"), undefined);
-  t.is(parseBuiltInLanguage(" "), undefined);
-  t.is(parseBuiltInLanguage(""), undefined);
-});
-
-test("isBuiltInLanguage matches the curated built-in language set", (t) => {
-  t.true(isBuiltInLanguage(BuiltInLanguage.actions));
-  t.true(isBuiltInLanguage(BuiltInLanguage.swift));
-  t.false(isBuiltInLanguage("typescript"));
-});
-
-test("BuiltInLanguage enum matches builtin.json", (t) => {
-  t.deepEqual(Object.values(BuiltInLanguage), knownLanguagesData.languages);
-});
@@ -1,57 +0,0 @@
-import knownLanguagesData from "./builtin.json";
-
-/** A language to analyze with CodeQL. */
-export type Language = string;
-
-/** A language built into the `defaults.json` CodeQL distribution. */
-export enum BuiltInLanguage {
-  actions = "actions",
-  cpp = "cpp",
-  csharp = "csharp",
-  go = "go",
-  java = "java",
-  javascript = "javascript",
-  python = "python",
-  ruby = "ruby",
-  rust = "rust",
-  swift = "swift",
-}
-
-/** Java-specific environment variable names that we may care about. */
-export enum JavaEnvVars {
-  JAVA_HOME = "JAVA_HOME",
-  JAVA_TOOL_OPTIONS = "JAVA_TOOL_OPTIONS",
-  JDK_JAVA_OPTIONS = "JDK_JAVA_OPTIONS",
-  _JAVA_OPTIONS = "_JAVA_OPTIONS",
-}
-
-const builtInLanguageSet = new Set<string>(knownLanguagesData.languages);
-
-export function isBuiltInLanguage(
-  language: string,
-): language is BuiltInLanguage {
-  return builtInLanguageSet.has(language);
-}
-
-/**
- * Parse a language input corresponding to a built-in language into its canonical CodeQL language
- * name.
- *
- * This uses the language aliases shipped with the Action and will not be able to resolve aliases
- * added by third-party CodeQL language support or versions of the CodeQL CLI newer than the one
- * mentioned in `defaults.json`. Therefore, this function should only be used when the CodeQL CLI is
- * not available.
- */
-export function parseBuiltInLanguage(
-  language: string,
-): BuiltInLanguage | undefined {
-  language = language.trim().toLowerCase();
-  language =
-    knownLanguagesData.aliases[
-      language as keyof typeof knownLanguagesData.aliases
-    ] ?? language;
-  if (isBuiltInLanguage(language)) {
-    return language;
-  }
-  return undefined;
-}
@@ -1,434 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-
-import * as actionsCache from "@actions/cache";
-import test from "ava";
-import * as sinon from "sinon";
-
-import * as actionsUtil from "../actions-util";
-import * as apiClient from "../api-client";
-import type { ResolveDatabaseOutput } from "../codeql";
-import * as gitUtils from "../git-utils";
-import { BuiltInLanguage } from "../languages";
-import { getRunnerLogger } from "../logging";
-import {
-  createTestConfig,
-  makeMacro,
-  mockCodeQLVersion,
-  setupTests,
-} from "../testing-utils";
-import * as utils from "../util";
-import { withTmpDir } from "../util";
-
-import {
-  downloadOverlayBaseDatabaseFromCache,
-  getCacheRestoreKeyPrefix,
-  getCacheSaveKey,
-  getCodeQlVersionsForOverlayBaseDatabases,
-} from "./caching";
-import { OverlayDatabaseMode } from "./overlay-database-mode";
-
-setupTests(test);
-
-interface DownloadOverlayBaseDatabaseTestCase {
-  overlayDatabaseMode: OverlayDatabaseMode;
-  useOverlayDatabaseCaching: boolean;
-  isInTestMode: boolean;
-  restoreCacheResult: string | undefined | Error;
-  hasBaseDatabaseOidsFile: boolean;
-  tryGetFolderBytesSucceeds: boolean;
-  codeQLVersion: string;
-  resolveDatabaseOutput: ResolveDatabaseOutput | Error;
-}
-
-const defaultDownloadTestCase: DownloadOverlayBaseDatabaseTestCase = {
-  overlayDatabaseMode: OverlayDatabaseMode.Overlay,
-  useOverlayDatabaseCaching: true,
-  isInTestMode: false,
-  restoreCacheResult: "cache-key",
-  hasBaseDatabaseOidsFile: true,
-  tryGetFolderBytesSucceeds: true,
-  codeQLVersion: "2.20.5",
-  resolveDatabaseOutput: { overlayBaseSpecifier: "20250626:XXX" },
-};
-
-const testDownloadOverlayBaseDatabaseFromCache = makeMacro({
-  exec: async (
-    t,
-    partialTestCase: Partial<DownloadOverlayBaseDatabaseTestCase>,
-    expectDownloadSuccess: boolean,
-  ) => {
-    await withTmpDir(async (tmpDir) => {
-      const dbLocation = path.join(tmpDir, "db");
-      await fs.promises.mkdir(dbLocation, { recursive: true });
-
-      const logger = getRunnerLogger(true);
-      const testCase = { ...defaultDownloadTestCase, ...partialTestCase };
-      const config = createTestConfig({
-        dbLocation,
-        languages: [BuiltInLanguage.java],
-      });
-
-      config.overlayDatabaseMode = testCase.overlayDatabaseMode;
-      config.useOverlayDatabaseCaching = testCase.useOverlayDatabaseCaching;
-
-      if (testCase.hasBaseDatabaseOidsFile) {
-        const baseDatabaseOidsFile = path.join(
-          dbLocation,
-          "base-database-oids.json",
-        );
-        await fs.promises.writeFile(baseDatabaseOidsFile, JSON.stringify({}));
-      }
-
-      const stubs: sinon.SinonStub[] = [];
-
-      const getAutomationIDStub = sinon
-        .stub(apiClient, "getAutomationID")
-        .resolves("test-automation-id/");
-      stubs.push(getAutomationIDStub);
-
-      const isInTestModeStub = sinon
-        .stub(utils, "isInTestMode")
-        .returns(testCase.isInTestMode);
-      stubs.push(isInTestModeStub);
-
-      if (testCase.restoreCacheResult instanceof Error) {
-        const restoreCacheStub = sinon
-          .stub(actionsCache, "restoreCache")
-          .rejects(testCase.restoreCacheResult);
-        stubs.push(restoreCacheStub);
-      } else {
-        const restoreCacheStub = sinon
-          .stub(actionsCache, "restoreCache")
-          .resolves(testCase.restoreCacheResult);
-        stubs.push(restoreCacheStub);
-      }
-
-      const tryGetFolderBytesStub = sinon
-        .stub(utils, "tryGetFolderBytes")
-        .resolves(testCase.tryGetFolderBytesSucceeds ? 1024 * 1024 : undefined);
-      stubs.push(tryGetFolderBytesStub);
-
-      const codeql = mockCodeQLVersion(testCase.codeQLVersion);
-
-      if (testCase.resolveDatabaseOutput instanceof Error) {
-        const resolveDatabaseStub = sinon
-          .stub(codeql, "resolveDatabase")
-          .rejects(testCase.resolveDatabaseOutput);
-        stubs.push(resolveDatabaseStub);
-      } else {
-        const resolveDatabaseStub = sinon
-          .stub(codeql, "resolveDatabase")
-          .resolves(testCase.resolveDatabaseOutput);
-        stubs.push(resolveDatabaseStub);
-      }
-
-      try {
-        const result = await downloadOverlayBaseDatabaseFromCache(
-          codeql,
-          config,
-          logger,
-        );
-
-        if (expectDownloadSuccess) {
-          t.truthy(result);
-        } else {
-          t.is(result, undefined);
-        }
-      } finally {
-        for (const stub of stubs) {
-          stub.restore();
-        }
-      }
-    });
-  },
-  title: (title) => `downloadOverlayBaseDatabaseFromCache: ${title}`,
-});
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns stats when successful",
-  {},
-  true,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when mode is OverlayDatabaseMode.OverlayBase",
-  {
-    overlayDatabaseMode: OverlayDatabaseMode.OverlayBase,
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when mode is OverlayDatabaseMode.None",
-  {
-    overlayDatabaseMode: OverlayDatabaseMode.None,
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when caching is disabled",
-  {
-    useOverlayDatabaseCaching: false,
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined in test mode",
-  {
-    isInTestMode: true,
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when cache miss",
-  {
-    restoreCacheResult: undefined,
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when download fails",
-  {
-    restoreCacheResult: new Error("Download failed"),
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when downloaded database is invalid",
-  {
-    hasBaseDatabaseOidsFile: false,
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when downloaded database doesn't have an overlayBaseSpecifier",
-  {
-    resolveDatabaseOutput: {},
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when resolving database metadata fails",
-  {
-    resolveDatabaseOutput: new Error("Failed to resolve database metadata"),
-  },
-  false,
-);
-
-testDownloadOverlayBaseDatabaseFromCache.serial(
-  "returns undefined when filesystem error occurs",
-  {
-    tryGetFolderBytesSucceeds: false,
-  },
-  false,
-);
-
-test.serial("overlay-base database cache keys remain stable", async (t) => {
-  const logger = getRunnerLogger(true);
-  const config = createTestConfig({ languages: ["python", "javascript"] });
-  const codeQlVersion = "2.23.0";
-  const commitOid = "abc123def456";
-
-  sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-  sinon.stub(gitUtils, "getCommitOid").resolves(commitOid);
-  sinon.stub(actionsUtil, "getWorkflowRunID").returns(12345);
-  sinon.stub(actionsUtil, "getWorkflowRunAttempt").returns(1);
-
-  const saveKey = await getCacheSaveKey(
-    config,
-    codeQlVersion,
-    "checkout-path",
-    logger,
-  );
-  const expectedSaveKey =
-    "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-abc123def456-12345-1";
-  t.is(
-    saveKey,
-    expectedSaveKey,
-    "Cache save key changed unexpectedly. " +
-      "This may indicate breaking changes in the cache key generation logic.",
-  );
-
-  const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
-    config,
-    codeQlVersion,
-  );
-  const expectedRestoreKeyPrefix =
-    "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-";
-  t.is(
-    restoreKeyPrefix,
-    expectedRestoreKeyPrefix,
-    "Cache restore key prefix changed unexpectedly. " +
-      "This may indicate breaking changes in the cache key generation logic.",
-  );
-
-  t.true(
-    saveKey.startsWith(restoreKeyPrefix),
-    `Expected save key "${saveKey}" to start with restore key prefix "${restoreKeyPrefix}"`,
-  );
-});
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases returns unique versions sorted latest first",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    sinon.stub(apiClient, "listActionsCaches").resolves([
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-abc123-1-1",
-      },
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.24.1-def456-2-1",
-      },
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-ghi789-3-1",
-      },
-    ]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["javascript", "python"],
-      logger,
-    );
-    t.deepEqual(result, ["2.24.1", "2.23.0"]);
-  },
-);
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases returns empty list when no caches exist",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    sinon.stub(apiClient, "listActionsCaches").resolves([]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["python"],
-      logger,
-    );
-    t.deepEqual(result, []);
-  },
-);
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases returns empty list when cache keys are unparseable",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    sinon.stub(apiClient, "listActionsCaches").resolves([
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-malformed",
-      },
-      { key: undefined },
-    ]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["python"],
-      logger,
-    );
-    t.deepEqual(result, []);
-  },
-);
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases returns the single version when only one cache exists",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    sinon.stub(apiClient, "listActionsCaches").resolves([
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-cpp-2.25.0-abc123-1-1",
-      },
-    ]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["cpp"],
-      logger,
-    );
-    t.deepEqual(result, ["2.25.0"]);
-  },
-);
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases resolves language aliases",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-    // The alias `c++` should be resolved to "cpp" and match cache entries keyed with "cpp"
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    sinon.stub(apiClient, "listActionsCaches").resolves([
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-cpp-2.25.0-abc123-1-1",
-      },
-    ]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["c++"],
-      logger,
-    );
-    t.deepEqual(result, ["2.25.0"]);
-  },
-);
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases de-duplicates resolved language aliases",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    const listActionsCachesStub = sinon
-      .stub(apiClient, "listActionsCaches")
-      .resolves([
-        {
-          key: "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.25.0-abc123-1-1",
-        },
-      ]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["javascript", "typescript", "Python", "python"],
-      logger,
-    );
-    t.deepEqual(result, ["2.25.0"]);
-    sinon.assert.calledOnceWithExactly(
-      listActionsCachesStub,
-      "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-",
-    );
-  },
-);
-
-test.serial(
-  "getCodeQlVersionsForOverlayBaseDatabases ignores nightly versions with build metadata",
-  async (t) => {
-    const logger = getRunnerLogger(true);
-
-    sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
-    sinon.stub(apiClient, "listActionsCaches").resolves([
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-2.25.0-abc123-1-1",
-      },
-      {
-        // Nightly release with semver build metadata; should be ignored.
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-2.26.0+202604211234-def456-2-1",
-      },
-      {
-        key: "codeql-overlay-base-database-1-c5666c509a2d9895-python-2.24.0-ghi789-3-1",
-      },
-    ]);
-
-    const result = await getCodeQlVersionsForOverlayBaseDatabases(
-      ["python"],
-      logger,
-    );
-    t.deepEqual(result, ["2.25.0", "2.24.0"]);
-  },
-);
@@ -1,521 +0,0 @@
-import * as fs from "fs";
-
-import * as actionsCache from "@actions/cache";
-import * as semver from "semver";
-
-import {
-  getRequiredInput,
-  getWorkflowRunAttempt,
-  getWorkflowRunID,
-} from "../actions-util";
-import { getAutomationID, listActionsCaches } from "../api-client";
-import { createCacheKeyHash } from "../caching-utils";
-import { type CodeQL } from "../codeql";
-import { type Config } from "../config-utils";
-import { getCommitOid } from "../git-utils";
-import { type Language, parseBuiltInLanguage } from "../languages";
-import { type Logger, withGroupAsync } from "../logging";
-import {
-  CleanupLevel,
-  getBaseDatabaseOidsFilePath,
-  getCodeQLDatabasePath,
-  getErrorMessage,
-  isInTestMode,
-  tryGetFolderBytes,
-  waitForResultWithTimeLimit,
-} from "../util";
-
-import { OverlayDatabaseMode } from "./overlay-database-mode";
-
-/**
- * The maximum (uncompressed) size of the overlay base database that we will
- * upload. By default, the Actions Cache has an overall capacity of 10 GB, and
- * the Actions Cache client library uses zstd compression.
- *
- * Ideally we would apply a size limit to the compressed overlay-base database,
- * but we cannot do so because compression is handled transparently by the
- * Actions Cache client library. Instead we place a limit on the uncompressed
- * size of the overlay-base database.
- *
- * Assuming 2.5:1 compression ratio, the 7.5 GB limit on uncompressed data would
- * translate to a limit of around 3 GB after compression.
- */
-const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
-const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES =
-  OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1_000_000;
-
-// Constants for database caching
-const CACHE_VERSION = 1;
-const CACHE_PREFIX = "codeql-overlay-base-database";
-
-// The purpose of this ten-minute limit is to guard against the possibility
-// that the cache service is unresponsive, which would otherwise cause the
-// entire action to hang.  Normally we expect cache operations to complete
-// within two minutes.
-const MAX_CACHE_OPERATION_MS = 600_000;
-
-/**
- * Checks that the overlay-base database is valid by checking for the
- * existence of the base database OIDs file.
- *
- * @param config The configuration object
- * @param logger The logger instance
- * @param warningPrefix Prefix for the check failure warning message
