Test switching windows-latest to windows-2025

.github/actions/prepare-mergeback-branch/action.yml

@@ -1,80 +0,0 @@
-name: "Prepare mergeback branch"
-description: Prepares a mergeback branch and opens a PR for it
-inputs:
-  base:
-    description: "The name of the base branch"
-    required: true
-  head:
-    description: "The name of the head branch"
-    required: true
-  branch:
-    description: "The name of the branch to create."
-    required: true
-  version:
-    description: "The new version"
-    required: true
-  token:
-    description: "The token to use"
-    required: true
-  dry-run:
-    description: "Set to true to skip creating the PR. The branch will still be pushed."
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Create mergeback branch
-      shell: bash
-      env:
-        VERSION: "${{ inputs.version }}"
-        NEW_BRANCH: "${{ inputs.branch }}"
-      run: |
-        set -exu
-
-        # Ensure we are on the new branch
-        git checkout "${NEW_BRANCH}"
-
-        # Update the version number ready for the next release
-        npm version patch --no-git-tag-version
-
-        # Update the changelog, adding a new version heading directly above the most recent existing one
-        awk '!f && /##/{print "'"## [UNRELEASED]\n\nNo user facing changes.\n"'"; f=1}1' CHANGELOG.md > temp && mv temp CHANGELOG.md
-        git add .
-        git commit -m "Update changelog and version after ${VERSION}"
-
-        git push origin "${NEW_BRANCH}"
-
-    - name: Create PR
-      shell: bash
-      if: inputs.dry-run != 'true'
-      env:
-        VERSION: "${{ inputs.version }}"
-        BASE_BRANCH: "${{ inputs.base }}"
-        HEAD_BRANCH: "${{ inputs.head }}"
-        NEW_BRANCH: "${{ inputs.branch }}"
-        GITHUB_TOKEN: "${{ inputs.token }}"
-      run: |
-        set -exu
-        pr_title="Mergeback ${VERSION} ${HEAD_BRANCH} into ${BASE_BRANCH}"
-        pr_body=$(cat << EOF
-          This PR bumps the version number and updates the changelog after the ${VERSION} release.
-
-          Please do the following:
-
-          - [ ] Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
-          - [ ] Wait for the "Rebuild" workflow to push a commit updating the distribution files.
-          - [ ] Mark the PR as ready for review to trigger the full set of PR checks.
-          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
-                selected rather than "Squash and merge" or "Rebase and merge".
-        EOF
-        )
-
-        # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft
-        # so that a maintainer can take the PR out of draft, thereby triggering the PR checks.
-        gh pr create \
-          --head "${NEW_BRANCH}" \
-          --base "${BASE_BRANCH}" \
-          --title "${pr_title}" \
-          --label "Rebuild" \
-          --body "${pr_body}" \
-          --assignee "${GITHUB_ACTOR}" \
-          --draft

.github/actions/prepare-test/action.yml

@@ -2,7 +2,7 @@ name: "Prepare test"
 description: Performs some preparation to run tests
 inputs:
   version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
+    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
     required: true
   use-all-platform-bundle:
     description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
@@ -35,10 +35,7 @@ runs:
       run: |
         set -e # Fail this Action if `gh release list` fails.
 
-        if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
-          echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
-          exit 0
-        elif [[ "$VERSION" == "linked" ]]; then
+        if [[ "$VERSION" == "linked" ]]; then
           echo "tools-url=linked" >> "$GITHUB_OUTPUT"
           exit 0
         elif [[ "$VERSION" == "default" ]]; then
@@ -46,20 +43,29 @@ runs:
           exit 0
         fi
 
+        if [[ "$VERSION" == "nightly-latest" && "$RUNNER_OS" != "Windows" ]]; then
+          extension="tar.zst"
+        else
+          extension="tar.gz"
+        fi
+
         if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
-          artifact_name="codeql-bundle.tar.gz"
+          artifact_name="codeql-bundle.$extension"
         elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          artifact_name="codeql-bundle-linux64.tar.gz"
+          artifact_name="codeql-bundle-linux64.$extension"
         elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          artifact_name="codeql-bundle-osx64.tar.gz"
+          artifact_name="codeql-bundle-osx64.$extension"
         elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          artifact_name="codeql-bundle-win64.tar.gz"
+          artifact_name="codeql-bundle-win64.$extension"
         else
           echo "::error::Unrecognized OS $RUNNER_OS"
           exit 1
         fi
 
-        if [[ "$VERSION" == *"nightly"* ]]; then
+        if [[ "$VERSION" == "nightly-latest" ]]; then
+          tag=`gh release list --repo dsp-testing/codeql-cli-nightlies -L 1 | cut -f 3`
+          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/$artifact_name" >> $GITHUB_OUTPUT
+        elif [[ "$VERSION" == *"nightly"* ]]; then
           version=`echo "$VERSION" | sed -e 's/^.*\-//'`
           echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
         elif [[ "$VERSION" == *"stable"* ]]; then

.github/actions/setup-swift/action.yml

@@ -0,0 +1,39 @@
+name: "Set up Swift on Linux"
+description: Sets up an appropriate Swift version on Linux.
+inputs:
+  codeql-path:
+    description: Path to the CodeQL CLI executable.
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Get Swift version
+      id: get_swift_version
+      if: runner.os == 'Linux'
+      shell: bash
+      env:
+        CODEQL_PATH: ${{ inputs.codeql-path }}
+      run: |
+        SWIFT_EXTRACTOR_DIR="$("$CODEQL_PATH" resolve languages --format json | jq -r '.swift[0]')"
+        if [ $SWIFT_EXTRACTOR_DIR = "null" ]; then
+          VERSION="null"
+        else
+          VERSION="$("$SWIFT_EXTRACTOR_DIR/tools/linux64/extractor" --version | awk '/version/ { print $3 }')"
+          # Specify 5.x.0, otherwise setup Action will default to latest minor version.
+          if [ $VERSION = "5.7" ]; then
+            VERSION="5.7.0"
+          elif [ $VERSION = "5.8" ]; then
+            VERSION="5.8.0"
+          elif [ $VERSION = "5.9" ]; then
+            VERSION="5.9.0"
+          # setup-swift does not yet support v5.9.1 Remove this when it does.
+          elif [ $VERSION = "5.9.1" ]; then
+            VERSION="5.9.0"
+          fi
+        fi
+        echo "version=$VERSION" | tee -a $GITHUB_OUTPUT
+
+    - uses: redsun82/setup-swift@362f49f31da2f5f4f851657046bdd1290d03edc8 # Please update the corresponding SHA in the CLI's CodeQL Action Integration Test.
+      if: runner.os == 'Linux' && steps.get_swift_version.outputs.version != 'null'
+      with:
+        swift-version: "${{ steps.get_swift_version.outputs.version }}"

.github/codeql/codeql-actions-config.yml

@@ -0,0 +1,4 @@
+# Configuration for the CodeQL Actions Queries
+name: "CodeQL Actions Queries config"
+queries:
+  - uses: security-and-quality

.github/codeql/codeql-config.yml

@@ -7,9 +7,9 @@ queries:
   # we include both even though one is a superset of the
   # other, because we're testing the parsing logic and
   # that the suites exist in the codeql bundle.
-  - uses: security-and-quality
   - uses: security-experimental
   - uses: security-extended
+  - uses: security-and-quality
 paths-ignore:
-  - lib
   - tests
+  - lib

.github/dependabot.yml

@@ -5,12 +5,15 @@ updates:
     schedule:
       interval: weekly
     labels:
-      - Rebuild
+      - Update dependencies
     # Ignore incompatible dependency updates
     ignore:
       # There is a type incompatibility issue between v0.0.9 and our other dependencies.
       - dependency-name: "@octokit/plugin-retry"
         versions: ["~6.0.0"]
+      # v7 requires ESM
+      - dependency-name: "del"
+        versions: ["^7.0.0"]
       # This is broken due to the way configuration files have changed. 
       # This might be fixed when we move to eslint v9.
       - dependency-name: "eslint-plugin-import"

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-<!-- For GitHub staff: Remember that this is a public repository. -->
+
 
 ### Risk assessment
 

.github/update-release-branch.py

@@ -97,8 +97,8 @@ def open_pr(
   body.append(' - [ ] Ensure the docs team is aware of any documentation changes that need to be released.')
 
   if not is_primary_release:
-    body.append(' - [ ] Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.')
-    body.append(' - [ ] Wait for the "Rebuild" workflow to push a commit updating the distribution files.')
+    body.append(' - [ ] Remove and re-add the "Update dependencies" label to the PR to trigger just this workflow.')
+    body.append(' - [ ] Wait for the "Update dependencies" workflow to push a commit updating the dependencies.')
 
   body.append(' - [ ] Mark the PR as ready for review to trigger the full set of PR checks.')
   body.append(' - [ ] Approve and merge this PR. Make sure `Create a merge commit` is selected rather than `Squash and merge` or `Rebase and merge`.')
@@ -108,7 +108,7 @@ def open_pr(
     body.append(' - [ ] Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.')
 
   title = f'Merge {source_branch} into {target_branch}'
-  labels = ['Rebuild'] if not is_primary_release else []
+  labels = ['Update dependencies'] if not is_primary_release else []
 
   # Create the pull request
   # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft so that
@@ -389,7 +389,7 @@ def main():
 
     # Migrate the package version number from a vLatest version number to a vOlder version number
     print(f'Setting version number to {version} in package.json')
-    replace_version_package_json(get_current_version(), version) # We rely on the `Rebuild` workflow to update package-lock.json
+    replace_version_package_json(get_current_version(), version) # We rely on the `Update dependencies` workflow to update package-lock.json
     run_git('add', 'package.json')
 
     # Migrate the changelog notes from vLatest version numbers to vOlder version numbers

.github/workflows/__all-platform-bundle.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   all-platform-bundle:
     strategy:
@@ -76,6 +70,7 @@ jobs:
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__analyze-ref-input.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   analyze-ref-input:
     strategy:
@@ -50,7 +44,7 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
     permissions:
@@ -80,6 +74,7 @@ jobs:
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:

.github/workflows/__autobuild-action.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   autobuild-action:
     strategy:
@@ -40,7 +34,7 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: autobuild-action
     permissions:
@@ -73,6 +67,7 @@ jobs:
           CORECLR_PROFILER_PATH_64: ''
       - uses: ./../action/analyze
       - name: Check database
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d csharp ]]; then