- * @returns True if the verification succeeded, false otherwise
- */
-async function checkOverlayBaseDatabase(
-  codeql: CodeQL,
-  config: Config,
-  logger: Logger,
-  warningPrefix: string,
-): Promise<boolean> {
-  // An overlay-base database should contain the base database OIDs file.
-  const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config);
-  if (!fs.existsSync(baseDatabaseOidsFilePath)) {
-    logger.warning(
-      `${warningPrefix}: ${baseDatabaseOidsFilePath} does not exist`,
-    );
-    return false;
-  }
-
-  for (const language of config.languages) {
-    const dbPath = getCodeQLDatabasePath(config, language);
-    try {
-      const resolveDatabaseOutput = await codeql.resolveDatabase(dbPath);
-      if (
-        resolveDatabaseOutput === undefined ||
-        !("overlayBaseSpecifier" in resolveDatabaseOutput)
-      ) {
-        logger.info(`${warningPrefix}: no overlayBaseSpecifier defined`);
-        return false;
-      } else {
-        logger.debug(
-          `Overlay base specifier for ${language} overlay-base database found: ` +
-            `${resolveDatabaseOutput.overlayBaseSpecifier}`,
-        );
-      }
-    } catch (e) {
-      logger.warning(`${warningPrefix}: failed to resolve database: ${e}`);
-      return false;
-    }
-  }
-
-  return true;
-}
-
-/**
- * Uploads the overlay-base database to the GitHub Actions cache. If conditions
- * for uploading are not met, the function does nothing and returns false.
- *
- * This function uses the `checkout_path` input to determine the repository path
- * and works only when called from `analyze` or `upload-sarif`.
- *
- * @param codeql The CodeQL instance
- * @param config The configuration object
- * @param logger The logger instance
- * @returns A promise that resolves to true if the upload was performed and
- * successfully completed, or false otherwise
- */
-export async function cleanupAndUploadOverlayBaseDatabaseToCache(
-  codeql: CodeQL,
-  config: Config,
-  logger: Logger,
-): Promise<boolean> {
-  const overlayDatabaseMode = config.overlayDatabaseMode;
-  if (overlayDatabaseMode !== OverlayDatabaseMode.OverlayBase) {
-    logger.debug(
-      `Overlay database mode is ${overlayDatabaseMode}. ` +
-        "Skip uploading overlay-base database to cache.",
-    );
-    return false;
-  }
-  if (!config.useOverlayDatabaseCaching) {
-    logger.debug(
-      "Overlay database caching is disabled. " +
-        "Skip uploading overlay-base database to cache.",
-    );
-    return false;
-  }
-  if (isInTestMode()) {
-    logger.debug(
-      "In test mode. Skip uploading overlay-base database to cache.",
-    );
-    return false;
-  }
-
-  const databaseIsValid = await checkOverlayBaseDatabase(
-    codeql,
-    config,
-    logger,
-    "Abort uploading overlay-base database to cache",
-  );
-  if (!databaseIsValid) {
-    return false;
-  }
-
-  // Clean up the database using the overlay cleanup level.
-  await withGroupAsync("Cleaning up databases", async () => {
-    await codeql.databaseCleanupCluster(config, CleanupLevel.Overlay);
-  });
-
-  const dbLocation = config.dbLocation;
-
-  const databaseSizeBytes = await tryGetFolderBytes(dbLocation, logger);
-  if (databaseSizeBytes === undefined) {
-    logger.warning(
-      "Failed to determine database size. " +
-        "Skip uploading overlay-base database to cache.",
-    );
-    return false;
-  }
-
-  if (databaseSizeBytes > OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES) {
-    const databaseSizeMB = Math.round(databaseSizeBytes / 1_000_000);
-    logger.warning(
-      `Database size (${databaseSizeMB} MB) ` +
-        `exceeds maximum upload size (${OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB} MB). ` +
-        "Skip uploading overlay-base database to cache.",
-    );
-    return false;
-  }
-
-  const codeQlVersion = (await codeql.getVersion()).version;
-  const checkoutPath = getRequiredInput("checkout_path");
-  const cacheSaveKey = await getCacheSaveKey(
-    config,
-    codeQlVersion,
-    checkoutPath,
-    logger,
-  );
-  logger.info(
-    `Uploading overlay-base database to Actions cache with key ${cacheSaveKey}`,
-  );
-
-  try {
-    const cacheId = await waitForResultWithTimeLimit(
-      MAX_CACHE_OPERATION_MS,
-      actionsCache.saveCache([dbLocation], cacheSaveKey),
-      () => {},
-    );
-    if (cacheId === undefined) {
-      logger.warning("Timed out while uploading overlay-base database");
-      return false;
-    }
-  } catch (error) {
-    logger.warning(
-      "Failed to upload overlay-base database to cache: " +
-        `${error instanceof Error ? error.message : String(error)}`,
-    );
-    return false;
-  }
-  logger.info(`Successfully uploaded overlay-base database from ${dbLocation}`);
-  return true;
-}
-
-export interface OverlayBaseDatabaseDownloadStats {
-  databaseSizeBytes: number;
-  databaseDownloadDurationMs: number;
-}
-
-/**
- * Downloads the overlay-base database from the GitHub Actions cache. If conditions
- * for downloading are not met, the function does nothing and returns false.
- *
- * @param codeql The CodeQL instance
- * @param config The configuration object
- * @param logger The logger instance
- * @returns A promise that resolves to download statistics if an overlay-base
- * database was successfully downloaded, or undefined if the download was
- * either not performed or failed.
- */
-export async function downloadOverlayBaseDatabaseFromCache(
-  codeql: CodeQL,
-  config: Config,
-  logger: Logger,
-): Promise<OverlayBaseDatabaseDownloadStats | undefined> {
-  const overlayDatabaseMode = config.overlayDatabaseMode;
-  if (overlayDatabaseMode !== OverlayDatabaseMode.Overlay) {
-    logger.debug(
-      `Overlay database mode is ${overlayDatabaseMode}. ` +
-        "Skip downloading overlay-base database from cache.",
-    );
-    return undefined;
-  }
-  if (!config.useOverlayDatabaseCaching) {
-    logger.debug(
-      "Overlay database caching is disabled. " +
-        "Skip downloading overlay-base database from cache.",
-    );
-    return undefined;
-  }
-  if (isInTestMode()) {
-    logger.debug(
-      "In test mode. Skip downloading overlay-base database from cache.",
-    );
-    return undefined;
-  }
-
-  const dbLocation = config.dbLocation;
-  const codeQlVersion = (await codeql.getVersion()).version;
-  const cacheRestoreKeyPrefix = await getCacheRestoreKeyPrefix(
-    config,
-    codeQlVersion,
-  );
-
-  logger.info(
-    "Looking in Actions cache for overlay-base database with " +
-      `restore key ${cacheRestoreKeyPrefix}`,
-  );
-
-  let databaseDownloadDurationMs = 0;
-  try {
-    const databaseDownloadStart = performance.now();
-    const foundKey = await waitForResultWithTimeLimit(
-      // This ten-minute limit for the cache restore operation is mainly to
-      // guard against the possibility that the cache service is unresponsive
-      // and hangs outside the data download.
-      //
-      // Data download (which is normally the most time-consuming part of the
-      // restore operation) should not run long enough to hit this limit. Even
-      // for an extremely large 10GB database, at a download speed of 40MB/s
-      // (see below), the download should complete within five minutes. If we
-      // do hit this limit, there are likely more serious problems other than
-      // mere slow download speed.
-      //
-      // This is important because we don't want any ongoing file operations
-      // on the database directory when we do hit this limit. Hitting this
-      // time limit takes us to a fallback path where we re-initialize the
-      // database from scratch at dbLocation, and having the cache restore
-      // operation continue to write into dbLocation in the background would
-      // really mess things up. We want to hit this limit only in the case
-      // of a hung cache service, not just slow download speed.
-      MAX_CACHE_OPERATION_MS,
-      actionsCache.restoreCache(
-        [dbLocation],
-        cacheRestoreKeyPrefix,
-        undefined,
-        {
-          // Azure SDK download (which is the default) uses 128MB segments; see
-          // https://github.com/actions/toolkit/blob/main/packages/cache/README.md.
-          // Setting segmentTimeoutInMs to 3000 translates to segment download
-          // speed of about 40 MB/s, which should be achievable unless the
-          // download is unreliable (in which case we do want to abort).
-          segmentTimeoutInMs: 3000,
-        },
-      ),
-      () => {
-        logger.info("Timed out downloading overlay-base database from cache");
-      },
-    );
-    databaseDownloadDurationMs = Math.round(
-      performance.now() - databaseDownloadStart,
-    );
-
-    if (foundKey === undefined) {
-      logger.info("No overlay-base database found in Actions cache");
-      return undefined;
-    }
-
-    logger.info(
-      `Downloaded overlay-base database in cache with key ${foundKey}`,
-    );
-  } catch (error) {
-    logger.warning(
-      "Failed to download overlay-base database from cache: " +
-        `${error instanceof Error ? error.message : String(error)}`,
-    );
-    return undefined;
-  }
-
-  const databaseIsValid = await checkOverlayBaseDatabase(
-    codeql,
-    config,
-    logger,
-    "Downloaded overlay-base database is invalid",
-  );
-  if (!databaseIsValid) {
-    logger.warning("Downloaded overlay-base database failed validation");
-    return undefined;
-  }
-
-  const databaseSizeBytes = await tryGetFolderBytes(dbLocation, logger);
-  if (databaseSizeBytes === undefined) {
-    logger.info(
-      "Filesystem error while accessing downloaded overlay-base database",
-    );
-    // The problem that warrants reporting download failure is not that we are
-    // unable to determine the size of the database. Rather, it is that we
-    // encountered a filesystem error while accessing the database, which
-    // indicates that an overlay analysis will likely fail.
-    return undefined;
-  }
-
-  logger.info(`Successfully downloaded overlay-base database to ${dbLocation}`);
-  return {
-    databaseSizeBytes: Math.round(databaseSizeBytes),
-    databaseDownloadDurationMs,
-  };
-}
-
-/**
- * Computes the cache key for saving the overlay-base database to the GitHub
- * Actions cache.
- *
- * The key consists of the restore key prefix (which does not include the
- * commit SHA) and the commit SHA of the current checkout.
- */
-export async function getCacheSaveKey(
-  config: Config,
-  codeQlVersion: string,
-  checkoutPath: string,
-  logger: Logger,
-): Promise<string> {
-  let runId = 1;
-  let attemptId = 1;
-  try {
-    runId = getWorkflowRunID();
-    attemptId = getWorkflowRunAttempt();
-  } catch (e) {
-    logger.warning(
-      `Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}`,
-    );
-  }
-  const sha = await getCommitOid(checkoutPath);
-  const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
-    config,
-    codeQlVersion,
-  );
-  return `${restoreKeyPrefix}${sha}-${runId}-${attemptId}`;
-}
-
-/**
- * Computes the cache key prefix for restoring the overlay-base database from
- * the GitHub Actions cache.
- *
- * Actions cache supports using multiple restore keys to indicate preference,
- * and this function could in principle take advantage of that feature by
- * returning a list of restore key prefixes. However, since overlay-base
- * databases are built from the default branch and used in PR analysis, it is
- * exceedingly unlikely that the commit SHA will ever be the same.
- *
- * Therefore, this function returns only a single restore key prefix, which does
- * not include the commit SHA. This allows us to restore the most recent
- * compatible overlay-base database.
- */
-export async function getCacheRestoreKeyPrefix(
-  config: Config,
-  codeQlVersion: string,
-): Promise<string> {
-  return `${await getCacheKeyPrefixBase(config.languages)}${codeQlVersion}-`;
-}
-
-/**
- * Computes the cache key prefix for overlay-base databases, excluding the
- * CodeQL version.
- */
-async function getCacheKeyPrefixBase(
-  parsedLanguages: Language[],
-): Promise<string> {
-  const languagesComponent = [...parsedLanguages].sort().join("_");
-
-  const cacheKeyComponents = {
-    automationID: await getAutomationID(),
-    // Add more components here as needed in the future
-  };
-  const componentsHash = createCacheKeyHash(cacheKeyComponents);
-
-  // CACHE_PREFIX: distinguishes overlay-base databases from other cache objects
-  // CACHE_VERSION: cache format version
-  // componentsHash: hash of additional components (see above for details)
-  // languagesComponent: the languages included in the overlay-base database
-  //
-  // Technically we can also include languages in the componentsHash, but
-  // including them explicitly in the cache key makes it easier to debug and
-  // understand the cache key structure.
-  return `${CACHE_PREFIX}-${CACHE_VERSION}-${componentsHash}-${languagesComponent}-`;
-}
-
-/**
- * Searches the GitHub Actions cache for overlay-base databases matching the given languages, and
- * returns all stable CodeQL versions found across matching cache entries.
- *
- * Note that we do not guarantee that the cache entry for these versions of CodeQL will still be
- * present by the time we attempt to restore the cache. We could achieve that with a download retry
- * loop, but we expect that if there is sufficient Actions cache contention that an overlay-base
- * cache entry for a particular CodeQL version is evicted before we can use it, then it is likely
- * that the same thing will happen to other overlay-base cache entries, and therefore we will not be
- * able to use overlay.
- *
- * @returns Unique stable CodeQL versions found in cached overlay-base databases, sorted from latest to
- * earliest, or undefined if one of the languages is not a built-in language.
- */
-export async function getCodeQlVersionsForOverlayBaseDatabases(
-  rawLanguages: string[],
-  logger: Logger,
-): Promise<string[] | undefined> {
-  const languages = rawLanguages.map(parseBuiltInLanguage);
-  if (languages.includes(undefined)) {
-    logger.warning(
-      "One or more provided languages are not recognized as built-in languages. " +
-        "Skipping searching for overlay-base databases in cache.",
-    );
-    return undefined;
-  }
-  const dedupedLanguages = [
-    ...new Set(languages.filter((l) => l !== undefined)),
-  ];
-  const cacheKeyPrefix = await getCacheKeyPrefixBase(dedupedLanguages);
-
-  logger.debug(
-    `Searching for overlay-base databases in Actions cache with ` +
-      `prefix ${cacheKeyPrefix}`,
-  );
-
-  const caches = await listActionsCaches(cacheKeyPrefix);
-
-  if (caches.length === 0) {
-    logger.info("No overlay-base databases found in Actions cache.");
-    return [];
-  }
-
-  logger.info(
-    `Found ${caches.length} overlay-base ` +
-      `${caches.length === 1 ? "database" : "databases"} in the Actions cache.`,
-  );
-
-  // Parse CodeQL versions from cache keys, matching only stable releases.
-  //
-  // After the prefix, the remaining key format starts with `${codeQlVersion}-`. Nightlies will have
-  // a suffix like `+202604201548` that will break the match.
-  //
-  // Caveat: this relies on the fact that we haven't released any CodeQL bundles with the
-  // `x.y.z-<pre-release>` semver format which does not interact well with the current overlay base
-  // DB cache key format.
-  const versionRegex = /^([\d.]+)-/;
-  const versionSet = new Set<string>();
-
-  for (const cache of caches) {
-    if (!cache.key) continue;
-    const suffix = cache.key.substring(cacheKeyPrefix.length);
-    const match = suffix.match(versionRegex);
-    if (match && semver.valid(match[1])) {
-      versionSet.add(match[1]);
-    }
-  }
-
-  if (versionSet.size === 0) {
-    logger.info(
-      "Could not parse any CodeQL versions from overlay-base database " +
-        "cache keys.",
-    );
-    return [];
-  }
-
-  const versions = [...versionSet].sort(semver.rcompare);
-
-  logger.info(
-    `Found overlay databases for the following CodeQL versions in the Actions cache: ${versions.join(", ")}`,
-  );
-
-  return versions;
-}
@@ -1,16 +1,32 @@
 import * as fs from "fs";
 import * as path from "path";

+import * as actionsCache from "@actions/cache";
 import test from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "../actions-util";
+import * as apiClient from "../api-client";
+import { ResolveDatabaseOutput } from "../codeql";
 import * as gitUtils from "../git-utils";
+import { KnownLanguage } from "../languages";
 import { getRunnerLogger } from "../logging";
-import { createTestConfig, setupTests } from "../testing-utils";
+import {
+  createTestConfig,
+  mockCodeQLVersion,
+  setupTests,
+} from "../testing-utils";
+import * as utils from "../util";
 import { withTmpDir } from "../util";

-import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from ".";
+import {
+  downloadOverlayBaseDatabaseFromCache,
+  getCacheRestoreKeyPrefix,
+  getCacheSaveKey,
+  OverlayDatabaseMode,
+  writeBaseDatabaseOidsFile,
+  writeOverlayChangesFile,
+} from ".";

 setupTests(test);

@@ -328,3 +344,261 @@ test.serial(
    });
  },
 );
+
+interface DownloadOverlayBaseDatabaseTestCase {
+  overlayDatabaseMode: OverlayDatabaseMode;
+  useOverlayDatabaseCaching: boolean;
+  isInTestMode: boolean;
+  restoreCacheResult: string | undefined | Error;
+  hasBaseDatabaseOidsFile: boolean;
+  tryGetFolderBytesSucceeds: boolean;
+  codeQLVersion: string;
+  resolveDatabaseOutput: ResolveDatabaseOutput | Error;
+}
+
+const defaultDownloadTestCase: DownloadOverlayBaseDatabaseTestCase = {
+  overlayDatabaseMode: OverlayDatabaseMode.Overlay,
+  useOverlayDatabaseCaching: true,
+  isInTestMode: false,
+  restoreCacheResult: "cache-key",
+  hasBaseDatabaseOidsFile: true,
+  tryGetFolderBytesSucceeds: true,
+  codeQLVersion: "2.20.5",
+  resolveDatabaseOutput: { overlayBaseSpecifier: "20250626:XXX" },
+};
+
+const testDownloadOverlayBaseDatabaseFromCache = test.macro({
+  exec: async (
+    t,
+    _title: string,
+    partialTestCase: Partial<DownloadOverlayBaseDatabaseTestCase>,
+    expectDownloadSuccess: boolean,
+  ) => {
+    await withTmpDir(async (tmpDir) => {
+      const dbLocation = path.join(tmpDir, "db");
+      await fs.promises.mkdir(dbLocation, { recursive: true });
+
+      const logger = getRunnerLogger(true);
+      const testCase = { ...defaultDownloadTestCase, ...partialTestCase };
+      const config = createTestConfig({
+        dbLocation,
+        languages: [KnownLanguage.java],
+      });
+
+      config.overlayDatabaseMode = testCase.overlayDatabaseMode;
+      config.useOverlayDatabaseCaching = testCase.useOverlayDatabaseCaching;
+
+      if (testCase.hasBaseDatabaseOidsFile) {
+        const baseDatabaseOidsFile = path.join(
+          dbLocation,
+          "base-database-oids.json",
+        );
+        await fs.promises.writeFile(baseDatabaseOidsFile, JSON.stringify({}));
+      }
+
+      const stubs: sinon.SinonStub[] = [];
+
+      const getAutomationIDStub = sinon
+        .stub(apiClient, "getAutomationID")
+        .resolves("test-automation-id/");
+      stubs.push(getAutomationIDStub);
+
+      const isInTestModeStub = sinon
+        .stub(utils, "isInTestMode")
+        .returns(testCase.isInTestMode);
+      stubs.push(isInTestModeStub);
+
+      if (testCase.restoreCacheResult instanceof Error) {
+        const restoreCacheStub = sinon
+          .stub(actionsCache, "restoreCache")
+          .rejects(testCase.restoreCacheResult);
+        stubs.push(restoreCacheStub);
+      } else {
+        const restoreCacheStub = sinon
+          .stub(actionsCache, "restoreCache")
+          .resolves(testCase.restoreCacheResult);
+        stubs.push(restoreCacheStub);
+      }
+
+      const tryGetFolderBytesStub = sinon
+        .stub(utils, "tryGetFolderBytes")
+        .resolves(testCase.tryGetFolderBytesSucceeds ? 1024 * 1024 : undefined);
+      stubs.push(tryGetFolderBytesStub);
+
+      const codeql = mockCodeQLVersion(testCase.codeQLVersion);
+
+      if (testCase.resolveDatabaseOutput instanceof Error) {
+        const resolveDatabaseStub = sinon
+          .stub(codeql, "resolveDatabase")
+          .rejects(testCase.resolveDatabaseOutput);
+        stubs.push(resolveDatabaseStub);
+      } else {
+        const resolveDatabaseStub = sinon
+          .stub(codeql, "resolveDatabase")
+          .resolves(testCase.resolveDatabaseOutput);
+        stubs.push(resolveDatabaseStub);
+      }
+
+      try {
+        const result = await downloadOverlayBaseDatabaseFromCache(
+          codeql,
+          config,
+          logger,
+        );
+
+        if (expectDownloadSuccess) {
+          t.truthy(result);
+        } else {
+          t.is(result, undefined);
+        }
+      } finally {
+        for (const stub of stubs) {
+          stub.restore();
+        }
+      }
+    });
+  },
+  title: (_, title) => `downloadOverlayBaseDatabaseFromCache: ${title}`,
+});
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns stats when successful",
+  {},
+  true,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when mode is OverlayDatabaseMode.OverlayBase",
+  {
+    overlayDatabaseMode: OverlayDatabaseMode.OverlayBase,
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when mode is OverlayDatabaseMode.None",
+  {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when caching is disabled",
+  {
+    useOverlayDatabaseCaching: false,
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined in test mode",
+  {
+    isInTestMode: true,
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when cache miss",
+  {
+    restoreCacheResult: undefined,
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when download fails",
+  {
+    restoreCacheResult: new Error("Download failed"),
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when downloaded database is invalid",
+  {
+    hasBaseDatabaseOidsFile: false,
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when downloaded database doesn't have an overlayBaseSpecifier",
+  {
+    resolveDatabaseOutput: {},
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when resolving database metadata fails",
+  {
+    resolveDatabaseOutput: new Error("Failed to resolve database metadata"),
+  },
+  false,
+);
+
+test.serial(
+  testDownloadOverlayBaseDatabaseFromCache,
+  "returns undefined when filesystem error occurs",
+  {
+    tryGetFolderBytesSucceeds: false,
+  },
+  false,
+);
+
+test.serial("overlay-base database cache keys remain stable", async (t) => {
+  const logger = getRunnerLogger(true);
+  const config = createTestConfig({ languages: ["python", "javascript"] });
+  const codeQlVersion = "2.23.0";
+  const commitOid = "abc123def456";
+
+  sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");
+  sinon.stub(gitUtils, "getCommitOid").resolves(commitOid);
+  sinon.stub(actionsUtil, "getWorkflowRunID").returns(12345);
+  sinon.stub(actionsUtil, "getWorkflowRunAttempt").returns(1);
+
+  const saveKey = await getCacheSaveKey(
+    config,
+    codeQlVersion,
+    "checkout-path",
+    logger,
+  );
+  const expectedSaveKey =
+    "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-abc123def456-12345-1";
+  t.is(
+    saveKey,
+    expectedSaveKey,
+    "Cache save key changed unexpectedly. " +
+      "This may indicate breaking changes in the cache key generation logic.",
+  );
+
+  const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
+    config,
+    codeQlVersion,
+  );
+  const expectedRestoreKeyPrefix =
+    "codeql-overlay-base-database-1-c5666c509a2d9895-javascript_python-2.23.0-";
+  t.is(
+    restoreKeyPrefix,
+    expectedRestoreKeyPrefix,
+    "Cache restore key prefix changed unexpectedly. " +
+      "This may indicate breaking changes in the cache key generation logic.",
+  );
+
+  t.true(
+    saveKey.startsWith(restoreKeyPrefix),
+    `Expected save key "${saveKey}" to start with restore key prefix "${restoreKeyPrefix}"`,
+  );
+});
@@ -1,12 +1,37 @@
 import * as fs from "fs";
 import * as path from "path";

+import * as actionsCache from "@actions/cache";
+
 import * as actionsUtil from "../actions-util";
-import { getOptionalInput, getTemporaryDirectory } from "../actions-util";
+import {
+  getOptionalInput,
+  getRequiredInput,
+  getTemporaryDirectory,
+  getWorkflowRunAttempt,
+  getWorkflowRunID,
+} from "../actions-util";
+import { getAutomationID } from "../api-client";
+import { createCacheKeyHash } from "../caching-utils";
+import { type CodeQL } from "../codeql";
 import { type Config } from "../config-utils";
-import { getFileOidsUnderPath, getGitRoot } from "../git-utils";
-import { Logger } from "../logging";
-import { getBaseDatabaseOidsFilePath } from "../util";
+import { getCommitOid, getFileOidsUnderPath, getGitRoot } from "../git-utils";
+import { Logger, withGroupAsync } from "../logging";
+import {
+  CleanupLevel,
+  getBaseDatabaseOidsFilePath,
+  getCodeQLDatabasePath,
+  getErrorMessage,
+  isInTestMode,
+  tryGetFolderBytes,
+  waitForResultWithTimeLimit,
+} from "../util";
+
+export enum OverlayDatabaseMode {
+  Overlay = "overlay",
+  OverlayBase = "overlay-base",
+  None = "none",
+}

 export const CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";

@@ -20,6 +45,23 @@ export const CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
 export const CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
 export const CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";