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Java to install
         required: false
         default: '17'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   autobuild-direct-tracing-with-working-dir:
     strategy:
@@ -48,11 +42,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
     permissions:
@@ -71,11 +65,12 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
       - name: Test setup
+        shell: bash
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
           cp -a ../action/tests/java-repo autobuild-dir
@@ -87,6 +82,7 @@ jobs:
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Check that indirect tracing is disabled
+        shell: bash
         run: |
           if [[ ! -z "${CODEQL_RUNNER}" ]]; then
             echo "Expected indirect tracing to be disabled, but the" \

.github/workflows/__autobuild-direct-tracing.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Java to install
         required: false
         default: '17'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   autobuild-direct-tracing:
     strategy:
@@ -48,11 +42,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Autobuild direct tracing
     permissions:
@@ -71,11 +65,12 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
       - name: Set up Java test repo configuration
+        shell: bash
         run: |
           mv * .github ../action/tests/multi-language-repo/
           mv ../action/tests/multi-language-repo/.github/workflows .github
@@ -90,6 +85,7 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
       - name: Check that indirect tracing is disabled
+        shell: bash
         run: |
           if [[ ! -z "${CODEQL_RUNNER}" ]]; then
             echo "Expected indirect tracing to be disabled, but the" \

.github/workflows/__build-mode-autobuild.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build-mode-autobuild:
     strategy:

.github/workflows/__build-mode-manual.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build-mode-manual:
     strategy:
@@ -87,6 +81,7 @@ jobs:
           fi
 
       - name: Build code
+        shell: bash
         run: ./build.sh
 
       - uses: ./../action/analyze

.github/workflows/__build-mode-none.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build-mode-none:
     strategy:

.github/workflows/__build-mode-rollback.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build-mode-rollback:
     strategy:

.github/workflows/__bundle-toolcache.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   bundle-toolcache:
     strategy:
@@ -40,7 +34,7 @@ jobs:
             version: linked
           - os: ubuntu-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: 'Bundle: Caching checks'
     permissions:

.github/workflows/__bundle-zstd.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   bundle-zstd:
     strategy:
@@ -40,7 +34,7 @@ jobs:
             version: linked
           - os: ubuntu-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: 'Bundle: Zstandard checks'
     permissions:

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   cleanup-db-cluster-dir:
     strategy:

.github/workflows/__config-export.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   config-export:
     strategy:
@@ -40,13 +34,13 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Config export
     permissions:

.github/workflows/__config-input.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   config-input:
     strategy:
@@ -47,13 +41,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install dependencies
-        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-disabled.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   cpp-deptrace-disabled:
     strategy:
@@ -59,6 +53,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
+        shell: bash
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
       - uses: ./../action/init
@@ -70,7 +65,8 @@ jobs:
           working-directory: autobuild-dir
         env:
           CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: false
-      - run: |
+      - shell: bash
+        run: |
           if ls /usr/bin/errno; then
             echo "C/C++ autobuild installed errno, but it should not have since auto-install dependencies is disabled."
             exit 1

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   cpp-deptrace-enabled-on-macos:
     strategy:
@@ -57,6 +51,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
+        shell: bash
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
       - uses: ./../action/init
@@ -68,7 +63,8 @@ jobs:
           working-directory: autobuild-dir
         env:
           CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-      - run: |
+      - shell: bash
+        run: |
           if ! ls /usr/bin/errno; then
             echo "As expected, CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES is a no-op on macOS"
           else

.github/workflows/__cpp-deptrace-enabled.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   cpp-deptrace-enabled:
     strategy:
@@ -59,6 +53,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
+        shell: bash
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
       - uses: ./../action/init
@@ -70,7 +65,8 @@ jobs:
           working-directory: autobuild-dir
         env:
           CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-      - run: |
+      - shell: bash
+        run: |
           if ! ls /usr/bin/errno; then
             echo "Did not autoinstall errno"
             exit 1

.github/workflows/__diagnostics-export.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   diagnostics-export:
     strategy:
@@ -40,13 +34,13 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Diagnostic export
     permissions:
@@ -70,6 +64,7 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Add test diagnostics
+        shell: bash
         env:
           CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
         run: |

.github/workflows/__export-file-baseline-information.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   export-file-baseline-information:
     strategy:
@@ -50,7 +44,7 @@ jobs:
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Export file baseline information
     permissions:
@@ -78,7 +72,12 @@ jobs:
         with:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - uses: ./../action/.github/actions/setup-swift
+        if: runner.os == 'macOS'
+        with:
+          codeql-path: ${{ steps.init.outputs.codeql-path }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -90,6 +89,7 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           expected_baseline_languages="c csharp go java kotlin javascript python ruby"

.github/workflows/__extractor-ram-threads.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   extractor-ram-threads:
     strategy:
@@ -60,6 +54,7 @@ jobs:
           ram: 230
           threads: 1
       - name: Assert Results
+        shell: bash
         run: |
           if [ "${CODEQL_RAM}" != "230" ]; then
             echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"

.github/workflows/__go-custom-queries.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-custom-queries:
     strategy:
@@ -77,6 +71,7 @@ jobs:
           config-file: ./.github/codeql/custom-queries.yml
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-indirect-tracing-workaround-diagnostic:
     strategy:
@@ -78,6 +72,7 @@ jobs:
         with:
           go-version: '1.20'
       - name: Build code
+        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
         with:

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-indirect-tracing-workaround-no-file-program:
     strategy:
@@ -79,6 +73,7 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
         with:

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-indirect-tracing-workaround:
     strategy:
@@ -74,9 +68,11 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
-      - run: |
+      - shell: bash
+        run: |
           if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then
             echo "Expected the workaround for indirect tracing of static binaries to trigger, but the" \
               "CODEQL_ACTION_GO_BINARY environment variable is not set."

.github/workflows/__go-tracing-autobuilder.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-tracing-autobuilder:
     strategy:
@@ -66,10 +60,6 @@ jobs:
             version: stable-v2.21.4
           - os: macos-latest
             version: stable-v2.21.4
-          - os: ubuntu-latest
-            version: stable-v2.22.4
-          - os: macos-latest
-            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
@@ -109,7 +99,8 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/autobuild
       - uses: ./../action/analyze
-      - run: |
+      - shell: bash
+        run: |
           if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
             echo "Expected the Go autobuilder to be run, but the" \
               "CODEQL_ACTION_DID_AUTOBUILD_GOLANG environment variable was not true."

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-tracing-custom-build-steps:
     strategy:
@@ -66,10 +60,6 @@ jobs:
             version: stable-v2.21.4
           - os: macos-latest
             version: stable-v2.21.4
-          - os: ubuntu-latest
-            version: stable-v2.22.4
-          - os: macos-latest
-            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
@@ -108,9 +98,11 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: go build main.go
       - uses: ./../action/analyze
-      - run: |
+      - shell: bash
+        run: |
           # Once we start running Bash 4.2 in all environments, we can replace the
           # `! -z` flag with the more elegant `-v` which confirms that the variable
           # is actually unset and not potentially set to a blank value.

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   go-tracing-legacy-workflow:
     strategy:
@@ -66,10 +60,6 @@ jobs:
             version: stable-v2.21.4
           - os: macos-latest
             version: stable-v2.21.4
-          - os: ubuntu-latest
-            version: stable-v2.22.4
-          - os: macos-latest
-            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
@@ -108,7 +98,8 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
-      - run: |
+      - shell: bash
+        run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d go ]]; then
             echo "Did not find a Go database"

.github/workflows/__init-with-registries.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   init-with-registries:
     strategy:
@@ -40,19 +34,19 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: 'Packaging: Download using registries'
     permissions:
@@ -84,6 +78,7 @@ jobs:
               token: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Verify packages installed
+        shell: bash
         run: |
           PRIVATE_PACK="$HOME/.codeql/packages/codeql-testing/private-pack"
           CODEQL_PACK1="$HOME/.codeql/packages/codeql-testing/codeql-pack1"
@@ -105,6 +100,7 @@ jobs:
           fi
 
       - name: Verify qlconfig.yml file was created
+        shell: bash
         run: |
           QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
           echo "Expected qlconfig.yml file to be created at $QLCONFIG_PATH"
@@ -119,6 +115,7 @@ jobs:
       - name: Verify contents of qlconfig.yml
     # yq is not available on windows
         if: runner.os != 'Windows'
+        shell: bash
         run: |
           QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
           cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'

.github/workflows/__javascript-source-root.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   javascript-source-root:
     strategy:
@@ -59,6 +53,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Move codeql-action
+        shell: bash
         run: |
           mkdir ../new-source-root
           mv * ../new-source-root
@@ -71,6 +66,7 @@ jobs:
         with:
           skip-queries: true
       - name: Assert database exists
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d javascript ]]; then

.github/workflows/__job-run-uuid-sarif.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   job-run-uuid-sarif:
     strategy:
@@ -69,6 +63,7 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)

.github/workflows/__language-aliases.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   language-aliases:
     strategy:

.github/workflows/__multi-language-autodetect.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   multi-language-autodetect:
     strategy:
@@ -66,10 +60,6 @@ jobs:
             version: stable-v2.21.4
           - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: macos-latest
-            version: stable-v2.22.4
-          - os: ubuntu-latest
-            version: stable-v2.22.4
           - os: macos-latest
             version: default
           - os: ubuntu-latest
@@ -103,10 +93,6 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
-      - name: Use Xcode 16
-        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
-        run: sudo xcode-select -s "/Applications/Xcode_16.app"
-
       - uses: ./../action/init
         id: init
         with:
@@ -115,7 +101,13 @@ jobs:
             || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
+      - uses: ./../action/.github/actions/setup-swift
+        if: runner.os == 'macOS'
+        with:
+          codeql-path: ${{ steps.init.outputs.codeql-path }}
+
       - name: Build code
+        shell: bash
         run: ./build.sh
 
       - uses: ./../action/analyze
@@ -124,6 +116,7 @@ jobs:
           upload-database: false
 
       - name: Check language autodetect for all languages excluding Swift
+        shell: bash
         run: |
           CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
           if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -163,6 +156,7 @@ jobs:
 
       - name: Check language autodetect for Swift on macOS
         if: runner.os == 'macOS'
+        shell: bash
         run: |
           SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
           if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -170,5 +164,4 @@ jobs:
             exit 1
           fi
     env:
-      CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__overlay-init-fallback.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   overlay-init-fallback:
     strategy:
@@ -67,6 +61,7 @@ jobs:
         with:
           upload-database: false
       - name: Check database
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases/actions"
           if ! grep -q 'overlayBaseDatabase: false' codeql-database.yml ; then