+/**
+ * The maximum (uncompressed) size of the overlay base database that we will
+ * upload. By default, the Actions Cache has an overall capacity of 10 GB, and
+ * the Actions Cache client library uses zstd compression.
+ *
+ * Ideally we would apply a size limit to the compressed overlay-base database,
+ * but we cannot do so because compression is handled transparently by the
+ * Actions Cache client library. Instead we place a limit on the uncompressed
+ * size of the overlay-base database.
+ *
+ * Assuming 2.5:1 compression ratio, the 7.5 GB limit on uncompressed data would
+ * translate to a limit of around 3 GB after compression.
+ */
+const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
+const OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES =
+  OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1_000_000;
+
 /**
 * Writes a JSON file containing Git OIDs for all tracked files (represented
 * by path relative to the source root) under the source root. The file is
@@ -193,3 +235,388 @@ async function getDiffRangeFilePaths(
    .filter((rel) => !rel.startsWith(".."));
  return [...new Set(relativePaths)];
 }
+
+// Constants for database caching
+const CACHE_VERSION = 1;
+const CACHE_PREFIX = "codeql-overlay-base-database";
+
+// The purpose of this ten-minute limit is to guard against the possibility
+// that the cache service is unresponsive, which would otherwise cause the
+// entire action to hang.  Normally we expect cache operations to complete
+// within two minutes.
+const MAX_CACHE_OPERATION_MS = 600_000;
+
+/**
+ * Checks that the overlay-base database is valid by checking for the
+ * existence of the base database OIDs file.
+ *
+ * @param config The configuration object
+ * @param logger The logger instance
+ * @param warningPrefix Prefix for the check failure warning message
+ * @returns True if the verification succeeded, false otherwise
+ */
+async function checkOverlayBaseDatabase(
+  codeql: CodeQL,
+  config: Config,
+  logger: Logger,
+  warningPrefix: string,
+): Promise<boolean> {
+  // An overlay-base database should contain the base database OIDs file.
+  const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config);
+  if (!fs.existsSync(baseDatabaseOidsFilePath)) {
+    logger.warning(
+      `${warningPrefix}: ${baseDatabaseOidsFilePath} does not exist`,
+    );
+    return false;
+  }
+
+  for (const language of config.languages) {
+    const dbPath = getCodeQLDatabasePath(config, language);
+    try {
+      const resolveDatabaseOutput = await codeql.resolveDatabase(dbPath);
+      if (
+        resolveDatabaseOutput === undefined ||
+        !("overlayBaseSpecifier" in resolveDatabaseOutput)
+      ) {
+        logger.info(`${warningPrefix}: no overlayBaseSpecifier defined`);
+        return false;
+      } else {
+        logger.debug(
+          `Overlay base specifier for ${language} overlay-base database found: ` +
+            `${resolveDatabaseOutput.overlayBaseSpecifier}`,
+        );
+      }
+    } catch (e) {
+      logger.warning(`${warningPrefix}: failed to resolve database: ${e}`);
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Uploads the overlay-base database to the GitHub Actions cache. If conditions
+ * for uploading are not met, the function does nothing and returns false.
+ *
+ * This function uses the `checkout_path` input to determine the repository path
+ * and works only when called from `analyze` or `upload-sarif`.
+ *
+ * @param codeql The CodeQL instance
+ * @param config The configuration object
+ * @param logger The logger instance
+ * @returns A promise that resolves to true if the upload was performed and
+ * successfully completed, or false otherwise
+ */
+export async function cleanupAndUploadOverlayBaseDatabaseToCache(
+  codeql: CodeQL,
+  config: Config,
+  logger: Logger,
+): Promise<boolean> {
+  const overlayDatabaseMode = config.overlayDatabaseMode;
+  if (overlayDatabaseMode !== OverlayDatabaseMode.OverlayBase) {
+    logger.debug(
+      `Overlay database mode is ${overlayDatabaseMode}. ` +
+        "Skip uploading overlay-base database to cache.",
+    );
+    return false;
+  }
+  if (!config.useOverlayDatabaseCaching) {
+    logger.debug(
+      "Overlay database caching is disabled. " +
+        "Skip uploading overlay-base database to cache.",
+    );
+    return false;
+  }
+  if (isInTestMode()) {
+    logger.debug(
+      "In test mode. Skip uploading overlay-base database to cache.",
+    );
+    return false;
+  }
+
+  const databaseIsValid = await checkOverlayBaseDatabase(
+    codeql,
+    config,
+    logger,
+    "Abort uploading overlay-base database to cache",
+  );
+  if (!databaseIsValid) {
+    return false;
+  }
+
+  // Clean up the database using the overlay cleanup level.
+  await withGroupAsync("Cleaning up databases", async () => {
+    await codeql.databaseCleanupCluster(config, CleanupLevel.Overlay);
+  });
+
+  const dbLocation = config.dbLocation;
+
+  const databaseSizeBytes = await tryGetFolderBytes(dbLocation, logger);
+  if (databaseSizeBytes === undefined) {
+    logger.warning(
+      "Failed to determine database size. " +
+        "Skip uploading overlay-base database to cache.",
+    );
+    return false;
+  }
+
+  if (databaseSizeBytes > OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES) {
+    const databaseSizeMB = Math.round(databaseSizeBytes / 1_000_000);
+    logger.warning(
+      `Database size (${databaseSizeMB} MB) ` +
+        `exceeds maximum upload size (${OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB} MB). ` +
+        "Skip uploading overlay-base database to cache.",
+    );
+    return false;
+  }
+
+  const codeQlVersion = (await codeql.getVersion()).version;
+  const checkoutPath = getRequiredInput("checkout_path");
+  const cacheSaveKey = await getCacheSaveKey(
+    config,
+    codeQlVersion,
+    checkoutPath,
+    logger,
+  );
+  logger.info(
+    `Uploading overlay-base database to Actions cache with key ${cacheSaveKey}`,
+  );
+
+  try {
+    const cacheId = await waitForResultWithTimeLimit(
+      MAX_CACHE_OPERATION_MS,
+      actionsCache.saveCache([dbLocation], cacheSaveKey),
+      () => {},
+    );
+    if (cacheId === undefined) {
+      logger.warning("Timed out while uploading overlay-base database");
+      return false;
+    }
+  } catch (error) {
+    logger.warning(
+      "Failed to upload overlay-base database to cache: " +
+        `${error instanceof Error ? error.message : String(error)}`,
+    );
+    return false;
+  }
+  logger.info(`Successfully uploaded overlay-base database from ${dbLocation}`);
+  return true;
+}
+
+export interface OverlayBaseDatabaseDownloadStats {
+  databaseSizeBytes: number;
+  databaseDownloadDurationMs: number;
+}
+
+/**
+ * Downloads the overlay-base database from the GitHub Actions cache. If conditions
+ * for downloading are not met, the function does nothing and returns false.
+ *
+ * @param codeql The CodeQL instance
+ * @param config The configuration object
+ * @param logger The logger instance
+ * @returns A promise that resolves to download statistics if an overlay-base
+ * database was successfully downloaded, or undefined if the download was
+ * either not performed or failed.
+ */
+export async function downloadOverlayBaseDatabaseFromCache(
+  codeql: CodeQL,
+  config: Config,
+  logger: Logger,
+): Promise<OverlayBaseDatabaseDownloadStats | undefined> {
+  const overlayDatabaseMode = config.overlayDatabaseMode;
+  if (overlayDatabaseMode !== OverlayDatabaseMode.Overlay) {
+    logger.debug(
+      `Overlay database mode is ${overlayDatabaseMode}. ` +
+        "Skip downloading overlay-base database from cache.",
+    );
+    return undefined;
+  }
+  if (!config.useOverlayDatabaseCaching) {
+    logger.debug(
+      "Overlay database caching is disabled. " +
+        "Skip downloading overlay-base database from cache.",
+    );
+    return undefined;
+  }
+  if (isInTestMode()) {
+    logger.debug(
+      "In test mode. Skip downloading overlay-base database from cache.",
+    );
+    return undefined;
+  }
+
+  const dbLocation = config.dbLocation;
+  const codeQlVersion = (await codeql.getVersion()).version;
+  const cacheRestoreKeyPrefix = await getCacheRestoreKeyPrefix(
+    config,
+    codeQlVersion,
+  );
+
+  logger.info(
+    "Looking in Actions cache for overlay-base database with " +
+      `restore key ${cacheRestoreKeyPrefix}`,
+  );
+
+  let databaseDownloadDurationMs = 0;
+  try {
+    const databaseDownloadStart = performance.now();
+    const foundKey = await waitForResultWithTimeLimit(
+      // This ten-minute limit for the cache restore operation is mainly to
+      // guard against the possibility that the cache service is unresponsive
+      // and hangs outside the data download.
+      //
+      // Data download (which is normally the most time-consuming part of the
+      // restore operation) should not run long enough to hit this limit. Even
+      // for an extremely large 10GB database, at a download speed of 40MB/s
+      // (see below), the download should complete within five minutes. If we
+      // do hit this limit, there are likely more serious problems other than
+      // mere slow download speed.
+      //
+      // This is important because we don't want any ongoing file operations
+      // on the database directory when we do hit this limit. Hitting this
+      // time limit takes us to a fallback path where we re-initialize the
+      // database from scratch at dbLocation, and having the cache restore
+      // operation continue to write into dbLocation in the background would
+      // really mess things up. We want to hit this limit only in the case
+      // of a hung cache service, not just slow download speed.
+      MAX_CACHE_OPERATION_MS,
+      actionsCache.restoreCache(
+        [dbLocation],
+        cacheRestoreKeyPrefix,
+        undefined,
+        {
+          // Azure SDK download (which is the default) uses 128MB segments; see
+          // https://github.com/actions/toolkit/blob/main/packages/cache/README.md.
+          // Setting segmentTimeoutInMs to 3000 translates to segment download
+          // speed of about 40 MB/s, which should be achievable unless the
+          // download is unreliable (in which case we do want to abort).
+          segmentTimeoutInMs: 3000,
+        },
+      ),
+      () => {
+        logger.info("Timed out downloading overlay-base database from cache");
+      },
+    );
+    databaseDownloadDurationMs = Math.round(
+      performance.now() - databaseDownloadStart,
+    );
+
+    if (foundKey === undefined) {
+      logger.info("No overlay-base database found in Actions cache");
+      return undefined;
+    }
+
+    logger.info(
+      `Downloaded overlay-base database in cache with key ${foundKey}`,
+    );
+  } catch (error) {
+    logger.warning(
+      "Failed to download overlay-base database from cache: " +
+        `${error instanceof Error ? error.message : String(error)}`,
+    );
+    return undefined;
+  }
+
+  const databaseIsValid = await checkOverlayBaseDatabase(
+    codeql,
+    config,
+    logger,
+    "Downloaded overlay-base database is invalid",
+  );
+  if (!databaseIsValid) {
+    logger.warning("Downloaded overlay-base database failed validation");
+    return undefined;
+  }
+
+  const databaseSizeBytes = await tryGetFolderBytes(dbLocation, logger);
+  if (databaseSizeBytes === undefined) {
+    logger.info(
+      "Filesystem error while accessing downloaded overlay-base database",
+    );
+    // The problem that warrants reporting download failure is not that we are
+    // unable to determine the size of the database. Rather, it is that we
+    // encountered a filesystem error while accessing the database, which
+    // indicates that an overlay analysis will likely fail.
+    return undefined;
+  }
+
+  logger.info(`Successfully downloaded overlay-base database to ${dbLocation}`);
+  return {
+    databaseSizeBytes: Math.round(databaseSizeBytes),
+    databaseDownloadDurationMs,
+  };
+}
+
+/**
+ * Computes the cache key for saving the overlay-base database to the GitHub
+ * Actions cache.
+ *
+ * The key consists of the restore key prefix (which does not include the
+ * commit SHA) and the commit SHA of the current checkout.
+ */
+export async function getCacheSaveKey(
+  config: Config,
+  codeQlVersion: string,
+  checkoutPath: string,
+  logger: Logger,
+): Promise<string> {
+  let runId = 1;
+  let attemptId = 1;
+  try {
+    runId = getWorkflowRunID();
+    attemptId = getWorkflowRunAttempt();
+  } catch (e) {
+    logger.warning(
+      `Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}`,
+    );
+  }
+  const sha = await getCommitOid(checkoutPath);
+  const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
+    config,
+    codeQlVersion,
+  );
+  return `${restoreKeyPrefix}${sha}-${runId}-${attemptId}`;
+}
+
+/**
+ * Computes the cache key prefix for restoring the overlay-base database from
+ * the GitHub Actions cache.
+ *
+ * Actions cache supports using multiple restore keys to indicate preference,
+ * and this function could in principle take advantage of that feature by
+ * returning a list of restore key prefixes. However, since overlay-base
+ * databases are built from the default branch and used in PR analysis, it is
+ * exceedingly unlikely that the commit SHA will ever be the same.
+ *
+ * Therefore, this function returns only a single restore key prefix, which does
+ * not include the commit SHA. This allows us to restore the most recent
+ * compatible overlay-base database.
+ */
+export async function getCacheRestoreKeyPrefix(
+  config: Config,
+  codeQlVersion: string,
+): Promise<string> {
+  const languages = [...config.languages].sort().join("_");
+
+  const cacheKeyComponents = {
+    automationID: await getAutomationID(),
+    // Add more components here as needed in the future
+  };
+  const componentsHash = createCacheKeyHash(cacheKeyComponents);
+
+  // For a cached overlay-base database to be considered compatible for overlay
+  // analysis, all components in the cache restore key must match:
+  //
+  // CACHE_PREFIX: distinguishes overlay-base databases from other cache objects
+  // CACHE_VERSION: cache format version
+  // componentsHash: hash of additional components (see above for details)
+  // languages: the languages included in the overlay-base database
+  // codeQlVersion: CodeQL bundle version
+  //
+  // Technically we can also include languages and codeQlVersion in the
+  // componentsHash, but including them explicitly in the cache key makes it
+  // easier to debug and understand the cache key structure.
+  return `${CACHE_PREFIX}-${CACHE_VERSION}-${componentsHash}-${languages}-${codeQlVersion}-`;
+}
@@ -1,5 +0,0 @@
-export enum OverlayDatabaseMode {
-  Overlay = "overlay",
-  OverlayBase = "overlay-base",
-  None = "none",
-}
@@ -7,10 +7,8 @@ import {
  getRequiredInput,
  getTemporaryDirectory,
 } from "./actions-util";
-import { AnalysisKind, getAnalysisKinds } from "./analyses";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL } from "./codeql";
-import { getRawLanguagesNoAutodetect } from "./config-utils";
 import { EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
 import { initCodeQL } from "./init";
@@ -138,21 +136,16 @@ async function run(startedAt: Date): Promise<void> {
    if (statusReportBase !== undefined) {
      await sendStatusReport(statusReportBase);
    }
-    const codeQLDefaultVersionInfo =
-      await features.getEnabledDefaultCliVersions(gitHubVersion.type);
-    toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
-    const rawLanguages = getRawLanguagesNoAutodetect(
-      getOptionalInput("languages"),
+    const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(
+      gitHubVersion.type,
    );
-    const analysisKinds = await getAnalysisKinds(logger);
+    toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
    const initCodeQLResult = await initCodeQL(
      getOptionalInput("tools"),
      apiDetails,
      getTemporaryDirectory(),
      gitHubVersion.type,
      codeQLDefaultVersionInfo,
-      rawLanguages,
-      analysisKinds.includes(AnalysisKind.CodeScanning),
      features,
      logger,
    );
@@ -7,9 +7,8 @@ import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
-import { Feature } from "./feature-flags";
+import { Feature, FeatureEnablement } from "./feature-flags";
 import { getRunnerLogger } from "./logging";
-import { getCacheRestoreKeyPrefix } from "./overlay/caching";
 import * as setupCodeql from "./setup-codeql";
 import * as tar from "./tar";
 import {
@@ -19,9 +18,8 @@ import {
  SAMPLE_DOTCOM_API_DETAILS,
  checkExpectedLogMessages,
  createFeatures,
-  createTestConfig,
  getRecordingLogger,
-  makeMacro,
+  initializeFeatures,
  mockBundleDownloadApi,
  setupActionsVars,
  setupTests,
@@ -35,6 +33,14 @@ import {

 setupTests(test);

+// TODO: Remove when when we no longer need to pass in features (https://github.com/github/codeql-action/issues/2600)
+const expectedFeatureEnablement: FeatureEnablement = initializeFeatures(
+  true,
+) as FeatureEnablement;
+expectedFeatureEnablement.getValue = function (feature: Feature) {
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+  return expectedFeatureEnablement[feature];
+};
 test.beforeEach(() => {
  initializeEnvironment("1.2.3");
 });
@@ -101,8 +107,6 @@ test.serial(
      const source = await setupCodeql.getCodeQLSource(
        `https://github.com/github/codeql-action/releases/download/${tagName}/codeql-bundle-linux64.tar.gz`,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -126,8 +130,6 @@ test.serial(
      const source = await setupCodeql.getCodeQLSource(
        "linked",
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -153,8 +155,6 @@ test.serial(
      const source = await setupCodeql.getCodeQLSource(
        "latest",
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -211,8 +211,6 @@ test.serial(
        "tmp/codeql_action_test/",
        GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        logger,
      );
@@ -268,8 +266,6 @@ test.serial(
        "tmp/codeql_action_test/",
        GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        logger,
      );
@@ -321,8 +317,6 @@ test.serial(
      const source = await setupCodeql.getCodeQLSource(
        "nightly",
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -384,8 +378,6 @@ test.serial(
      const source = await setupCodeql.getCodeQLSource(
        undefined,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -440,8 +432,6 @@ test.serial(
      const source = await setupCodeql.getCodeQLSource(
        "toolcache",
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -483,7 +473,7 @@ test.serial(
  },
 );