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   packaging-codescanning-config-inputs-js:
     strategy:
@@ -50,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
     permissions:
@@ -73,13 +67,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install dependencies
-        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -99,6 +86,7 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -114,6 +102,7 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__packaging-config-inputs-js.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   packaging-config-inputs-js:
     strategy:
@@ -50,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: 'Packaging: Config and input'
     permissions:
@@ -73,13 +67,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install dependencies
-        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -99,6 +86,7 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -114,6 +102,7 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__packaging-config-js.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   packaging-config-js:
     strategy:
@@ -50,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: 'Packaging: Config file'
     permissions:
@@ -73,13 +67,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install dependencies
-        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -98,6 +85,7 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -113,6 +101,7 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__packaging-inputs-js.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   packaging-inputs-js:
     strategy:
@@ -50,19 +44,19 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: 'Packaging: Action input'
     permissions:
@@ -73,13 +67,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install dependencies
-        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -99,6 +86,7 @@ jobs:
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -113,6 +101,7 @@ jobs:
           queries-not-run: foo,bar
 
       - name: Assert Results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__quality-queries.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   quality-queries:
     strategy:
@@ -38,58 +32,16 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
-            analysis-kinds: code-scanning
-          - os: ubuntu-latest
-            version: linked
-            analysis-kinds: code-quality
-          - os: ubuntu-latest
-            version: linked
-            analysis-kinds: code-scanning,code-quality
           - os: macos-latest
             version: linked
-            analysis-kinds: code-scanning
-          - os: macos-latest
+          - os: windows-2025
             version: linked
-            analysis-kinds: code-quality
-          - os: macos-latest
-            version: linked
-            analysis-kinds: code-scanning,code-quality
-          - os: windows-latest
-            version: linked
-            analysis-kinds: code-scanning
-          - os: windows-latest
-            version: linked
-            analysis-kinds: code-quality
-          - os: windows-latest
-            version: linked
-            analysis-kinds: code-scanning,code-quality
           - os: ubuntu-latest
             version: nightly-latest
-            analysis-kinds: code-scanning
-          - os: ubuntu-latest
-            version: nightly-latest
-            analysis-kinds: code-quality
-          - os: ubuntu-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning,code-quality
           - os: macos-latest
             version: nightly-latest
-            analysis-kinds: code-scanning
-          - os: macos-latest
+          - os: windows-2025
             version: nightly-latest
-            analysis-kinds: code-quality
-          - os: macos-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning,code-quality
-          - os: windows-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning
-          - os: windows-latest
-            version: nightly-latest
-            analysis-kinds: code-quality
-          - os: windows-latest
-            version: nightly-latest
-            analysis-kinds: code-scanning,code-quality
     name: Quality queries input
     permissions:
       contents: read
@@ -109,30 +61,25 @@ jobs:
       - uses: ./../action/init
         with:
           languages: javascript
-          analysis-kinds: ${{ matrix.analysis-kinds }}
+          quality-queries: code-quality
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Upload security SARIF
-        if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/upload-artifact@v4
         with:
-          name: |
-            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
+          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Upload quality SARIF
-        if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/upload-artifact@v4
         with:
-          name: |
-            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
+          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.quality.sarif.json
           path: ${{ runner.temp }}/results/javascript.quality.sarif
           retention-days: 7
       - name: Check quality query does not appear in security SARIF
-        if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
@@ -140,7 +87,6 @@ jobs:
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
-        if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif

.github/workflows/__remote-config.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   remote-config:
     strategy:
@@ -78,6 +72,7 @@ jobs:
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__resolve-environment-action.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   resolve-environment-action:
     strategy:
@@ -40,19 +34,19 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
           - os: ubuntu-latest
             version: nightly-latest
           - os: macos-latest
             version: nightly-latest
-          - os: windows-latest
+          - os: windows-2025
             version: nightly-latest
     name: Resolve environment
     permissions:

.github/workflows/__rubocop-multi-language.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   rubocop-multi-language:
     strategy:
@@ -55,14 +49,17 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
+        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 # v1.254.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration
+        shell: bash
         run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
       - name: Install dependencies
+        shell: bash
         run: bundle install
       - name: RuboCop run
+        shell: bash
         run: |
           bash -c "
             bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif

.github/workflows/__ruby.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   ruby:
     strategy:
@@ -73,6 +67,7 @@ jobs:
         with:
           upload-database: false
       - name: Check database
+        shell: bash
         run: |
           RUBY_DB="${{ fromJson(steps.analysis.outputs.db-locations).ruby }}"
           if [[ ! -d "$RUBY_DB" ]]; then

.github/workflows/__rust.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   rust:
     strategy:
@@ -71,6 +65,7 @@ jobs:
         with:
           upload-database: false
       - name: Check database
+        shell: bash
         run: |
           RUST_DB="${{ fromJson(steps.analysis.outputs.db-locations).rust }}"
           if [[ ! -d "$RUST_DB" ]]; then

.github/workflows/__split-workflow.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   split-workflow:
     strategy:
@@ -86,6 +80,7 @@ jobs:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         with:
@@ -94,6 +89,7 @@ jobs:
           upload-database: false
 
       - name: Assert No Results
+        shell: bash
         run: |
           if [ "$(ls -A $RUNNER_TEMP/results)" ]; then
             echo "Expected results directory to be empty after skipping query execution!"
@@ -104,6 +100,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Assert Results
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/results"
           # We should have 4 hits from these rules

.github/workflows/__start-proxy.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   start-proxy:
     strategy:
@@ -40,7 +34,7 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: Start proxy
     permissions:

.github/workflows/__submit-sarif-failure.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   submit-sarif-failure:
     strategy:

.github/workflows/__swift-autobuild.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   swift-autobuild:
     strategy:
@@ -60,7 +54,11 @@ jobs:
           languages: swift
           build-mode: autobuild
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - uses: ./../action/.github/actions/setup-swift
+        with:
+          codeql-path: ${{steps.init.outputs.codeql-path}}
       - name: Check working directory
+        shell: bash
         run: pwd
       - uses: ./../action/autobuild
         timeout-minutes: 30
@@ -69,6 +67,7 @@ jobs:
         with:
           upload-database: false
       - name: Check database
+        shell: bash
         run: |
           SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
           if [[ ! -d "$SWIFT_DB" ]]; then

.github/workflows/__swift-custom-build.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   swift-custom-build:
     strategy:
@@ -73,23 +67,26 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
-      - name: Use Xcode 16
-        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
-        run: sudo xcode-select -s "/Applications/Xcode_16.app"
       - uses: ./../action/init
         id: init
         with:
           languages: swift
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - uses: ./../action/.github/actions/setup-swift
+        with:
+          codeql-path: ${{steps.init.outputs.codeql-path}}
       - name: Check working directory
+        shell: bash
         run: pwd
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis
         with:
           upload-database: false
       - name: Check database
+        shell: bash
         run: |
           SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
           if [[ ! -d "$SWIFT_DB" ]]; then

.github/workflows/__test-autobuild-working-dir.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   test-autobuild-working-dir:
     strategy:
@@ -55,6 +49,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Test setup
+        shell: bash
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
           cp -a ../action/tests/java-repo autobuild-dir
@@ -69,6 +64,7 @@ jobs:
           working-directory: autobuild-dir
       - uses: ./../action/analyze
       - name: Check database
+        shell: bash
         run: |
           cd "$RUNNER_TEMP/codeql_databases"
           if [[ ! -d java ]]; then

.github/workflows/__test-local-codeql.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   test-local-codeql:
     strategy:
@@ -47,7 +41,7 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            version: linked
+            version: nightly-latest
     name: Local CodeQL bundle
     permissions:
       contents: read
@@ -69,9 +63,12 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
-      - name: Fetch latest CodeQL bundle
+      - name: Fetch a CodeQL bundle
+        shell: bash
+        env:
+          CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
         run: |
-          wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst
+          wget "$CODEQL_URL"
       - id: init
         uses: ./../action/init
         with:
@@ -79,6 +76,7 @@ jobs:
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ./codeql-bundle-linux64.tar.zst
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
     env:

.github/workflows/__test-proxy.yml

@@ -24,12 +24,6 @@ on:
     inputs: {}
   workflow_call:
     inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   test-proxy:
     strategy:

.github/workflows/__unset-environment.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   unset-environment:
     strategy:
@@ -79,12 +73,14 @@ jobs:
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
+        shell: bash
         run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
       - uses: ./../action/analyze
         id: analysis
         with:
           upload-database: false
-      - run: |
+      - shell: bash
+        run: |
           CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
           if [[ ! -d "$CPP_DB" ]] || [[ ! "$CPP_DB" == "${RUNNER_TEMP}/customDbLocation/cpp" ]]; then
             echo "::error::Did not create a database for CPP, or created it in the wrong location." \

.github/workflows/__upload-quality-sarif.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   upload-quality-sarif:
     strategy:
@@ -50,7 +44,7 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
     name: 'Upload-sarif: code quality endpoint'
     permissions:
@@ -76,9 +70,12 @@ jobs:
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
-          languages: csharp,java,javascript,python
-          analysis-kinds: code-quality
+          languages: cpp,csharp,java,javascript,python
+          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
+            github.sha }}
+          quality-queries: code-quality
       - name: Build code
+        shell: bash
         run: ./build.sh
   # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
@@ -87,12 +84,8 @@ jobs:
           sha: 5e235361806c361d4d3f8859e3c897658025a9a2
           upload: never
       - uses: ./../action/upload-sarif
-        id: upload-sarif
         with:
           ref: refs/heads/main
           sha: 5e235361806c361d4d3f8859e3c897658025a9a2
-      - name: Check output from `upload-sarif` step
-        if: fromJSON(steps.upload-sarif.outputs.sarif-ids)[0].analysis != 'code-quality'
-        run: exit 1
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   upload-ref-sha-input:
     strategy:
@@ -50,7 +44,7 @@ jobs:
             version: default
           - os: macos-latest
             version: default
-          - os: windows-latest
+          - os: windows-2025
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
     permissions:
@@ -80,6 +74,7 @@ jobs:
           config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
             github.sha }}
       - name: Build code
+        shell: bash
         run: ./build.sh
   # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze

.github/workflows/__with-checkout-path.yml

@@ -34,12 +34,6 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   with-checkout-path:
     strategy:
@@ -50,7 +44,7 @@ jobs:
             version: linked
           - os: macos-latest
             version: linked
-          - os: windows-latest
+          - os: windows-2025
             version: linked
     name: Use a custom `checkout_path`
     permissions:
@@ -74,6 +68,7 @@ jobs:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Delete original checkout
+        shell: bash
         run: |
           # delete the original checkout so we don't accidentally use it.
           # Actions does not support deleting the current working directory, so we
@@ -94,6 +89,7 @@ jobs:
           source-root: x/y/z/some-path/tests/multi-language-repo
 
       - name: Build code
+        shell: bash
         working-directory: x/y/z/some-path/tests/multi-language-repo
         run: |
           ./build.sh
@@ -105,6 +101,7 @@ jobs:
           sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
 
       - name: Verify SARIF after upload
+        shell: bash
         run: |
           EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
           EXPECTED_REF="v1.1.0"

.github/workflows/check-expected-release-files.yml

@@ -9,10 +9,6 @@ on:
     # by other workflows.
     types: [opened, synchronize, reopened, ready_for_review]
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   check-expected-release-files:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -13,10 +13,6 @@ on:
     - cron: '30 1 * * 0'
   workflow_dispatch:
 
-defaults:
-  run:
-    shell: bash
-
 env:
   CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
@@ -95,29 +91,22 @@ jobs:
       id: init
       with:
         languages: javascript
-        config-file: ./.github/codeql/codeql-config-javascript.yml
+        config-file: ./.github/codeql/codeql-config.yml
         tools: ${{ matrix.tools }}
     # confirm steps.init.outputs.codeql-path points to the codeql binary
     - name: Print CodeQL Version
-      run: >
-        "$CODEQL" version --format=json
-      env:
-        CODEQL: ${{steps.init.outputs.codeql-path}}
+      run: ${{steps.init.outputs.codeql-path}} version --format=json
     - name: Perform CodeQL Analysis
       uses: ./analyze
       with:
         category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}
 
-  analyze-other:
+
+  analyze-actions:
     runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - language: actions
-          - language: python
 
     permissions:
       contents: read
@@ -129,15 +118,9 @@ jobs:
     - name: Initialize CodeQL
       uses: ./init
       with:
-        languages: ${{ matrix.language }}
-        build-mode: none
-        config: >
-          paths-ignore:
-            - lib
-            - tests
-          queries:
-            - uses: security-and-quality
+        languages: actions
+        config-file: ./.github/codeql/codeql-actions-config.yml
     - name: Perform CodeQL Analysis
       uses: ./analyze
       with:
-        category: "/language:${{ matrix.language }}"
+        category: "/language:actions"

.github/workflows/codescanning-config-cli.yml

@@ -22,10 +22,6 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   code-scanning-config-tests:
     continue-on-error: true
@@ -59,16 +55,6 @@ jobs:
     steps:
     - name: Check out repository
       uses: actions/checkout@v5
-
-    - name: Set up Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '20'
-        cache: 'npm'
-
-    - name: Install dependencies
-      run: npm ci
-
     - name: Prepare test
       id: prepare-test
       uses: ./.github/actions/prepare-test

.github/workflows/debug-artifacts-failure-safe.yml

@@ -17,11 +17,6 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
-
-defaults:
-  run:
-    shell: bash
-
 jobs:
   upload-artifacts:
     strategy:
@@ -60,6 +55,7 @@ jobs:
           debug-artifact-name: my-debug-artifacts
           debug-database-name: my-db
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis
@@ -79,6 +75,7 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v5
       - name: Check expected artifacts exist
+        shell: bash
         run: |
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do

.github/workflows/debug-artifacts-safe.yml

@@ -16,11 +16,6 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
-
-defaults:
-  run:
-    shell: bash
-
 jobs:
   upload-artifacts:
     strategy:
@@ -59,6 +54,7 @@ jobs:
           # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
           languages: cpp,csharp,go,java,javascript,python,ruby
       - name: Build code
+        shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis
@@ -73,6 +69,7 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v5
       - name: Check expected artifacts exist
+        shell: bash
         run: |
           VERSIONS="stable-v2.20.3 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"

.github/workflows/expected-queries-runs.yml

@@ -0,0 +1,49 @@
+name: Check queries that ran
+
+on:
+  push:
+    branches:
+    - main
+    - releases/v*
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+
+jobs:
+  expected-queries:
+    name: Expected Queries Tests
+    env:
+      CODEQL_ACTION_TEST_MODE: true
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: read
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v5
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/actions/prepare-test
+      with:
+        version: linked
+    - uses: ./../action/init
+      with:
+        languages: javascript
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - uses: ./../action/analyze
+      with:
+        output: ${{ runner.temp }}/results
+
+    - name: Check Sarif
+      uses: ./../action/.github/actions/check-sarif
+      with:
+        sarif-file: ${{ runner.temp }}/results/javascript.sarif
+        queries-run: js/incomplete-hostname-regexp,js/path-injection
+        queries-not-run: foo,bar

.github/workflows/post-release-mergeback.yml

@@ -3,7 +3,7 @@
 #    tag
 # 2. Updates the `vN` tag to refer to this merge commit.
 # 3. Iff vN == vLatest, merges any changes from the release back into the main branch.
-#    Typically, this is two commits – one to update the version number and one to rebuild.
+#    Typically, this is two commits – one to update the version number and one to update dependencies.
 name: Tag release and merge back
 
 on:
@@ -18,10 +18,6 @@ on:
     branches:
       - releases/v*
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   merge-back:
     runs-on: ubuntu-latest
@@ -128,15 +124,48 @@ jobs:
           cat $PARTIAL_CHANGELOG
           echo "::endgroup::"
 
-      - name: Create mergeback branch and PR
+      - name: Create mergeback branch
         if: ${{ steps.check.outputs.exists != 'true' && endsWith(github.ref_name, steps.getVersion.outputs.latest_release_branch) }}
-        uses: ./.github/actions/prepare-mergeback-branch
-        with:
-          base: "${{ env.BASE_BRANCH }}"
-          head: "${{ env.HEAD_BRANCH }}"
-          branch: "${{ steps.getVersion.outputs.newBranch }}"
-          version: "${{ steps.getVersion.outputs.version }}"
-          token: "${{ secrets.GITHUB_TOKEN }}"
+        env:
+          VERSION: "${{ steps.getVersion.outputs.version }}"
+          NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          set -exu
+          pr_title="Mergeback ${VERSION} ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          pr_body=$(cat << EOF
+            This PR bumps the version number and updates the changelog after the ${VERSION} release.
+
+            Please do the following:
+
+            - [ ] Remove and re-add the "Update dependencies" label to the PR to trigger just this workflow.
+            - [ ] Wait for the "Update dependencies" workflow to push a commit updating the dependencies.
+            - [ ] Mark the PR as ready for review to trigger the full set of PR checks.
+            - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
+                  selected rather than "Squash and merge" or "Rebase and merge".
+          EOF
+          )
+
+          # Update the version number ready for the next release
+          npm version patch --no-git-tag-version
+
+          # Update the changelog, adding a new version heading directly above the most recent existing one
+          awk '!f && /##/{print "'"## [UNRELEASED]\n\nNo user facing changes.\n"'"; f=1}1' CHANGELOG.md > temp && mv temp CHANGELOG.md
+          git add .
+          git commit -m "Update changelog and version after ${VERSION}"
+
+          git push origin "${NEW_BRANCH}"
+
+          # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft
+          # so that a maintainer can take the PR out of draft, thereby triggering the PR checks.
+          gh pr create \
+            --head "${NEW_BRANCH}" \
+            --base "${BASE_BRANCH}" \
+            --title "${pr_title}" \
+            --label "Update dependencies" \
+            --body "${pr_body}" \
+            --assignee "${GITHUB_ACTOR}" \
+            --draft
 
       - name: Generate token
         uses: actions/create-github-app-token@v2.1.1

.github/workflows/pr-checks.yml

@@ -8,67 +8,90 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
-  unit-tests:
-    name: Unit Tests
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+  check-js:
+    name: Check JS
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
     permissions:
       contents: read
       security-events: write # needed to upload ESLint results
-    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Lint
+        id: lint
+        run: npm run-script lint-ci
+
+      - name: Upload sarif
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: eslint.sarif
+          category: eslint
+
+      - name: Check generated JS
+        run: .github/workflows/script/check-js.sh
+
+  check-node-modules:
+    if: github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/releases/v')
+    name: Check modules up to date
+    permissions:
+      contents: read
+    runs-on: macos-latest
     timeout-minutes: 45
 
     steps:
-      - name: Prepare git (Windows)
-        if: runner.os == 'Windows'
-        run: git config --global core.autocrlf false
-
       - uses: actions/checkout@v5
-      
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.x'
-          cache: 'npm'
+      - name: Check node modules up to date
+        run: .github/workflows/script/check-node-modules.sh
+
+  check-file-contents:
+    if: github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/releases/v')
+    name: Check file contents
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: 3.11
 
-      - name: Install dependencies
-        run: |
-          # Use the system Bash shell to ensure we can run commands like `npm ci`
-          # that are not available in the default shell on Windows.
-          npm config set script-shell bash
-          npm ci
-
-      - name: Verify compiled JS up to date
-        run: .github/workflows/script/check-js.sh
-
+      # Ensure the generated PR check workflows are up to date.
       - name: Verify PR checks up to date
         run: .github/workflows/script/verify-pr-checks.sh
 
-      - name: Run unit tests
-        run: npm test
+  npm-test:
+    if: github.event_name != 'push' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/releases/v')
+    name: Unit Test
+    needs: [check-js, check-node-modules]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-2025]
+    permissions:
+      contents: read
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
 