-const toolcacheInputFallbackMacro = makeMacro({
+const toolcacheInputFallbackMacro = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    featureList: Feature[],
@@ -509,8 +499,6 @@ const toolcacheInputFallbackMacro = makeMacro({
      const source = await setupCodeql.getCodeQLSource(
        "toolcache",
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        SAMPLE_DOTCOM_API_DETAILS,
        GitHubVariant.DOTCOM,
        false,
@@ -526,10 +514,7 @@ const toolcacheInputFallbackMacro = makeMacro({

      // Check that `sourceType` and `toolsVersion` match expectations.
      t.is(source.sourceType, "download");
-      t.is(
-        source.toolsVersion,
-        SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
-      );
+      t.is(source.toolsVersion, SAMPLE_DEFAULT_CLI_VERSION.cliVersion);

      // Check that key messages we would expect to find in the log are present.
      for (const expectedMessage of expectedMessages) {
@@ -548,8 +533,9 @@ const toolcacheInputFallbackMacro = makeMacro({
    `getCodeQLSource falls back to downloading the CLI if ${providedTitle}`,
 });

-toolcacheInputFallbackMacro.serial(
+test.serial(
  "the toolcache doesn't have a CodeQL CLI when tools == toolcache",
+  toolcacheInputFallbackMacro,
  [Feature.AllowToolcacheInput],
  { GITHUB_EVENT_NAME: "dynamic" },
  [],
@@ -559,8 +545,9 @@ toolcacheInputFallbackMacro.serial(
  ],
 );

-toolcacheInputFallbackMacro.serial(
+test.serial(
  "the workflow trigger is not `dynamic`",
+  toolcacheInputFallbackMacro,
  [Feature.AllowToolcacheInput],
  { GITHUB_EVENT_NAME: "pull_request" },
  [],
@@ -569,8 +556,9 @@ toolcacheInputFallbackMacro.serial(
  ],
 );

-toolcacheInputFallbackMacro.serial(
+test.serial(
  "the feature flag is not enabled",
+  toolcacheInputFallbackMacro,
  [],
  { GITHUB_EVENT_NAME: "dynamic" },
  [],
@@ -610,288 +598,3 @@ test.serial(
    t.is(setupCodeql.getLatestToolcacheVersion(getRunnerLogger(true)), "3.2.1");
  },
 );
-
-const overlayMatchEnabledVersions = {
-  enabledVersions: [
-    { cliVersion: "2.20.2", tagName: "codeql-bundle-v2.20.2" },
-    { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-    { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
-  ],
-  toolsFeatureFlagsValid: true,
-};
-
-async function fakeOverlayBaseCacheKey(
-  language: string,
-  cliVersion: string,
-  suffix: string,
-): Promise<string> {
-  const prefix = await getCacheRestoreKeyPrefix(
-    createTestConfig({ languages: [language] }),
-    cliVersion,
-  );
-  return `${prefix}${suffix}`;
-}
-
-test.serial(
-  "getCodeQLSource uses overlay-aware default version when requested for a PR",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      process.env["CODE_SCANNING_REF"] = "refs/heads/feature-branch";
-      process.env["CODE_SCANNING_BASE_BRANCH"] = "main";
-
-      sinon.stub(api, "getAutomationID").resolves("test/");
-      const listStub = sinon.stub(api, "listActionsCaches").resolves([
-        {
-          key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
-        },
-      ]);
-      sinon
-        .stub(toolcache, "find")
-        .withArgs("CodeQL", "2.20.1")
-        .returns("/path/to/codeql-2.20.1");
-
-      const source = await setupCodeql.getCodeQLSource(
-        undefined,
-        overlayMatchEnabledVersions,
-        ["javascript"],
-        true,
-        SAMPLE_DOTCOM_API_DETAILS,
-        GitHubVariant.DOTCOM,
-        false,
-        createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-        getRunnerLogger(true),
-      );
-
-      t.assert(listStub.calledOnce);
-      t.is(source.sourceType, "toolcache");
-      t.is(source.toolsVersion, "2.20.1");
-    });
-  },
-);
-
-test.serial(
-  "getCodeQLSource skips overlay-aware default version when not requested",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      process.env["CODE_SCANNING_REF"] = "refs/heads/feature-branch";
-      process.env["CODE_SCANNING_BASE_BRANCH"] = "main";
-
-      sinon.stub(api, "getAutomationID").resolves("test/");
-      const listStub = sinon.stub(api, "listActionsCaches").resolves([
-        {
-          key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
-        },
-      ]);
-      sinon
-        .stub(toolcache, "find")
-        .withArgs("CodeQL", "2.20.2")
-        .returns("/path/to/codeql-2.20.2");
-
-      const source = await setupCodeql.getCodeQLSource(
-        undefined,
-        overlayMatchEnabledVersions,
-        ["javascript"],
-        false,
-        SAMPLE_DOTCOM_API_DETAILS,
-        GitHubVariant.DOTCOM,
-        false,
-        createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-        getRunnerLogger(true),
-      );
-
-      t.assert(listStub.notCalled);
-      t.is(source.sourceType, "toolcache");
-      t.is(source.toolsVersion, "2.20.2");
-    });
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases returns flag-enabled versions present in cache, sorted desc",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    sinon.stub(api, "listActionsCaches").resolves([
-      // Flag-enabled versions present in the cache, listed in non-descending
-      // order so the test exercises the sort.
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.0", "ghi-3-1"),
-      },
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "def-2-1"),
-      },
-      // Newer than any flag-enabled version: should be filtered out.
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.21.0", "abc-1-1"),
-      },
-    ]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, [
-      { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-      { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
-    ]);
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases returns empty when no cached version is flag-enabled",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    sinon.stub(api, "listActionsCaches").resolves([
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.19.0", "abc-1-1"),
-      },
-    ]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, []);
-  },
-);
-
-const noLanguagesMacro = makeMacro({
-  exec: async (
-    t: ExecutionContext<unknown>,
-    rawLanguages: string[] | undefined,
-  ) => {
-    const listStub = sinon.stub(api, "listActionsCaches").resolves([]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      rawLanguages,
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, []);
-    t.assert(
-      listStub.notCalled,
-      "Should not list Actions caches without any rawLanguages.",
-    );
-  },
-  title: (providedTitle = "") =>
-    `getEnabledVersionsWithOverlayBaseDatabases does not list caches when rawLanguages is ${providedTitle}`,
-});
-
-noLanguagesMacro.serial("undefined", undefined);
-noLanguagesMacro.serial("an empty array", []);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases returns empty when listing caches throws",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    sinon.stub(api, "listActionsCaches").rejects(new Error("listing failed"));
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, []);
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases returns versions present in the cache",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    sinon.stub(api, "listActionsCaches").resolves([
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.2", "abc-1-1"),
-      },
-    ]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, [
-      { cliVersion: "2.20.2", tagName: "codeql-bundle-v2.20.2" },
-    ]);
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases does not list caches when both gates are off",
-  async (t) => {
-    const listStub = sinon.stub(api, "listActionsCaches").resolves([]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, []);
-    t.assert(
-      listStub.notCalled,
-      "Should not list Actions caches when both gating feature flags are off.",
-    );
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases dry-run returns empty but lists caches",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    const listStub = sinon.stub(api, "listActionsCaches").resolves([
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
-      },
-    ]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(
-      result,
-      [],
-      "Dry-run should return an empty list so the caller falls back.",
-    );
-    t.assert(
-      listStub.calledOnce,
-      "Dry-run should still list Actions caches to populate the diagnostic.",
-    );
-  },
-);
-
-test.serial(
-  "getEnabledVersionsWithOverlayBaseDatabases match flag wins over dry-run",
-  async (t) => {
-    sinon.stub(api, "getAutomationID").resolves("test/");
-    sinon.stub(api, "listActionsCaches").resolves([
-      {
-        key: await fakeOverlayBaseCacheKey("javascript", "2.20.1", "abc-1-1"),
-      },
-    ]);
-
-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([
-        Feature.OverlayAnalysisMatchCodeqlVersion,
-        Feature.OverlayAnalysisMatchCodeqlVersionDryRun,
-      ]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, [
-      { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-    ]);
-  },
-);
@@ -7,27 +7,17 @@ import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";

-import {
-  isAnalyzingPullRequest,
-  isDynamicWorkflow,
-  isRunningLocalAction,
-} from "./actions-util";
+import { isDynamicWorkflow, isRunningLocalAction } from "./actions-util";
 import * as api from "./api-client";
 import * as defaults from "./defaults.json";
-import {
-  addNoLanguageDiagnostic,
-  makeDiagnostic,
-  makeTelemetryDiagnostic,
-} from "./diagnostics";
+import { addNoLanguageDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
  CODEQL_VERSION_ZSTD_BUNDLE,
  CodeQLDefaultVersionInfo,
-  CodeQLVersionInfo,
  Feature,
  FeatureEnablement,
 } from "./feature-flags";
 import { Logger } from "./logging";
-import { getCodeQlVersionsForOverlayBaseDatabases } from "./overlay/caching";
 import * as tar from "./tar";
 import {
  downloadAndExtract,
@@ -274,131 +264,12 @@ async function findOverridingToolsInCache(
  return undefined;
 }

-/**
- * Returns the sorted set of enabled versions that have cached overlay-base databases for the
- * given languages, or an empty list if neither the `OverlayAnalysisMatchCodeqlVersion` nor the
- * `OverlayAnalysisMatchCodeqlVersionDryRun` feature flag is enabled. When only the dry-run flag
- * is enabled, this performs the lookup and emits a telemetry diagnostic with the version that
- * would have been chosen, but still returns an empty list so the caller falls back.
- */
-export async function getEnabledVersionsWithOverlayBaseDatabases(
-  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  features: FeatureEnablement,
-  logger: Logger,
-): Promise<CodeQLVersionInfo[]> {
-  if (rawLanguages === undefined || rawLanguages.length === 0) {
-    return [];
-  }
-  const isEnabled = await features.getValue(
-    Feature.OverlayAnalysisMatchCodeqlVersion,
-  );
-  const isDryRun =
-    !isEnabled &&
-    (await features.getValue(Feature.OverlayAnalysisMatchCodeqlVersionDryRun));
-  if (!isEnabled && !isDryRun) {
-    return [];
-  }
-
-  let cachedVersions: string[] | undefined;
-  try {
-    cachedVersions = await getCodeQlVersionsForOverlayBaseDatabases(
-      rawLanguages,
-      logger,
-    );
-  } catch (e) {
-    logger.warning(
-      "Could not list overlay-base databases in the Actions cache while choosing a default " +
-        `CodeQL CLI version, falling back to the highest enabled version. Details: ${util.getErrorMessage(e)}`,
-    );
-    return [];
-  }
-
-  if (cachedVersions === undefined || cachedVersions.length === 0) {
-    return [];
-  }
-
-  const cachedVersionsSet = new Set(cachedVersions);
-  const overlayVersions = defaultCliVersion.enabledVersions.filter((v) =>
-    cachedVersionsSet.has(v.cliVersion),
-  );
-
-  if (overlayVersions.length === 0) {
-    return [];
-  }
-
-  const isCachedVersionDifferent =
-    overlayVersions[0].cliVersion !==
-    defaultCliVersion.enabledVersions[0].cliVersion;
-
-  if (isCachedVersionDifferent) {
-    addNoLanguageDiagnostic(
-      undefined,
-      makeTelemetryDiagnostic(
-        "codeql-action/overlay-aware-default-codeql-version",
-        "Overlay-aware default CodeQL version selection",
-        {
-          cachedVersions,
-          enabledVersions: defaultCliVersion.enabledVersions.map(
-            (v) => v.cliVersion,
-          ),
-          isDryRun,
-          overlayAwareVersion: overlayVersions[0].cliVersion,
-        },
-      ),
-    );
-  }
-
-  if (isDryRun) {
-    logger.debug(
-      `Overlay-aware default CodeQL version selection is running in dry-run mode. Would have used version ${overlayVersions[0].cliVersion}.`,
-    );
-    return [];
-  }
-
-  return overlayVersions;
-}
-
-/**
- * Resolves the newest enabled default CLI version that has a cached overlay-base database for the
- * relevant languages, if running a Code Scanning analysis for a pull request and one exists.
- * Otherwise, falls back to the newest enabled default CLI version.
- */
-async function resolveDefaultCliVersion(
-  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  useOverlayAwareDefaultCliVersion: boolean,
-  features: FeatureEnablement,
-  logger: Logger,
-): Promise<CodeQLVersionInfo> {
-  if (!useOverlayAwareDefaultCliVersion || !isAnalyzingPullRequest()) {
-    return defaultCliVersion.enabledVersions[0];
-  }
-
-  const overlayVersions = await getEnabledVersionsWithOverlayBaseDatabases(
-    defaultCliVersion,
-    rawLanguages,
-    features,
-    logger,
-  );
-  if (overlayVersions.length > 0) {
-    logger.info(
-      `Using CodeQL version ${overlayVersions[0].cliVersion} since this is the ` +
-        `highest enabled version that has a cached overlay-base database.`,
-    );
-    return overlayVersions[0];
-  }
-  return defaultCliVersion.enabledVersions[0];
-}
-
 /**
 * Determines where the CodeQL CLI we want to use comes from. This can be from a local file,
 * the Actions toolcache, or a download.
 *
 * @param toolsInput The argument provided for the `tools` input, if any.
 * @param defaultCliVersion The default CLI version that's linked to the CodeQL Action.
- * @param rawLanguages Raw set of languages.
- * @param useOverlayAwareDefaultCliVersion Whether to select an overlay-aware default CLI version.
 * @param apiDetails Information about the GitHub API.
 * @param variant The GitHub variant we are running on.
 * @param tarSupportsZstd Whether zstd is supported by `tar`.
@@ -410,8 +281,6 @@ async function resolveDefaultCliVersion(
 export async function getCodeQLSource(
  toolsInput: string | undefined,
  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  useOverlayAwareDefaultCliVersion: boolean,
  apiDetails: api.GitHubApiDetails,
  variant: util.GitHubVariant,
  tarSupportsZstd: boolean,
@@ -569,15 +438,8 @@ export async function getCodeQLSource(
        }
      }

-      const version = await resolveDefaultCliVersion(
-        defaultCliVersion,
-        rawLanguages,
-        useOverlayAwareDefaultCliVersion,
-        features,
-        logger,
-      );
-      cliVersion = version.cliVersion;
-      tagName = version.tagName;
+      cliVersion = defaultCliVersion.cliVersion;
+      tagName = defaultCliVersion.tagName;
    }
  } else if (toolsInput !== undefined) {
    // If a tools URL was provided, then use that.
@@ -592,15 +454,9 @@ export async function getCodeQLSource(
      }
    }
  } else {
-    const version = await resolveDefaultCliVersion(
-      defaultCliVersion,
-      rawLanguages,
-      useOverlayAwareDefaultCliVersion,
-      features,
-      logger,
-    );
-    cliVersion = version.cliVersion;
-    tagName = version.tagName;
+    // Otherwise, use the default CLI version passed in.
+    cliVersion = defaultCliVersion.cliVersion;
+    tagName = defaultCliVersion.tagName;
  }

  const bundleVersion =
@@ -935,8 +791,6 @@ export async function setupCodeQLBundle(
  tempDir: string,
  variant: util.GitHubVariant,
  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  useOverlayAwareDefaultCliVersion: boolean,
  features: FeatureEnablement,
  logger: Logger,
 ): Promise<SetupCodeQLResult> {
@@ -950,8 +804,6 @@ export async function setupCodeQLBundle(
  const source = await getCodeQLSource(
    toolsInput,
    defaultCliVersion,
-    rawLanguages,
-    useOverlayAwareDefaultCliVersion,
    apiDetails,
    variant,
    zstdAvailability.available,
@@ -6,7 +6,7 @@ import * as core from "@actions/core";
 import * as actionsUtil from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
-import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
 import {
@@ -14,6 +14,7 @@ import {
  getCredentials,
  getProxyBinaryPath,
  getSafeErrorMessage,
+  parseLanguage,
  ProxyInfo,
  sendFailedStatusReport,
  sendSuccessStatusReport,
@@ -32,7 +33,7 @@ async function run(startedAt: Date) {

  const logger = getActionsLogger();
  let features: FeatureEnablement | undefined;
-  let language: BuiltInLanguage | undefined;
+  let language: KnownLanguage | undefined;

  try {
    // Make inputs accessible in the `post` step.
@@ -55,7 +56,7 @@ async function run(startedAt: Date) {

    // Get the language input.
    const languageInput = actionsUtil.getOptionalInput("language");
-    language = languageInput ? parseBuiltInLanguage(languageInput) : undefined;
+    language = languageInput ? parseLanguage(languageInput) : undefined;

    // Query the FF for whether we should use the reduced registry mapping.
    const skipUnusedRegistries = await features.getValue(
@@ -111,14 +112,14 @@ async function run(startedAt: Date) {
      logger,
    );

-    // Perform best-effort checks that the private registries are reachable.
+    // Check that the private registries are reachable.
    await checkConnections(logger, proxyInfo);

    // Report success if we have reached this point.
    await sendSuccessStatusReport(
      startedAt,
      {
-        languages: language === undefined ? undefined : [language],
+        languages: language && [language],
      },
      proxyConfig.all_credentials.map((c) => c.type),
      logger,
@@ -198,7 +199,6 @@ async function startProxy(
    .map((credential) => ({
      type: credential.type,
      url: credential.url,
-      "replaces-base": credential["replaces-base"],
    }));
  core.setOutput("proxy_urls", JSON.stringify(registry_urls));

@@ -8,17 +8,15 @@ import sinon from "sinon";
 import * as apiClient from "./api-client";
 import * as defaults from "./defaults.json";
 import { setUpFeatureFlagTests } from "./feature-flags/testing-util";
-import { UnvalidatedObject, validateSchema } from "./json";
-import { makeFromSchema } from "./json/testing-util";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger, Logger } from "./logging";
 import * as startProxyExports from "./start-proxy";
+import { parseLanguage } from "./start-proxy";
 import * as statusReport from "./status-report";
 import {
  assertNotLogged,
  checkExpectedLogMessages,
  createFeatures,
-  makeMacro,
  makeTestToken,
  RecordingLogger,
  setupTests,
@@ -33,7 +31,7 @@ import {

 setupTests(test);

-const sendFailedStatusReportTest = makeMacro({
+const sendFailedStatusReportTest = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    err: Error,
@@ -89,14 +87,16 @@ const sendFailedStatusReportTest = makeMacro({
  title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`,
 });

-sendFailedStatusReportTest.serial(
+test.serial(
  "reports generic error message for non-StartProxyError error",
+  sendFailedStatusReportTest,
  new Error("Something went wrong today"),
  "Error from start-proxy Action omitted (Error).",
 );

-sendFailedStatusReportTest.serial(
+test.serial(
  "reports generic error message for non-StartProxyError error with safe error message",
+  sendFailedStatusReportTest,
  new Error(
    startProxyExports.getStartProxyErrorMessage(
      startProxyExports.StartProxyErrorType.DownloadFailed,
@@ -105,8 +105,9 @@ sendFailedStatusReportTest.serial(
  "Error from start-proxy Action omitted (Error).",
 );

-sendFailedStatusReportTest.serial(
+test.serial(
  "reports generic error message for ConfigurationError error",
+  sendFailedStatusReportTest,
  new ConfigurationError("Something went wrong today"),
  "Error from start-proxy Action omitted (ConfigurationError).",
  "user-error",
@@ -231,7 +232,7 @@ test("getCredentials filters by language when specified", async (t) => {
    getRunnerLogger(true),
    undefined,
    toEncodedJSON(mixedCredentials),
-    BuiltInLanguage.java,
+    KnownLanguage.java,
  );
  t.is(credentials.length, 1);
  t.is(credentials[0].type, "maven_repository");
@@ -242,7 +243,7 @@ test("getCredentials returns all for a language when specified", async (t) => {
    getRunnerLogger(true),
    undefined,
    toEncodedJSON(mixedCredentials),
-    BuiltInLanguage.go,
+    KnownLanguage.go,
  );
  t.is(credentials.length, 2);

@@ -251,57 +252,6 @@ test("getCredentials returns all for a language when specified", async (t) => {
  t.assert(credentialsTypes.includes("git_source"));
 });

-test("getCredentials returns all goproxy_servers for Go when specified", async (t) => {
-  const multipleGoproxyServers = [
-    { type: "goproxy_server", host: "goproxy1.example.com", token: "token1" },
-    { type: "goproxy_server", host: "goproxy2.example.com", token: "token2" },
-    { type: "git_source", host: "github.com/github", token: "mno" },
-  ];
-
-  const credentials = startProxyExports.getCredentials(
-    getRunnerLogger(true),
-    undefined,
-    toEncodedJSON(multipleGoproxyServers),
-    BuiltInLanguage.go,
-  );
-  t.is(credentials.length, 3);
-
-  const goproxyServers = credentials.filter((c) => c.type === "goproxy_server");
-  t.is(goproxyServers.length, 2);
-  t.assert(goproxyServers.some((c) => c.host === "goproxy1.example.com"));
-  t.assert(goproxyServers.some((c) => c.host === "goproxy2.example.com"));
-});
-
-test("getCredentials returns all maven_repositories for Java when specified", async (t) => {
-  const multipleMavenRepositories = [
-    {
-      type: "maven_repository",
-      host: "maven1.pkg.github.com",
-      token: "token1",
-    },
-    {
-      type: "maven_repository",
-      host: "maven2.pkg.github.com",
-      token: "token2",
-    },
-    { type: "git_source", host: "github.com/github", token: "mno" },
-  ];
-
-  const credentials = startProxyExports.getCredentials(
-    getRunnerLogger(true),
-    undefined,
-    toEncodedJSON(multipleMavenRepositories),
-    BuiltInLanguage.java,
-  );
-  t.is(credentials.length, 2);
-
-  const mavenRepositories = credentials.filter(
-    (c) => c.type === "maven_repository",
-  );
-  t.assert(mavenRepositories.some((c) => c.host === "maven1.pkg.github.com"));
-  t.assert(mavenRepositories.some((c) => c.host === "maven2.pkg.github.com"));
-});
-
 test("getCredentials returns all credentials when no language specified", async (t) => {
  const credentialsInput = toEncodedJSON(mixedCredentials);

@@ -349,70 +299,147 @@ test("getCredentials throws an error when non-printable characters are used", as
  }
 });

-for (const oidcSchemaInfo of startProxyExports.oidcSchemas) {
-  test(`getCredentials throws when non-printable characters are used (${oidcSchemaInfo.name} OIDC)`, (t) => {
-    const validCredential = makeFromSchema(true, oidcSchemaInfo.schema);
-    for (const key of Object.keys(validCredential)) {
-      const invalidAuthConfig = {
-        ...validCredential,
-        [key]: "123\x00",
-      };
-      const invalidCredential: startProxyExports.RawCredential = {
-        type: "nuget_feed",
-        host: `${key}.nuget.pkg.github.com`,
-        ...invalidAuthConfig,
-      };
-      const credentialsInput = toEncodedJSON([invalidCredential]);
+const validAzureCredential: startProxyExports.AzureConfig = {
+  tenant_id: "12345678-1234-1234-1234-123456789012",
+  client_id: "abcdef01-2345-6789-abcd-ef0123456789",
+};

-      t.throws(
-        () =>
-          startProxyExports.getCredentials(
-            getRunnerLogger(true),
-            undefined,
-            credentialsInput,
-            undefined,
-          ),
-        {
-          message:
-            "Invalid credentials - fields must contain only printable characters",
-        },
-      );
-    }
-  });
-}
+const validAwsCredential: startProxyExports.AWSConfig = {
+  aws_region: "us-east-1",
+  account_id: "123456789012",
+  role_name: "MY_ROLE",
+  domain: "MY_DOMAIN",
+  domain_owner: "987654321098",
+  audience: "custom-audience",
+};
+
+const validJFrogCredential: startProxyExports.JFrogConfig = {
+  jfrog_oidc_provider_name: "MY_PROVIDER",
+  audience: "jfrog-audience",
+  identity_mapping_name: "my-mapping",
+};
+
+test("getCredentials throws an error when non-printable characters are used for Azure OIDC", (t) => {
+  for (const key of Object.keys(validAzureCredential)) {
+    const invalidAzureCredential = {
+      ...validAzureCredential,
+      [key]: "123\x00",
+    };
+    const invalidCredential: startProxyExports.RawCredential = {
+      type: "nuget_feed",
+      host: `${key}.nuget.pkg.github.com`,
+      ...invalidAzureCredential,
+    };
+    const credentialsInput = toEncodedJSON([invalidCredential]);
+
+    t.throws(
+      () =>
+        startProxyExports.getCredentials(
+          getRunnerLogger(true),
+          undefined,
+          credentialsInput,
+          undefined,
+        ),
+      {
+        message:
+          "Invalid credentials - fields must contain only printable characters",
+      },
+    );
+  }
+});
+
+test("getCredentials throws an error when non-printable characters are used for AWS OIDC", (t) => {
+  for (const key of Object.keys(validAwsCredential)) {
+    const invalidAwsCredential = {
+      ...validAwsCredential,
+      [key]: "123\x00",
+    };
+    const invalidCredential: startProxyExports.RawCredential = {
+      type: "nuget_feed",
+      host: `${key}.nuget.pkg.github.com`,
+      ...invalidAwsCredential,
+    };
+    const credentialsInput = toEncodedJSON([invalidCredential]);
+
+    t.throws(
+      () =>
+        startProxyExports.getCredentials(
+          getRunnerLogger(true),
+          undefined,
+          credentialsInput,
+          undefined,
+        ),
+      {
+        message:
+          "Invalid credentials - fields must contain only printable characters",
+      },
+    );
+  }
+});
+
+test("getCredentials throws an error when non-printable characters are used for JFrog OIDC", (t) => {
+  for (const key of Object.keys(validJFrogCredential)) {
+    const invalidJFrogCredential = {
+      ...validJFrogCredential,
+      [key]: "123\x00",
+    };
+    const invalidCredential: startProxyExports.RawCredential = {
+      type: "nuget_feed",
+      host: `${key}.nuget.pkg.github.com`,
+      ...invalidJFrogCredential,
+    };
+    const credentialsInput = toEncodedJSON([invalidCredential]);
+
+    t.throws(
+      () =>
+        startProxyExports.getCredentials(
+          getRunnerLogger(true),
+          undefined,
+          credentialsInput,
+          undefined,
+        ),
+      {
+        message:
+          "Invalid credentials - fields must contain only printable characters",
+      },
+    );
+  }
+});

 test("getCredentials accepts OIDC configurations", (t) => {
-  const oidcConfigurations = startProxyExports.oidcSchemas.map(
-    (schemaInfo) => ({
+  const oidcConfigurations = [
+    {
      type: "nuget_feed",
-      host: `${schemaInfo.name.toLowerCase()}.pkg.github.com`,
-      ...makeFromSchema(true, schemaInfo.schema),
-    }),
-  );
+      host: "azure.pkg.github.com",
+      ...validAzureCredential,
+    },
+    {
+      type: "nuget_feed",
+      host: "aws.pkg.github.com",
+      ...validAwsCredential,
+    },
+    {
+      type: "nuget_feed",
+      host: "jfrog.pkg.github.com",
+      ...validJFrogCredential,
+    },
+  ];

  const credentials = startProxyExports.getCredentials(
    getRunnerLogger(true),
    undefined,
    toEncodedJSON(oidcConfigurations),
-    BuiltInLanguage.csharp,
+    KnownLanguage.csharp,
  );
-  t.is(credentials.length, startProxyExports.oidcSchemas.length);
+  t.is(credentials.length, 3);

  t.assert(credentials.every((c) => c.type === "nuget_feed"));
-
-  for (const oidcSchemaInfo of startProxyExports.oidcSchemas) {
-    t.assert(
-      credentials.some((c) =>
-        validateSchema(
-          oidcSchemaInfo.schema,
-          c as unknown as UnvalidatedObject<any>,
-        ),
-      ),
-    );
-  }
+  t.assert(credentials.some((c) => startProxyExports.isAzureConfig(c)));
+  t.assert(credentials.some((c) => startProxyExports.isAWSConfig(c)));
+  t.assert(credentials.some((c) => startProxyExports.isJFrogConfig(c)));
 });

-const getCredentialsMacro = makeMacro({
+const getCredentialsMacro = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    credentials: startProxyExports.RawCredential[],
@@ -438,8 +465,9 @@ const getCredentialsMacro = makeMacro({
  title: (providedTitle = "") => `getCredentials - ${providedTitle}`,
 });

-getCredentialsMacro(
+test(
  "warns for PAT-like password without a username",
+  getCredentialsMacro,
  [
    {
      type: "git_server",
@@ -454,7 +482,7 @@ getCredentialsMacro(
    t.is(results[0].type, "git_server");
    t.is(results[0].host, "https://github.com/");

-    if (startProxyExports.hasUsernameAndPassword(results[0])) {
+    if (startProxyExports.isUsernamePassword(results[0])) {
      t.assert(results[0].password?.startsWith("ghp_"));
    } else {
      t.fail("Expected a `UsernamePassword`-based credential.");
@@ -467,8 +495,9 @@ getCredentialsMacro(
  },
 );