-      - name: Lint
-        if: matrix.os != 'windows-latest'
-        run: npm run lint-ci
-
-      - name: Upload sarif
-        uses: github/codeql-action/upload-sarif@v3
-        if: matrix.os == 'ubuntu-latest'
-        with:
-          sarif_file: eslint.sarif
-          category: eslint
+    steps:
+      - uses: actions/checkout@v5
+      - name: npm test
+        run: |
+          # Run any commands referenced in package.json using Bash, otherwise
+          # we won't be able to find them on Windows.
+          npm config set script-shell bash
+          npm test
 
   check-node-version:
     if: github.event.pull_request

.github/workflows/prepare-release.yml

@@ -1,77 +0,0 @@
-name: Prepare release
-on:
-  workflow_call:
-    outputs:
-      version:
-        description: "The version that is being released."
-        value: ${{ jobs.prepare.outputs.version }}
-      major_version:
-        description: "The major version of the release."
-        value: ${{ jobs.prepare.outputs.major_version }}
-      latest_tag:
-        description: "The most recent, existing release tag."
-        value: ${{ jobs.prepare.outputs.latest_tag }}
-      backport_source_branch:
-        description: "The release branch for the given tag."
-        value: ${{ jobs.prepare.outputs.backport_source_branch }}
-      backport_target_branches:
-        description: "JSON encoded list of branches to target with backports."
-        value: ${{ jobs.prepare.outputs.backport_target_branches }}
-
-  push:
-    paths:
-      - .github/workflows/prepare-release.yml
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Prepare release"
-    runs-on: ubuntu-latest
-    if: github.repository == 'github/codeql-action'
-
-    permissions:
-      contents: read
-
-    outputs:
-      version: ${{ steps.versions.outputs.version }}
-      major_version: ${{ steps.versions.outputs.major_version }}
-      latest_tag: ${{ steps.versions.outputs.latest_tag }}
-      backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}
-      backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-
-      - name: Configure runner for release
-        uses: ./.github/actions/release-initialise
-
-      - name: Get version tags
-        id: versions
-        run: |
-          VERSION="v$(jq '.version' -r 'package.json')"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          MAJOR_VERSION=$(cut -d '.' -f1 <<< "${VERSION}")
-          echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
-          LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-          echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
-
-      - name: Determine older release branches
-        id: branches
-        uses: ./.github/actions/release-branches
-        with:
-          major_version: ${{ steps.versions.outputs.major_version }}
-          latest_tag: ${{ steps.versions.outputs.latest_tag }}
-
-      - name: Print release information
-        run: |
-          echo 'version: ${{ steps.versions.outputs.version }}'
-          echo 'major_version: ${{ steps.versions.outputs.major_version }}'
-          echo 'latest_tag: ${{ steps.versions.outputs.latest_tag }}'
-          echo 'backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}'
-          echo 'backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}'

.github/workflows/publish-immutable-action.yml

@@ -4,10 +4,6 @@ on:
   release:
     types: [published]
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   publish:
     runs-on: ubuntu-latest

.github/workflows/python312-windows.yml

@@ -12,10 +12,6 @@ on:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   test-setup-python-scripts:
     env:
@@ -23,7 +19,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: windows-latest
+    runs-on: windows-2025
 
     steps:
     - uses: actions/setup-python@v5

.github/workflows/query-filters.yml

@@ -15,10 +15,6 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   query-filters:
     name: Query Filters Tests
@@ -29,16 +25,6 @@ jobs:
     steps:
     - name: Check out repository
       uses: actions/checkout@v5
-
-    - name: Install Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: 20.x
-        cache: npm
-
-    - name: Install dependencies
-      run: npm ci
-
     - name: Prepare test
       id: prepare-test
       uses: ./.github/actions/prepare-test

.github/workflows/rebuild.yml

@@ -5,10 +5,6 @@ on:
     types: [labeled]
   workflow_dispatch:
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   rebuild:
     name: Rebuild Action
@@ -67,7 +63,7 @@ jobs:
 
       - name: Compile TypeScript
         run: |
-          npm ci
+          npm install
           npm run lint -- --fix
           npm run build
 

.github/workflows/rollback-release.yml

@@ -1,182 +0,0 @@
-name: Rollback release
-on:
-  # You can trigger this workflow via workflow dispatch to start a rollback.
-  # This will create a draft release that mirrors the release for `rollback-tag`.
-  workflow_dispatch:
-    inputs:
-      rollback-tag:
-        type: string
-        description: "The tag of an old release to roll-back to."
-        required: true
-  # Only for dry-runs of changes to the workflow.
-  push:
-    paths:
-      - .github/workflows/rollback-release.yml
-      - .github/actions/prepare-mergeback-branch/**
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  prepare:
-    name: "Prepare release"
-    if: github.repository == 'github/codeql-action'
-
-    permissions:
-      contents: read
-
-    uses: ./.github/workflows/prepare-release.yml
-
-  rollback:
-    name: "Create rollback release"
-    if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-
-    # Don't set the deployment environment for test runs
-    # The Actions token does not have permissions to push changes to workflow files.
-    # Since workflow files may change as part of a backport PR, we use the "Automation" environment for real runs to authenticate as a GitHub App and push these changes.
-    environment: ${{ github.event_name == 'workflow_dispatch' && 'Automation' || '' }}
-
-    needs:
-      - prepare
-
-    permissions:
-      contents: write # needed to push to the repo (tags and releases)
-      pull-requests: write # needed to create the mergeback PR
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0 # Need full history for calculation of diffs
-
-      - name: Configure runner for release
-        uses: ./.github/actions/release-initialise
-
-      - name: Create tag for testing
-        if: github.event_name != 'workflow_dispatch'
-        run: git tag v0.0.0
-
-      # We start by preparing the mergeback branch, mainly so that we have the updated changelog
-      # readily available for the partial changelog that's needed for the release.
-      - name: Prepare mergeback branch
-        id: mergeback-branch
-        env:
-          BASE_BRANCH: ${{ (github.event_name == 'workflow_dispatch' && 'main') || github.ref_name }}
-          VERSION: ${{ needs.prepare.outputs.version }}
-        run: |
-          set -x
-
-          # Checkout the base branch, since we may be testing on a different branch
-          git checkout "$BASE_BRANCH"
-
-          # Generate a new branch name for the mergeback PR
-          short_sha="${GITHUB_SHA:0:8}"
-          NEW_BRANCH="mergeback/${VERSION}-to-${BASE_BRANCH}-${short_sha}"
-          echo "new-branch=${NEW_BRANCH}" >> $GITHUB_OUTPUT
-
-          # Create the mergeback branch
-          git checkout -b "${NEW_BRANCH}"
-
-      - name: Prepare rollback changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
-          # but use `v0.0.0` for testing.
-          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}
-          VERSION: "${{ needs.prepare.outputs.version }}"
-        run: |
-          python .github/workflows/script/rollback_changelog.py \
-            --target-version "${ROLLBACK_TAG:1}" \
-            --rollback-version "${LATEST_TAG:1}" \
-            --new-version "$VERSION" > $NEW_CHANGELOG
-
-          echo "::group::New CHANGELOG"
-          cat $NEW_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Create tags
-        env:
-          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
-          # but use `v0.0.0` for testing.
-          ROLLBACK_TAG: ${{ inputs.rollback-tag || 'v0.0.0' }}
-          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
-          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
-        run: |
-          git checkout "refs/tags/${ROLLBACK_TAG}"
-          git tag --annotate "${RELEASE_TAG}" --message "${RELEASE_TAG}"
-          git tag --annotate "${MAJOR_VERSION_TAG}" --message "${MAJOR_VERSION_TAG}" --force
-
-      - name: Push tags
-        # skip when testing
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
-          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
-        run: |
-          git push origin --atomic --force refs/tags/"${RELEASE_TAG}" refs/tags/"${MAJOR_VERSION_TAG}"
-
-      - name: Prepare partial Changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-          VERSION: "${{ needs.prepare.outputs.version }}"
-        run: |
-          python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG "$VERSION" > $PARTIAL_CHANGELOG
-
-          echo "::group::Partial CHANGELOG"
-          cat $PARTIAL_CHANGELOG
-          echo "::endgroup::"
-
-      - name: Generate token
-        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v2.1.1
-        id: app-token
-        with:
-          app-id: ${{ vars.AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
-
-      - name: Create the rollback release
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
-          VERSION: "${{ needs.prepare.outputs.version }}"
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          RELEASE_URL: "${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ needs.prepare.outputs.version }}"
-        run: |
-          set -exu
-
-          # Do not mark this release as latest. The most recent bundle release must be marked as latest.
-          # Set as a draft to give us an opportunity to review the rollback release.
-          gh release create \
-            "$VERSION" \
-            --latest=false \
-            --draft \
-            --title "$VERSION" \
-            --notes-file "$PARTIAL_CHANGELOG"
-
-          echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY
-
-      - name: Update changelog
-        env:
-          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
-          NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"
-        run: |
-          git checkout "${NEW_BRANCH}"
-          mv ${NEW_CHANGELOG} CHANGELOG.md
-
-      - name: Create mergeback branch and PR
-        uses: ./.github/actions/prepare-mergeback-branch
-        with:
-          base: "main"
-          head: ""
-          branch: "${{ steps.mergeback-branch.outputs.new-branch }}"
-          version: "${{ needs.prepare.outputs.version }}"
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          # Setting this to `true` for non-workflow_dispatch events will
-          # still push the `branch`, but won't create a corresponding PR
-          dry-run: "${{ github.event_name != 'workflow_dispatch' }}"
-

.github/workflows/script/check-node-modules.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -eu
+
+# Sanity check that repo is clean to start with
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then this workflow needs attention...
+    >&2 echo "Failed: Repo should be clean before testing!"
+    exit 1
+fi
+
+"$(dirname "$0")/update-node-modules.sh" check-only
+
+# Check that repo is still clean
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then the PR needs attention
+    >&2 echo "Failed: node_modules are not up to date. Add the 'Update dependencies' label to your PR to update them. Note it is important that node modules are updated on macOS and not any other operating system as there is one dependency (fsevents) that is needed for macOS and may not be installed if dependencies are updated on a Windows or Linux machine."
+    git status
+    exit 1
+fi
+echo "Success: node_modules are up to date"

.github/workflows/script/prepare_changelog.py

@@ -12,7 +12,7 @@ def extract_changelog_snippet(changelog_file, version_tag):
     output = EMPTY_CHANGELOG
 
   else:
-    with open(changelog_file, 'r') as f:
+    with open('CHANGELOG.md', 'r') as f:
       lines = f.readlines()
 