-getCredentialsMacro(
+test(
  "no warning for PAT-like password with a username",
+  getCredentialsMacro,
  [
    {
      type: "git_server",
@@ -484,7 +513,7 @@ getCredentialsMacro(
    t.is(results[0].type, "git_server");
    t.is(results[0].host, "https://github.com/");

-    if (startProxyExports.hasUsernameAndPassword(results[0])) {
+    if (startProxyExports.isUsernamePassword(results[0])) {
      t.assert(results[0].password?.startsWith("ghp_"));
    } else {
      t.fail("Expected a `UsernamePassword`-based credential.");
@@ -498,8 +527,9 @@ getCredentialsMacro(
  },
 );

-getCredentialsMacro(
+test(
  "warns for PAT-like token without a username",
+  getCredentialsMacro,
  [
    {
      type: "git_server",
@@ -527,8 +557,9 @@ getCredentialsMacro(
  },
 );

-getCredentialsMacro(
+test(
  "no warning for PAT-like token with a username",
+  getCredentialsMacro,
  [
    {
      type: "git_server",
@@ -558,76 +589,6 @@ getCredentialsMacro(
  },
 );

-test("getCredentials validates 'replaces-base' correctly", async (t) => {
-  // Valid cases.
-  const credentialsInput = toEncodedJSON([
-    {
-      type: "maven_repository",
-      host: "maven1.pkg.github.com",
-      token: "abc",
-      "replaces-base": false,
-    },
-    {
-      type: "maven_repository",
-      host: "maven2.pkg.github.com",
-      token: "def",
-      "replaces-base": true,
-    },
-    {
-      type: "maven_repository",
-      host: "maven3.pkg.github.com",
-      token: "ghi",
-    },
-  ]);
-
-  const credentials = startProxyExports.getCredentials(
-    getRunnerLogger(true),
-    undefined,
-    credentialsInput,
-    BuiltInLanguage.java,
-    false,
-  );
-
-  t.is(credentials.length, 3);
-  t.true(credentials.some((c) => c["replaces-base"] === true));
-  t.true(credentials.some((c) => c["replaces-base"] === false));
-  t.true(credentials.some((c) => c["replaces-base"] === undefined));
-
-  // Invalid cases.
-  const baseInvalid = {
-    type: "maven_repository",
-    host: "maven4.pkg.github.com",
-    token: "jkl",
-  };
-  t.throws(() =>
-    startProxyExports.getCredentials(
-      getRunnerLogger(true),
-      undefined,
-      toEncodedJSON([{ ...baseInvalid, "replaces-base": null }]),
-      BuiltInLanguage.actions,
-      false,
-    ),
-  );
-  t.throws(() =>
-    startProxyExports.getCredentials(
-      getRunnerLogger(true),
-      undefined,
-      toEncodedJSON([{ ...baseInvalid, "replaces-base": 123 }]),
-      BuiltInLanguage.actions,
-      false,
-    ),
-  );
-  t.throws(() =>
-    startProxyExports.getCredentials(
-      getRunnerLogger(true),
-      undefined,
-      toEncodedJSON([{ ...baseInvalid, "replaces-base": "true" }]),
-      BuiltInLanguage.actions,
-      false,
-    ),
-  );
-});
-
 test("getCredentials returns all credentials for Actions when using LANGUAGE_TO_REGISTRY_TYPE", async (t) => {
  const credentialsInput = toEncodedJSON(mixedCredentials);

@@ -635,7 +596,7 @@ test("getCredentials returns all credentials for Actions when using LANGUAGE_TO_
    getRunnerLogger(true),
    undefined,
    credentialsInput,
-    BuiltInLanguage.actions,
+    KnownLanguage.actions,
    false,
  );
  t.is(credentials.length, mixedCredentials.length);
@@ -648,12 +609,39 @@ test("getCredentials returns no credentials for Actions when using NEW_LANGUAGE_
    getRunnerLogger(true),
    undefined,
    credentialsInput,
-    BuiltInLanguage.actions,
+    KnownLanguage.actions,
    true,
  );
  t.deepEqual(credentials, []);
 });

+test("parseLanguage", async (t) => {
+  // Exact matches
+  t.deepEqual(parseLanguage("csharp"), KnownLanguage.csharp);
+  t.deepEqual(parseLanguage("cpp"), KnownLanguage.cpp);
+  t.deepEqual(parseLanguage("go"), KnownLanguage.go);
+  t.deepEqual(parseLanguage("java"), KnownLanguage.java);
+  t.deepEqual(parseLanguage("javascript"), KnownLanguage.javascript);
+  t.deepEqual(parseLanguage("python"), KnownLanguage.python);
+  t.deepEqual(parseLanguage("rust"), KnownLanguage.rust);
+
+  // Aliases
+  t.deepEqual(parseLanguage("c"), KnownLanguage.cpp);
+  t.deepEqual(parseLanguage("c++"), KnownLanguage.cpp);
+  t.deepEqual(parseLanguage("c#"), KnownLanguage.csharp);
+  t.deepEqual(parseLanguage("kotlin"), KnownLanguage.java);
+  t.deepEqual(parseLanguage("typescript"), KnownLanguage.javascript);
+
+  // spaces and case-insensitivity
+  t.deepEqual(parseLanguage("  \t\nCsHaRp\t\t"), KnownLanguage.csharp);
+  t.deepEqual(parseLanguage("  \t\nkOtLin\t\t"), KnownLanguage.java);
+
+  // Not matches
+  t.deepEqual(parseLanguage("foo"), undefined);
+  t.deepEqual(parseLanguage(" "), undefined);
+  t.deepEqual(parseLanguage(""), undefined);
+});
+
 function mockGetApiClient(endpoints: any) {
  return (
    sinon
@@ -790,7 +778,7 @@ test.serial(
  },
 );

-const wrapFailureTest = makeMacro({
+const wrapFailureTest = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    setup: () => void,
@@ -821,8 +809,9 @@ test.serial("downloadProxy - returns file path on success", async (t) => {
  });
 });

-wrapFailureTest.serial(
+test.serial(
  "downloadProxy",
+  wrapFailureTest,
  () => {
    sinon.stub(toolcache, "downloadTool").throws();
  },
@@ -841,8 +830,9 @@ test.serial("extractProxy - returns file path on success", async (t) => {
  });
 });

-wrapFailureTest.serial(
+test.serial(
  "extractProxy",
+  wrapFailureTest,
  () => {
    sinon.stub(toolcache, "extractTar").throws();
  },
@@ -866,8 +856,9 @@ test.serial("cacheProxy - returns file path on success", async (t) => {
  });
 });

-wrapFailureTest.serial(
+test.serial(
  "cacheProxy",
+  wrapFailureTest,
  () => {
    sinon.stub(toolcache, "cacheDir").throws();
  },
@@ -1010,10 +1001,8 @@ test.serial(
        return true;
      });
      const getDefaultCliVersion = sinon
-        .stub(features, "getEnabledDefaultCliVersions")
-        .resolves({
-          enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }],
-        });
+        .stub(features, "getDefaultCliVersion")
+        .resolves({ cliVersion: "2.20.1", tagName: expectedTag });
      const path = await startProxyExports.getProxyBinaryPath(logger, features);