       # Include everything up to, but excluding the second heading

.github/workflows/script/rollback_changelog.py

@@ -1,62 +0,0 @@
-import datetime
-import os
-import argparse
-
-EMPTY_CHANGELOG = """# CodeQL Action Changelog
-
-"""
-
-def get_today_string():
-  today = datetime.datetime.today()
-  return '{:%d %b %Y}'.format(today)
-
-# Include everything up to and after the first heading,
-# but not the first heading and body.
-def drop_unreleased_section(lines: list[str]):
-  before_first_section = ''
-  after_first_section = ''
-  found_first_section = False
-  skipped_first_section = False
-
-  for i, line in enumerate(lines):
-    if line.startswith('## ') and not found_first_section:
-      found_first_section = True
-    elif line.startswith('## ') and found_first_section:
-      skipped_first_section = True
-
-    if not found_first_section:
-      before_first_section += line
-    if skipped_first_section:
-      after_first_section += line
-
-  return (before_first_section, after_first_section)
-
-def update_changelog(target_version, rollback_version, new_version):
-  before_first_section = EMPTY_CHANGELOG
-  after_first_section = ''
-
-  if (os.path.exists('CHANGELOG.md')):
-    with open('CHANGELOG.md', 'r') as f:
-      (before_first_section, after_first_section) = drop_unreleased_section(f.readlines())
-
-  newHeader = f'## {new_version} - {get_today_string()}\n'
-
-  print(before_first_section, end="")
-  print(newHeader)
-  print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n")
-  print(after_first_section)
-
-# We expect three version strings as input:
-#
-# - target_version: the version that we are re-releasing as `new_version`
-# - rollback_version: the version that we are rolling back, typically the one that followed `target_version`
-# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version`
-#
-# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5"
-parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.")
-parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.")
-parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.")
-parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.")
-args = parser.parse_args()
-
-update_changelog(args.target_version, args.rollback_version, args.new_version)

.github/workflows/script/update-node-modules.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -eu
+
+if [ "$1" != "update" ] && [ "$1" != "check-only" ]; then
+    >&2 echo "Failed: Invalid argument. Must be 'update' or 'check-only'"
+    exit 1
+fi
+
+npm install --force -g npm@9.2.0
+
+# clean the npm cache to ensure we don't have any files owned by root
+sudo npm cache clean --force
+
+if [ "$1" = "update" ]; then
+    npm install
+fi
+
+# Reinstall modules and then clean to remove absolute paths
+# Use 'npm ci' instead of 'npm install' as this is intended to be reproducible
+npm ci
+npm run removeNPMAbsolutePaths

.github/workflows/script/update-required-checks.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 # Update the required checks based on the current branch.
-
-set -euo pipefail
+# Typically, this will be main.
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 REPO_DIR="$(dirname "$SCRIPT_DIR")"
@@ -33,12 +32,6 @@ CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs -
 
 echo "$CHECKS" | jq
 
-# Fail if there are no checks
-if [ -z "$CHECKS" ] || [ "$(echo "$CHECKS" | jq '. | length')" -eq 0 ]; then
-  echo "No checks found for $GITHUB_SHA"
-  exit 1
-fi
-
 echo "{\"contexts\": ${CHECKS}}" > checks.json
 
 echo "Updating main"

.github/workflows/test-codeql-bundle-all.yml

@@ -16,9 +16,6 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch: {}
-defaults:
-  run:
-    shell: bash
 jobs:
   test-codeql-bundle-all:
     strategy:
@@ -49,6 +46,7 @@ jobs:
         languages: cpp,csharp,go,java,javascript,python,ruby 
         tools: ${{ steps.prepare-test.outputs.tools-url }}
     - name: Build code
+      shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
     env:

.github/workflows/update-bundle.yml

@@ -13,10 +13,6 @@ on:
     # to filter pre-release attribute.
     types: [published]
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
@@ -40,15 +36,6 @@ jobs:
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.x'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
       - name: Update bundle
         uses: ./.github/actions/update-bundle
 

.github/workflows/update-dependencies.yml

@@ -0,0 +1,45 @@
+name: Update dependencies
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
+
+jobs:
+  update:
+    name: Update dependencies
+    timeout-minutes: 45
+    runs-on: macos-latest
+    if: contains(github.event.pull_request.labels.*.name, 'Update dependencies') && (github.event.pull_request.head.repo.full_name == 'github/codeql-action')
+    permissions:
+      contents: write # needed to push the updated dependencies
+      pull-requests: write # needed to comment on the PR
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+
+    - name: Remove PR label
+      env:
+        GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        REPOSITORY: '${{ github.repository }}'
+        PR_NUMBER: '${{ github.event.pull_request.number }}'
+      run: |
+        gh api "repos/$REPOSITORY/issues/$PR_NUMBER/labels/Update%20dependencies" -X DELETE
+
+    - name: Push updated dependencies
+      env:
+        BRANCH: '${{ github.head_ref }}'
+        GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+      run: |
+        git fetch origin "$BRANCH" --depth=1
+        git checkout "origin/$BRANCH"
+        .github/workflows/script/update-node-modules.sh update
+        if [ ! -z "$(git status --porcelain)" ]; then
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+          git add node_modules
+          git commit -am "Update checked-in dependencies"
+          git push origin "HEAD:$BRANCH"
+          echo "Pushed a commit to update the checked-in dependencies." \
+            "Please mark the PR as ready for review to trigger PR checks." |
+            gh pr comment --body-file - --repo github/codeql-action "${{ github.event.pull_request.number }}"
+          gh pr ready --undo --repo github/codeql-action "${{ github.event.pull_request.number }}"
+        fi

.github/workflows/update-proxy-release.yml

@@ -7,10 +7,6 @@ on:
         type: string
         required: true
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   update:
     name: Update code and create PR
@@ -24,6 +20,7 @@ jobs:
     steps:
       - name: Check release tag format
         id: checks
+        shell: bash
         run: |
           if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
@@ -33,6 +30,7 @@ jobs:
           echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
 
       - name: Check that the release exists
+        shell: bash
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         run: |
@@ -48,17 +46,20 @@ jobs:
           ref: main
 
       - name: Update git config
+        shell: bash
         run: |
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
       - name: Update release tag and version
+        shell: bash
         run: |
           NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
           sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
           sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
 
       - name: Compile TypeScript and commit changes
+        shell: bash
         env:
           TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
         run: |
@@ -71,6 +72,7 @@ jobs:
           git commit -m "Update release used by \`start-proxy\` action"
 
       - name: Push changes and open PR
+        shell: bash
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}

.github/workflows/update-release-branch.yml

@@ -11,18 +11,49 @@ on:
     branches:
       - releases/*
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
 
   prepare:
-    name: "Prepare release"
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/codeql-action'
+    outputs:
+      version: ${{ steps.versions.outputs.version }}
+      major_version: ${{ steps.versions.outputs.major_version }}
+      latest_tag: ${{ steps.versions.outputs.latest_tag }}
+      backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}
+      backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
     permissions:
       contents: read
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        fetch-depth: 0  # Need full history for calculation of diffs
+    - uses: ./.github/actions/release-initialise
 
-    uses: ./.github/workflows/prepare-release.yml
+    - name: Get version tags
+      id: versions
+      run: |
+        VERSION="v$(jq '.version' -r 'package.json')"
+        echo "version=${VERSION}" >> $GITHUB_OUTPUT
+        MAJOR_VERSION=$(cut -d '.' -f1 <<< "${VERSION}")
+        echo "major_version=${MAJOR_VERSION}" >> $GITHUB_OUTPUT
+        LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+        echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
+
+    - id: branches
+      name: Determine older release branches
+      uses: ./.github/actions/release-branches
+      with:
+        major_version: ${{ steps.versions.outputs.major_version }}
+        latest_tag: ${{ steps.versions.outputs.latest_tag }}
+
+    - name: debug logging
+      run: |
+        echo 'version: ${{ steps.versions.outputs.version }}'
+        echo 'major_version: ${{ steps.versions.outputs.major_version }}'
+        echo 'latest_tag: ${{ steps.versions.outputs.latest_tag }}'
+        echo 'backport_source_branch: ${{ steps.branches.outputs.backport_source_branch }}'
+        echo 'backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}'
 
   update:
     timeout-minutes: 45

.gitignore

@@ -1,7 +1,5 @@
-# Dependency directories
-node_modules/
-# Build output for tests
-build/
+# Ignore for example failing-tests.json from AVA
+node_modules/.cache/
 # Java build files
 .gradle/
 *.class
@@ -10,4 +8,4 @@ build/
 # eslint sarif report
 eslint.sarif
 # for local incremental compilation
-tsconfig.tsbuildinfo
+tsconfig.tsbuildinfo

.vscode/settings.json

@@ -5,7 +5,6 @@
     "**/.DS_Store": true,
 
     // transpiled JavaScript
-    "build": true,
     "lib": true,
   },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically

CHANGELOG.md

@@ -4,31 +4,8 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-- We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
-- We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107)
-- You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#3130](https://github.com/github/codeql-action/pull/3130)
-
-## 3.30.3 - 10 Sep 2025
-
 No user facing changes.
 
-## 3.30.2 - 09 Sep 2025
-
-- Fixed a bug which could cause language autodetection to fail. [#3084](https://github.com/github/codeql-action/pull/3084)
-- Experimental: The `quality-queries` input that was added in `3.29.2` as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new `analysis-kinds` input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. [#3064](https://github.com/github/codeql-action/pull/3064)
-
-## 3.30.1 - 05 Sep 2025
-
-- Update default CodeQL bundle version to 2.23.0. [#3077](https://github.com/github/codeql-action/pull/3077)
-
-## 3.30.0 - 01 Sep 2025
-
-- Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. [#3054](https://github.com/github/codeql-action/pull/3054)
-
-## 3.29.11 - 21 Aug 2025
-
-- Update default CodeQL bundle version to 2.22.4. [#3044](https://github.com/github/codeql-action/pull/3044)
-
 ## 3.29.10 - 18 Aug 2025
 
 No user facing changes.

CONTRIBUTING.md

@@ -25,9 +25,11 @@ This project also includes configuration to run tests from VSCode (with support
 
 You may want to run `tsc --watch` from the command line or inside of vscode in order to ensure build artifacts are up to date as you are working.
 
-### Checking in compiled artifacts
+### Checking in compiled artifacts and `node_modules`
 
-Because CodeQL Action users consume the code directly from this repository, and there can be no build step during a GitHub Actions run, this repository contains all compiled artifacts. There is a PR check that will fail if any of the compiled artifacts are not up to date. Compiled artifacts are stored in the `lib/` directory. For all day-to-day development purposes, this folder can be ignored.
+Because CodeQL Action users consume the code directly from this repository, and there can be no build step during a GitHub Actions run, this repository contains all compiled artifacts and node modules. There is a PR check that will fail if any of the compiled artifacts are not up to date. Compiled artifacts are stored in the `lib/` directory. For all day-to-day development purposes, this folder can be ignored.
+
+Only run `npm install` if you are explicitly changing the set of dependencies in `package.json`. The `node_modules` directory should be up to date when you check out, but if for some reason, there is an inconsistency use `npm ci && npm run removeNPMAbsolutePaths` to ensure the directory is in a state consistent with the `package-lock.json`. Note that due to a macOS-specific dependency, this command should be run on a macOS machine. There is a PR check to ensure the consistency of the `node_modules` directory.
 
 ### Running the action
 
@@ -39,10 +41,10 @@ As well as the unit tests (see _Common tasks_ above), there are integration test
 
 ## Submitting a pull request
 
-1. [Fork][fork] and clone the repository.
-2. Create a new branch: `git checkout -b my-branch-name`.
-3. Make your change, add tests, and make sure the tests still pass. Ensure that you have run `npm run build` and committed any changes to the compiled artifacts.
-4. Push to your fork and [submit a pull request][pr].
+1. [Fork][fork] and clone the repository
+2. Create a new branch: `git checkout -b my-branch-name`
+3. Make your change, add tests, and make sure the tests still pass
+4. Push to your fork and [submit a pull request][pr]
 5. Pat yourself on the back and wait for your pull request to be reviewed and merged.
 
 If you're a GitHub staff member, you can merge your own PR once it's approved; for external contributors, GitHub staff will merge your PR once it's approved.
@@ -60,7 +62,7 @@ Here are a few things you can do that will increase the likelihood of your pull
 
     You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
 1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it.
-1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
+1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action. 
 1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
 1. Approve the mergeback and backport pull request (if applicable) and automerge them.
 
@@ -68,12 +70,11 @@ Once the mergeback and backport pull request have been merged, the release is co
 
 ## Keeping the PR checks up to date (admin access required)
 
-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:
+Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred jobs that need to pass in order for a PR to turn green. You can regenerate the checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:
 
-- If you run the script without an argument, it will retrieve the set of workflows that ran for the latest commit on `main`. Make sure that your local `main` branch is up to date before running the script.
-- You can specify a commit SHA as argument to retrieve the set of workflows for that commit instead. You will likely want to use this if you have a PR that removes or adds PR checks.
-
-After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.
+1. By default, this script retrieves the checks from the latest SHA on `main`, so make sure that your `main` branch is up to date.
+2. Run the script. If there's a reason to, you can pass in a different SHA as a CLI argument.
+3. After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.
 
 Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.
 

analyze/action.yml

@@ -58,7 +58,7 @@ inputs:
     # If changing this, make sure to update workflow.ts accordingly.
     default: ${{ github.workspace }}
   ref:
-    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks. Expected format: refs/heads/<branch name>, refs/tags/<tag>, refs/pull/<number>/merge, or refs/pull/<number>/head."
+    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks."
     required: false
   sha:
     description: "The sha of the HEAD of the ref where results will be uploaded. If not provided, the Action will use the GITHUB_SHA environment variable. If provided, the ref input must be provided as well. This input is ignored for pull requests from forks."

build.mjs

@@ -1,75 +0,0 @@
-import { copyFile, rm } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import * as esbuild from "esbuild";
-import { globSync } from "glob";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const SRC_DIR = join(__dirname, "src");
-const OUT_DIR = join(__dirname, "lib");
-
-/**
- * Clean the output directory before building.
- * 
- * @type {esbuild.Plugin}
- */
-const cleanPlugin = {
-  name: "clean",
-  setup(build) {
-    build.onStart(async () => {
-      await rm(OUT_DIR, { recursive: true, force: true });
-    });
-  },
-};
-
-/**
- * Copy defaults.json to the output directory since other projects depend on it.
- * 
- * @type {esbuild.Plugin}
- */
-const copyDefaultsPlugin = {
-  name: "copy-defaults",
-  setup(build) {
-    build.onEnd(async () => {
-      await rm(join(OUT_DIR, "defaults.json"), {
-        force: true,
-      });
-      await copyFile(
-        join(SRC_DIR, "defaults.json"),
-        join(OUT_DIR, "defaults.json"),
-      );
-    });
-  },
-};
-
-/**
- * Log when the build ends.
- *
- * @type {esbuild.Plugin}
- */
-const onEndPlugin = {
-  name: "on-end",
-  setup(build) {
-    build.onEnd((result) => {
-      // eslint-disable-next-line no-console
-      console.log(`Build ended with ${result.errors.length} errors`);
-    });
-  },
-};
-
-const context = await esbuild.context({
-  // Include upload-lib.ts as an entry point for use in testing environments.
-  entryPoints: globSync([`${SRC_DIR}/*-action.ts`, `${SRC_DIR}/*-action-post.ts`, "src/upload-lib.ts"]),
-  bundle: true,
-  format: "cjs",
-  outdir: OUT_DIR,
-  platform: "node",
-  plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
-  target: ["node20"],
-});
-
-await context.rebuild();
-await context.dispose();

eslint.config.mjs

@@ -26,11 +26,9 @@ export default [
   {
     ignores: [
       "**/webpack.config.js",
-      "build/**/*",
       "lib/**/*",
       "src/testdata/**/*",
       "tests/**/*",
-      "build.mjs",
       "eslint.config.mjs",
       ".github/**/*",
     ],
@@ -76,7 +74,7 @@ export default [
 
         typescript: {},
       },
-      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size"],
+      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry"],
     },
 
     rules: {

init/action.yml

@@ -12,9 +12,6 @@ inputs:
       - The URL of a CodeQL Bundle tarball GitHub release asset, or
       - A special value `linked` which uses the version of the CodeQL tools
         that the Action has been bundled with.
-      - A special value `nightly` which uses the latest nightly version of the
-        CodeQL tools. Note that this is unstable and not recommended for
-        production use.
 
       If not specified, the Action will check in several places until it finds
       the CodeQL tools.
@@ -45,19 +42,6 @@ inputs:
                      your workflow between the `init` and `analyze` steps. Available for all
                      compiled languages.
     required: false
-  analysis-kinds:
-    description: >-
-      [Internal] A comma-separated list of analysis kinds to enable. This input is intended for
-      internal-use only at this time and the behaviour is subject to changes. Some features may
-      not be available depending on which analysis kinds are enabled.
-
-      Available options are:
-
-      - `code-scanning`: The default, security-focused analysis.
-      - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
-                        with `code-scanning`.
-    default: 'code-scanning'
-    required: true
   token:
     description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
     default: ${{ github.token }}
@@ -100,7 +84,7 @@ inputs:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
   quality-queries:
-    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
+    description: '[Internal] Comma-separated list of code quality queries to run.'
     required: false
   packs:
     description: >-