      t.assert(getDefaultCliVersion.calledOnce);
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Óscar San José	13efb23391	Merge pull request #3778 from github/backport-v3.35.0-b8bb9f28b Merge releases/v4 into releases/v3	2026-03-27 17:00:05 +01:00
github-actions[bot]	b1a5f00cf1	Rebuild	2026-03-27 12:23:35 +00:00
github-actions[bot]	124f6eec3b	Update version and changelog for v3.35.0	2026-03-27 12:18:22 +00:00
github-actions[bot]	a88fb3cde0	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.35.0-b8bb9f28b	2026-03-27 12:18:20 +00:00
github-actions[bot]	57d591c67c	Revert "Rebuild" This reverts commit `97fd992228`.	2026-03-27 12:18:20 +00:00
github-actions[bot]	dba1849cf2	Revert "Update version and changelog for v3.34.1" This reverts commit `95a562052b`.	2026-03-27 12:18:20 +00:00
Henry Mercer	ebcb5b36de	Merge pull request #3765 from github/backport-v3.34.1-386975555 Merge releases/v4 into releases/v3	2026-03-20 18:37:00 +00:00
github-actions[bot]	97fd992228	Rebuild	2026-03-20 18:19:37 +00:00
github-actions[bot]	95a562052b	Update version and changelog for v3.34.1	2026-03-20 18:16:44 +00:00
github-actions[bot]	ae8b37eb31	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.34.1-386975555	2026-03-20 18:16:42 +00:00
github-actions[bot]	d75030c604	Revert "Rebuild" This reverts commit `c146cd2193`.	2026-03-20 18:16:42 +00:00
github-actions[bot]	a777590c0f	Revert "Update version and changelog for v3.34.0" This reverts commit `3fef31e9b5`.	2026-03-20 18:16:41 +00:00
Óscar San José	dfad8f8ebc	Merge pull request #3590 from github/backport-v3.34.0-c6f931105 Merge releases/v4 into releases/v3	2026-03-20 16:15:08 +01:00
github-actions[bot]	c146cd2193	Rebuild	2026-03-20 12:03:47 +00:00
github-actions[bot]	3fef31e9b5	Update version and changelog for v3.34.0	2026-03-20 11:59:46 +00:00
github-actions[bot]	3d7478b23a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.34.0-c6f931105	2026-03-20 11:59:44 +00:00
github-actions[bot]	f874badee7	Revert "Rebuild" This reverts commit `9ed0d758ce`.	2026-03-20 11:59:44 +00:00
github-actions[bot]	1c3843e226	Revert "Update version and changelog for v3.33.0" This reverts commit `2da877a512`.	2026-03-20 11:59:44 +00:00
Michael B. Gale	603b797f8b	Merge pull request #3577 from github/backport-v3.33.0-b1bff8193 Merge releases/v4 into releases/v3	2026-03-16 12:23:22 +00:00
github-actions[bot]	9ed0d758ce	Rebuild	2026-03-16 11:10:08 +00:00
github-actions[bot]	2da877a512	Update version and changelog for v3.33.0	2026-03-16 09:08:36 +00:00
github-actions[bot]	4ccf9a5deb	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.33.0-b1bff8193	2026-03-16 09:08:34 +00:00
github-actions[bot]	e50ab6dc1d	Revert "Rebuild" This reverts commit `dabb34c95a`.	2026-03-16 09:08:33 +00:00
github-actions[bot]	ee6db5e4f5	Revert "Update version and changelog for v3.32.6" This reverts commit `c0e7770e36`.	2026-03-16 09:08:33 +00:00
Óscar San José	820e3160e2	Merge pull request #3553 from github/backport-v3.32.6-0d579ffd0 Merge releases/v4 into releases/v3	2026-03-06 10:44:37 +01:00
github-actions[bot]	dabb34c95a	Rebuild	2026-03-05 19:44:24 +00:00
github-actions[bot]	c0e7770e36	Update version and changelog for v3.32.6	2026-03-05 19:35:55 +00:00
github-actions[bot]	dbc2ac9b7a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.6-0d579ffd0	2026-03-05 19:35:54 +00:00
github-actions[bot]	e61b8b4cf5	Revert "Rebuild" This reverts commit `b58ecf644d`.	2026-03-05 19:35:53 +00:00
github-actions[bot]	b7ebceaf1a	Revert "Update version and changelog for v3.32.5" This reverts commit `e3632d0ee3`.	2026-03-05 19:35:53 +00:00
Henry Mercer	ae9ef3a1d2	Merge pull request #3533 from github/backport-v3.32.5-c793b717b Merge releases/v4 into releases/v3	2026-03-02 12:01:34 +00:00
github-actions[bot]	b58ecf644d	Rebuild	2026-03-02 11:34:55 +00:00
github-actions[bot]	e3632d0ee3	Update version and changelog for v3.32.5	2026-03-02 11:17:26 +00:00
github-actions[bot]	cdcb071e67	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.5-c793b717b	2026-03-02 11:17:25 +00:00
github-actions[bot]	177cb24be1	Revert "Rebuild" This reverts commit `a3696cdbdf`.	2026-03-02 11:17:24 +00:00
github-actions[bot]	2427cfc4a9	Revert "Update version and changelog for v3.32.4" This reverts commit `147ec67ee5`.	2026-03-02 11:17:23 +00:00
Michael B. Gale	45580472a5	Merge pull request #3496 from github/backport-v3.32.4-89a39a4e5	2026-02-20 15:34:23 +00:00
github-actions[bot]	a3696cdbdf	Rebuild	2026-02-20 14:52:56 +00:00
github-actions[bot]	147ec67ee5	Update version and changelog for v3.32.4	2026-02-20 14:21:14 +00:00
github-actions[bot]	acb91bd91f	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.4-89a39a4e5	2026-02-20 14:21:13 +00:00
github-actions[bot]	88d9aba91d	Revert "Rebuild" This reverts commit `70a71a57dd`.	2026-02-20 14:21:12 +00:00
github-actions[bot]	72edeaa05b	Revert "Update version and changelog for v3.32.3" This reverts commit `676a1ceb5c`.	2026-02-20 14:21:12 +00:00
Henry Mercer	f5c2471be7	Merge pull request #3481 from github/backport-v3.32.3-9e907b5e6 Merge releases/v4 into releases/v3	2026-02-13 12:21:24 +00:00
github-actions[bot]	70a71a57dd	Rebuild	2026-02-13 12:01:04 +00:00
github-actions[bot]	676a1ceb5c	Update version and changelog for v3.32.3	2026-02-13 11:55:54 +00:00
github-actions[bot]	e127ec2647	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.3-9e907b5e6	2026-02-13 11:55:52 +00:00
github-actions[bot]	f5e6f52190	Revert "Rebuild" This reverts commit `bb159524f9`.	2026-02-13 11:55:52 +00:00
github-actions[bot]	e2a90d3e23	Revert "Update version and changelog for v3.32.2" This reverts commit `6b68dd5d27`.	2026-02-13 11:55:52 +00:00
Henry Mercer	b5ebac6f4c	Merge pull request #3463 from github/backport-v3.32.2-45cbd0c69 Merge releases/v4 into releases/v3	2026-02-06 11:22:57 +00:00
github-actions[bot]	bb159524f9	Rebuild	2026-02-06 11:00:51 +00:00
github-actions[bot]	6b68dd5d27	Update version and changelog for v3.32.2	2026-02-05 17:12:29 +00:00
github-actions[bot]	24e739f51f	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.2-45cbd0c69	2026-02-05 17:12:25 +00:00
github-actions[bot]	e5a63de15c	Revert "Rebuild" This reverts commit `fd13ffa22c`.	2026-02-05 17:12:25 +00:00
github-actions[bot]	c2d57b0fc7	Revert "Update version and changelog for v3.32.1" This reverts commit `ce04bc5815`.	2026-02-05 17:12:24 +00:00
Henry Mercer	2588666de8	Merge pull request #3449 from github/backport-v3.32.1-6bc82e05f Merge releases/v4 into releases/v3	2026-02-02 07:47:27 -08:00
github-actions[bot]	fd13ffa22c	Rebuild	2026-02-02 15:21:36 +00:00
github-actions[bot]	ce04bc5815	Update version and changelog for v3.32.1	2026-02-02 15:14:15 +00:00
github-actions[bot]	27eb5f56eb	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.1-6bc82e05f	2026-02-02 15:14:12 +00:00
github-actions[bot]	44f67f0887	Revert "Rebuild" This reverts commit `f5ab452606`.	2026-02-02 15:14:12 +00:00
github-actions[bot]	5d24c86a89	Revert "Update version and changelog for v3.32.0" This reverts commit `56c8e1c8a8`.	2026-02-02 15:14:12 +00:00
Henry Mercer	439137e1b5	Merge pull request #3430 from github/backport-v3.32.0-b20883b0c Merge releases/v4 into releases/v3	2026-01-26 11:23:41 -08:00
github-actions[bot]	f5ab452606	Rebuild	2026-01-26 18:54:38 +00:00
github-actions[bot]	56c8e1c8a8	Update version and changelog for v3.32.0	2026-01-26 18:41:33 +00:00
github-actions[bot]	4f5ca6f9a5	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.0-b20883b0c	2026-01-26 18:41:32 +00:00
github-actions[bot]	92f3a2822b	Revert "Rebuild" This reverts commit `c9e0329cc4`.	2026-01-26 18:41:32 +00:00
github-actions[bot]	e9bf22fb0e	Revert "Update version and changelog for v3.31.11" This reverts commit `9ffacc75e8`.	2026-01-26 18:41:32 +00:00
Michael B. Gale	38e701f46e	Merge pull request #3419 from github/backport-v3.31.11-19b2f06db	2026-01-23 15:44:23 +00:00
github-actions[bot]	c9e0329cc4	Rebuild	2026-01-23 15:14:24 +00:00
github-actions[bot]	9ffacc75e8	Update version and changelog for v3.31.11	2026-01-23 13:56:12 +00:00
github-actions[bot]	21961f3b6f	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.11-19b2f06db	2026-01-23 13:56:10 +00:00
github-actions[bot]	8233700206	Revert "Rebuild" This reverts commit `6252d140cd`.	2026-01-23 13:56:10 +00:00
github-actions[bot]	23e84a39f0	Revert "Update version and changelog for v3.31.10" This reverts commit `84cf4b44bb`.	2026-01-23 13:56:09 +00:00
Ian Lynagh	4bdb89f480	Merge pull request #3396 from github/backport-v3.31.10-cdefb33c0 Merge releases/v4 into releases/v3	2026-01-12 16:26:37 +00:00
Michael B. Gale	ed629463c0	Set `using: node20` for `verify-debug-artifact-scan-completed` on `releases/v3`	2026-01-12 15:44:23 +00:00
github-actions[bot]	6252d140cd	Rebuild	2026-01-12 15:28:18 +00:00
github-actions[bot]	84cf4b44bb	Update version and changelog for v3.31.10	2026-01-12 14:37:46 +00:00
github-actions[bot]	52cebb523a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.10-cdefb33c0	2026-01-12 14:37:43 +00:00
github-actions[bot]	fc6e643fe1	Revert "Rebuild" This reverts commit `311b632b9d`.	2026-01-12 14:37:43 +00:00
github-actions[bot]	f8ee3fcc9a	Revert "Update version and changelog for v3.31.9" This reverts commit `d300581d5e`.	2026-01-12 14:37:43 +00:00
Henry Mercer	45c373516f	Merge pull request #3373 from github/backport-v3.31.9-5d4e8d1ac Merge releases/v4 into releases/v3	2025-12-16 19:21:59 +00:00
github-actions[bot]	311b632b9d	Rebuild	2025-12-16 18:51:43 +00:00
github-actions[bot]	d300581d5e	Update version and changelog for v3.31.9	2025-12-16 18:34:57 +00:00
github-actions[bot]	7348876640	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.9-5d4e8d1ac	2025-12-16 18:34:56 +00:00
github-actions[bot]	4f34645a82	Revert "Rebuild" This reverts commit `74951318a2`.	2025-12-16 18:34:56 +00:00
github-actions[bot]	e7c7a2d323	Revert "Update version and changelog for v3.31.8" This reverts commit `5676d1f64a`.	2025-12-16 18:34:56 +00:00
Óscar San José	f47c8e6a9b	Merge pull request #3357 from github/backport-v3.31.8-1b168cd39 Merge releases/v4 into releases/v3	2025-12-12 10:43:49 +01:00
github-actions[bot]	74951318a2	Rebuild	2025-12-12 08:53:47 +00:00
github-actions[bot]	5676d1f64a	Update version and changelog for v3.31.8	2025-12-12 08:46:33 +00:00
github-actions[bot]	c1bea80e56	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.8-1b168cd39	2025-12-12 08:46:32 +00:00
github-actions[bot]	2d9c0b97af	Revert "Rebuild" This reverts commit `817dbfb39b`.	2025-12-12 08:46:32 +00:00
github-actions[bot]	827017f97b	Revert "Update version and changelog for v3.31.7" This reverts commit `793f7006bb`.	2025-12-12 08:46:31 +00:00
Henry Mercer	bffd034ab1	Merge pull request #3346 from github/backport-v3.31.7-cf1bb45a2 Merge releases/v4 into releases/v3	2025-12-09 13:26:37 +00:00
github-actions[bot]	817dbfb39b	Rebuild	2025-12-05 20:45:51 +00:00
github-actions[bot]	793f7006bb	Update version and changelog for v3.31.7	2025-12-05 17:21:20 +00:00
github-actions[bot]	d2e9832330	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.7-cf1bb45a2	2025-12-05 17:21:19 +00:00
github-actions[bot]	c2e4b7785f	Revert "Rebuild" This reverts commit `89cb79a131`.	2025-12-05 17:21:18 +00:00
github-actions[bot]	66d7f51a10	Revert "Update version and changelog for v3.31.6" This reverts commit `dbf6819ebd`.	2025-12-05 17:21:18 +00:00
Michael B. Gale	497990dfed	Merge pull request #3338 from github/backport-v3.31.6-fe4161a26 Merge releases/v4 into releases/v3	2025-12-01 10:24:24 +00:00
github-actions[bot]	89cb79a131	Rebuild	2025-12-01 09:59:32 +00:00
github-actions[bot]	dbf6819ebd	Update version and changelog for v3.31.6	2025-12-01 09:52:51 +00:00
github-actions[bot]	5af51f4048	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.6-fe4161a26	2025-12-01 09:52:49 +00:00
github-actions[bot]	e439418aab	Revert "Rebuild" This reverts commit `c12d7c1f2d`.	2025-12-01 09:52:49 +00:00
github-actions[bot]	249860e323	Revert "Update version and changelog for v3.31.5" This reverts commit `2e2a1cf1ef`.	2025-12-01 09:52:49 +00:00
Paolo Tranquilli	d3ced5c96c	Merge pull request #3324 from github/backport-v3.31.5-fdbfb4d27 Merge releases/v4 into releases/v3	2025-11-24 12:16:57 +01:00
github-actions[bot]	c12d7c1f2d	Rebuild	2025-11-24 10:56:57 +00:00
github-actions[bot]	2e2a1cf1ef	Update version and changelog for v3.31.5	2025-11-24 09:33:54 +00:00
github-actions[bot]	e2cca77d06	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.5-fdbfb4d27	2025-11-24 09:33:53 +00:00
github-actions[bot]	801a18bea6	Revert "Rebuild" This reverts commit `9031cd9330`.	2025-11-24 09:33:52 +00:00
github-actions[bot]	1c715a714c	Revert "Update version and changelog for v3.31.4" This reverts commit `f58938aee2`.	2025-11-24 09:33:52 +00:00
Henry Mercer	c3d42c5d08	Merge pull request #3314 from github/backport-v3.31.4-e12f01789 Merge releases/v4 into releases/v3	2025-11-19 10:02:25 +00:00
github-actions[bot]	9031cd9330	Rebuild	2025-11-18 17:06:56 +00:00
github-actions[bot]	f58938aee2	Update version and changelog for v3.31.4	2025-11-18 16:16:32 +00:00
github-actions[bot]	1f1c162805	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.4-e12f01789	2025-11-18 16:16:30 +00:00
github-actions[bot]	7ab96a0e6f	Revert "Rebuild" This reverts commit `e5971bdba6`.	2025-11-18 16:16:30 +00:00
github-actions[bot]	e3cb86275a	Revert "Update version and changelog for v3.31.3" This reverts commit `c5a9d29dc9`.	2025-11-18 16:16:29 +00:00
Michael B. Gale	f94c9befff	Merge pull request #3295 from github/backport-v3.31.3-014f16e7a Merge releases/v4 into releases/v3	2025-11-13 22:45:46 +00:00
github-actions[bot]	e5971bdba6	Rebuild	2025-11-13 22:03:22 +00:00
github-actions[bot]	c5a9d29dc9	Update version and changelog for v3.31.3	2025-11-13 21:57:42 +00:00
github-actions[bot]	9f1109665d	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.3-014f16e7a	2025-11-13 21:57:40 +00:00
github-actions[bot]	f8f60f3a2b	Revert "Rebuild" This reverts commit `c6eb09db21`.	2025-11-13 21:57:40 +00:00
github-actions[bot]	f4d10b9ef7	Revert "Update version and changelog for v3.31.2" This reverts commit `09db9044dc`.	2025-11-13 21:57:39 +00:00
Henry Mercer	5d5cd550d3	Merge pull request #3263 from github/backport-v3.31.2-0499de31b Merge releases/v4 into releases/v3	2025-10-30 15:01:09 +00:00
github-actions[bot]	c6eb09db21	Rebuild	2025-10-30 14:37:32 +00:00
github-actions[bot]	09db9044dc	Update version and changelog for v3.31.2	2025-10-30 14:34:26 +00:00
github-actions[bot]	d3cd47d8d6	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.2-0499de31b	2025-10-30 14:34:25 +00:00
github-actions[bot]	8e9caa5100	Revert "Rebuild" This reverts commit `c2805e0a04`.	2025-10-30 14:34:25 +00:00
github-actions[bot]	23a6333b88	Revert "Update version and changelog for v3.31.1" This reverts commit `c0d3370b54`.	2025-10-30 14:34:24 +00:00
Henry Mercer	c503cb4fbb	Merge pull request #3254 from github/backport-v3.31.1-5fe9434cd Merge releases/v4 into releases/v3	2025-10-30 11:00:54 +00:00
github-actions[bot]	c2805e0a04	Rebuild	2025-10-30 10:35:44 +00:00
github-actions[bot]	c0d3370b54	Update version and changelog for v3.31.1	2025-10-30 10:31:02 +00:00
github-actions[bot]	ddd0dc746a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.1-5fe9434cd	2025-10-30 10:31:01 +00:00
github-actions[bot]	2f607936ce	Revert "Rebuild" This reverts commit `9e3918e481`.	2025-10-30 10:31:00 +00:00
github-actions[bot]	37e7dfbaa0	Revert "Update version and changelog for v3.31.0" This reverts commit `7dd1575dac`.	2025-10-30 10:31:00 +00:00
Michael B. Gale	d198d2fabf	Merge pull request #3237 from github/backport-v3.31.0-4e94bd11f Merge releases/v4 into releases/v3	2025-10-24 19:30:34 +01:00
github-actions[bot]	9e3918e481	Rebuild	2025-10-24 17:18:40 +00:00
github-actions[bot]	7dd1575dac	Update version and changelog for v3.31.0	2025-10-24 17:11:07 +00:00
github-actions[bot]	28fc48d83c	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.0-4e94bd11f	2025-10-24 17:11:06 +00:00
github-actions[bot]	12c6008004	Revert "Rebuild" This reverts commit `5f3f3164ad`.	2025-10-24 17:11:05 +00:00
github-actions[bot]	d3019effb0	Revert "Update version and changelog for v3.30.9" This reverts commit `ba42101490`.	2025-10-24 17:11:05 +00:00
Henry Mercer	42213152a8	Merge pull request #3216 from github/backport-v3.30.9-16140ae1a Merge releases/v4 into releases/v3	2025-10-17 17:09:13 +01:00
Henry Mercer	e677e67801	Run `setup-codeql` on Node 20 for v3	2025-10-17 16:53:18 +01:00
github-actions[bot]	5f3f3164ad	Rebuild	2025-10-17 15:34:40 +00:00
github-actions[bot]	ba42101490	Update version and changelog for v3.30.9	2025-10-17 15:24:34 +00:00
github-actions[bot]	f11af5849b	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.30.9-16140ae1a	2025-10-17 15:24:33 +00:00
github-actions[bot]	ba5430dc86	Revert "Rebuild" This reverts commit `948223fe01`.	2025-10-17 15:24:33 +00:00
github-actions[bot]	13e883e119	Revert "Update version and changelog for v3.30.8" This reverts commit `a37add20d4`.	2025-10-17 15:24:32 +00:00
Michael B. Gale	755f44910c	Merge pull request #3201 from github/backport-v3.30.8-2a6736cca Merge releases/v4 into releases/v3	2025-10-10 18:20:36 +01:00
github-actions[bot]	948223fe01	Rebuild	2025-10-10 16:56:34 +00:00
github-actions[bot]	a37add20d4	Update version and changelog for v3.30.8	2025-10-10 16:50:13 +00:00
github-actions[bot]	ab163cf08b	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.30.8-2a6736cca	2025-10-10 16:50:12 +00:00
github-actions[bot]	319796f085	Revert "Rebuild" This reverts commit `c551c50310`.	2025-10-10 16:50:12 +00:00
github-actions[bot]	bd1ac56295	Revert "Update version and changelog for v3.30.7" This reverts commit `b264e15259`.	2025-10-10 16:50:12 +00:00
Mario Campos	a8d1ac45b9	Merge pull request #3187 from github/backport-v3.30.7-e296a9355 Merge releases/v4 into releases/v3	2025-10-07 10:58:53 -05:00
github-actions[bot]	c551c50310	Rebuild	2025-10-07 15:33:29 +00:00
Mario Campos	01f1a24033	Downgrade action.yml to use Node.js 20 instead of Node.js 24 for v3	2025-10-07 10:29:22 -05:00
github-actions[bot]	b264e15259	Update version and changelog for v3.30.7	2025-10-07 15:23:05 +00:00