lib/actions-util.js

@@ -0,0 +1,430 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.restoreInputs = exports.persistInputs = exports.CommandInvocationError = exports.getFileType = exports.FileCmdNotFoundError = exports.getOptionalInput = exports.getRequiredInput = void 0;
+exports.getTemporaryDirectory = getTemporaryDirectory;
+exports.getActionVersion = getActionVersion;
+exports.getWorkflowEventName = getWorkflowEventName;
+exports.isRunningLocalAction = isRunningLocalAction;
+exports.getRelativeScriptPath = getRelativeScriptPath;
+exports.getWorkflowEvent = getWorkflowEvent;
+exports.printDebugLogs = printDebugLogs;
+exports.getUploadValue = getUploadValue;
+exports.getWorkflowRunID = getWorkflowRunID;
+exports.getWorkflowRunAttempt = getWorkflowRunAttempt;
+exports.isSelfHostedRunner = isSelfHostedRunner;
+exports.isDefaultSetup = isDefaultSetup;
+exports.prettyPrintInvocation = prettyPrintInvocation;
+exports.ensureEndsInPeriod = ensureEndsInPeriod;
+exports.runTool = runTool;
+exports.getPullRequestBranches = getPullRequestBranches;
+exports.isAnalyzingPullRequest = isAnalyzingPullRequest;
+exports.fixCodeQualityCategory = fixCodeQualityCategory;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const core = __importStar(require("@actions/core"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const github = __importStar(require("@actions/github"));
+const io = __importStar(require("@actions/io"));
+const util_1 = require("./util");
+// eslint-disable-next-line import/no-commonjs, @typescript-eslint/no-require-imports
+const pkg = require("../package.json");
+/**
+ * Wrapper around core.getInput for inputs that always have a value.
+ * Also see getOptionalInput.
+ *
+ * This allows us to get stronger type checking of required/optional inputs.
+ */
+const getRequiredInput = function (name) {
+    const value = core.getInput(name);
+    if (!value) {
+        throw new util_1.ConfigurationError(`Input required and not supplied: ${name}`);
+    }
+    return value;
+};
+exports.getRequiredInput = getRequiredInput;
+/**
+ * Wrapper around core.getInput that converts empty inputs to undefined.
+ * Also see getRequiredInput.
+ *
+ * This allows us to get stronger type checking of required/optional inputs.
+ */
+const getOptionalInput = function (name) {
+    const value = core.getInput(name);
+    return value.length > 0 ? value : undefined;
+};
+exports.getOptionalInput = getOptionalInput;
+function getTemporaryDirectory() {
+    const value = process.env["CODEQL_ACTION_TEMP"];
+    return value !== undefined && value !== ""
+        ? value
+        : (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
+}
+function getActionVersion() {
+    return pkg.version;
+}
+/**
+ * Returns the name of the event that triggered this workflow.
+ *
+ * This will be "dynamic" for default setup workflow runs.
+ */
+function getWorkflowEventName() {
+    return (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_NAME");
+}
+/**
+ * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
+ * a workflow on the codeql-action repo itself.
+ */
+function isRunningLocalAction() {
+    const relativeScriptPath = getRelativeScriptPath();
+    return (relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath));
+}
+/**
+ * Get the location where the Action is running from.
+ *
+ * This can be used to get the Action's name or tell if we're running a local Action.
+ */
+function getRelativeScriptPath() {
+    const runnerTemp = (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
+    const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
+    return path.relative(actionsDirectory, __filename);
+}
+/** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
+function getWorkflowEvent() {
+    const eventJsonFile = (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_PATH");
+    try {
+        return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
+    }
+    catch (e) {
+        throw new Error(`Unable to read workflow event JSON from ${eventJsonFile}: ${e}`);
+    }
+}
+async function printDebugLogs(config) {
+    for (const language of config.languages) {
+        const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
+        const logsDirectory = path.join(databaseDirectory, "log");
+        if (!(0, util_1.doesDirectoryExist)(logsDirectory)) {
+            core.info(`Directory ${logsDirectory} does not exist.`);
+            continue; // Skip this language database.
+        }
+        const walkLogFiles = (dir) => {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            if (entries.length === 0) {
+                core.info(`No debug logs found at directory ${logsDirectory}.`);
+            }
+            for (const entry of entries) {
+                if (entry.isFile()) {
+                    const absolutePath = path.resolve(dir, entry.name);
+                    core.startGroup(`CodeQL Debug Logs - ${language} - ${entry.name} from file at path ${absolutePath}`);
+                    process.stdout.write(fs.readFileSync(absolutePath));
+                    core.endGroup();
+                }
+                else if (entry.isDirectory()) {
+                    walkLogFiles(path.resolve(dir, entry.name));
+                }
+            }
+        };
+        walkLogFiles(logsDirectory);
+    }
+}
+/**
+ * Parses the `upload` input into an `UploadKind`, converting unspecified and deprecated upload
+ * inputs appropriately.
+ */
+function getUploadValue(input) {
+    switch (input) {
+        case undefined:
+        case "true":
+        case "always":
+            return "always";
+        case "false":
+        case "failure-only":
+            return "failure-only";
+        case "never":
+            return "never";
+        default:
+            core.warning(`Unrecognized 'upload' input to 'analyze' Action: ${input}. Defaulting to 'always'.`);
+            return "always";
+    }
+}
+/**
+ * Get the workflow run ID.
+ */
+function getWorkflowRunID() {
+    const workflowRunIdString = (0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID");
+    const workflowRunID = parseInt(workflowRunIdString, 10);
+    if (Number.isNaN(workflowRunID)) {
+        throw new Error(`GITHUB_RUN_ID must define a non NaN workflow run ID. Current value is ${workflowRunIdString}`);
+    }
+    if (workflowRunID < 0) {
+        throw new Error(`GITHUB_RUN_ID must be a non-negative integer. Current value is ${workflowRunIdString}`);
+    }
+    return workflowRunID;
+}
+/**
+ * Get the workflow run attempt number.
+ */
+function getWorkflowRunAttempt() {
+    const workflowRunAttemptString = (0, util_1.getRequiredEnvParam)("GITHUB_RUN_ATTEMPT");
+    const workflowRunAttempt = parseInt(workflowRunAttemptString, 10);
+    if (Number.isNaN(workflowRunAttempt)) {
+        throw new Error(`GITHUB_RUN_ATTEMPT must define a non NaN workflow run attempt. Current value is ${workflowRunAttemptString}`);
+    }
+    if (workflowRunAttempt <= 0) {
+        throw new Error(`GITHUB_RUN_ATTEMPT must be a positive integer. Current value is ${workflowRunAttemptString}`);
+    }
+    return workflowRunAttempt;
+}
+class FileCmdNotFoundError extends Error {
+    constructor(msg) {
+        super(msg);
+        this.name = "FileCmdNotFoundError";
+    }
+}
+exports.FileCmdNotFoundError = FileCmdNotFoundError;
+/**
+ * Tries to obtain the output of the `file` command for the file at the specified path.
+ * The output will vary depending on the type of `file`, which operating system we are running on, etc.
+ */
+const getFileType = async (filePath) => {
+    let stderr = "";
+    let stdout = "";
+    let fileCmdPath;
+    try {
+        fileCmdPath = await io.which("file", true);
+    }
+    catch (e) {
+        throw new FileCmdNotFoundError(`The \`file\` program is required, but does not appear to be installed. Please install it: ${e}`);
+    }
+    try {
+        // The `file` command will output information about the type of file pointed at by `filePath`.
+        // For binary files, this may include e.g. whether they are static of dynamic binaries.
+        // The `-L` switch instructs the command to follow symbolic links.
+        await new toolrunner.ToolRunner(fileCmdPath, ["-L", filePath], {
+            silent: true,
+            listeners: {
+                stdout: (data) => {
+                    stdout += data.toString();
+                },
+                stderr: (data) => {
+                    stderr += data.toString();
+                },
+            },
+        }).exec();
+        return stdout.trim();
+    }
+    catch (e) {
+        core.info(`Could not determine type of ${filePath} from ${stdout}. ${stderr}`);
+        throw e;
+    }
+};
+exports.getFileType = getFileType;
+function isSelfHostedRunner() {
+    return process.env.RUNNER_ENVIRONMENT === "self-hosted";
+}
+/** Determines whether we are running in default setup. */
+function isDefaultSetup() {
+    return getWorkflowEventName() === "dynamic";
+}
+function prettyPrintInvocation(cmd, args) {
+    return [cmd, ...args].map((x) => (x.includes(" ") ? `'${x}'` : x)).join(" ");
+}
+/**
+ * An error from a tool invocation, with associated exit code, stderr, etc.
+ */
+class CommandInvocationError extends Error {
+    constructor(cmd, args, exitCode, stderr, stdout = "") {
+        const prettyCommand = prettyPrintInvocation(cmd, args);
+        const lastLine = ensureEndsInPeriod(stderr.trim().split("\n").pop()?.trim() || "n/a");
+        super(`Failed to run "${prettyCommand}". ` +
+            `Exit code was ${exitCode} and last log line was: ${lastLine} See the logs for more details.`);
+        this.cmd = cmd;
+        this.args = args;
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+        this.stdout = stdout;
+    }
+}
+exports.CommandInvocationError = CommandInvocationError;
+function ensureEndsInPeriod(text) {
+    return text[text.length - 1] === "." ? text : `${text}.`;
+}
+/**
+ * A constant defining the maximum number of characters we will keep from
+ * the programs stderr for logging.
+ *
+ * This serves two purposes:
+ * 1. It avoids an OOM if a program fails in a way that results it
+ *    printing many log lines.
+ * 2. It avoids us hitting the limit of how much data we can send in our
+ *    status reports on GitHub.com.
+ */
+const MAX_STDERR_BUFFER_SIZE = 20000;
+/**
+ * Runs a CLI tool.
+ *
+ * @returns Standard output produced by the tool.
+ * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
+ */
+async function runTool(cmd, args = [], opts = {}) {
+    let stdout = "";
+    let stderr = "";
+    if (!opts.noStreamStdout) {
+        process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
+    }
+    const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+        ignoreReturnCode: true,
+        listeners: {
+            stdout: (data) => {
+                stdout += data.toString("utf8");
+                if (!opts.noStreamStdout) {
+                    process.stdout.write(data);
+                }
+            },
+            stderr: (data) => {
+                let readStartIndex = 0;
+                // If the error is too large, then we only take the last MAX_STDERR_BUFFER_SIZE characters
+                if (data.length - MAX_STDERR_BUFFER_SIZE > 0) {
+                    // Eg: if we have MAX_STDERR_BUFFER_SIZE the start index should be 2.
+                    readStartIndex = data.length - MAX_STDERR_BUFFER_SIZE + 1;
+                }
+                stderr += data.toString("utf8", readStartIndex);
+                // Mimic the standard behavior of the toolrunner by writing stderr to stdout
+                process.stdout.write(data);
+            },
+        },
+        silent: true,
+        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
+    }).exec();
+    if (exitCode !== 0) {
+        throw new CommandInvocationError(cmd, args, exitCode, stderr, stdout);
+    }
+    return stdout;
+}
+const persistedInputsKey = "persisted_inputs";
+/**
+ * Persists all inputs to the action as state that can be retrieved later in the post-action.
+ * This would be simplified if actions/runner#3514 is addressed.
+ * https://github.com/actions/runner/issues/3514
+ */
+const persistInputs = function () {
+    const inputEnvironmentVariables = Object.entries(process.env).filter(([name]) => name.startsWith("INPUT_"));
+    core.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
+};
+exports.persistInputs = persistInputs;
+/**
+ * Restores all inputs to the action from the persisted state.
+ */
+const restoreInputs = function () {
+    const persistedInputs = core.getState(persistedInputsKey);
+    if (persistedInputs) {
+        for (const [name, value] of JSON.parse(persistedInputs)) {
+            process.env[name] = value;
+        }
+    }
+};
+exports.restoreInputs = restoreInputs;
+/**
+ * Returns the base and head branches of the pull request being analyzed.
+ *
+ * @returns the base and head branches of the pull request, or undefined if
+ * we are not analyzing a pull request.
+ */
+function getPullRequestBranches() {
+    const pullRequest = github.context.payload.pull_request;
+    if (pullRequest) {
+        return {
+            base: pullRequest.base.ref,
+            // We use the head label instead of the head ref here, because the head
+            // ref lacks owner information and by itself does not uniquely identify
+            // the head branch (which may be in a forked repository).
+            head: pullRequest.head.label,
+        };
+    }
+    // PR analysis under Default Setup does not have the pull_request context,
+    // but it should set CODE_SCANNING_REF and CODE_SCANNING_BASE_BRANCH.
+    const codeScanningRef = process.env.CODE_SCANNING_REF;
+    const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
+    if (codeScanningRef && codeScanningBaseBranch) {
+        return {
+            base: codeScanningBaseBranch,
+            // PR analysis under Default Setup analyzes the PR head commit instead of
+            // the merge commit, so we can use the provided ref directly.
+            head: codeScanningRef,
+        };
+    }
+    return undefined;
+}
+/**
+ * Returns whether we are analyzing a pull request.
+ */
+function isAnalyzingPullRequest() {
+    return getPullRequestBranches() !== undefined;
+}
+/**
+ * A workaround for code quality to map category names from old default setup workflows
+ * to ones that the code quality service expects.
+ */
+const qualityCategoryMapping = {
+    "c#": "csharp",
+    cpp: "c-cpp",
+    c: "c-cpp",
+    "c++": "c-cpp",
+    java: "java-kotlin",
+    javascript: "javascript-typescript",
+    typescript: "javascript-typescript",
+    kotlin: "java-kotlin",
+};
+/** Adjusts the category string for a Code Quality SARIF file if an "old"
+ * category identifier is used by Default Setup.
+ */
+function fixCodeQualityCategory(logger, category) {
+    // The `category` should always be set by Default Setup. We perform this check
+    // to avoid potential issues if Code Quality supports Advanced Setup in the future
+    // and before this workaround is removed.
+    if (category !== undefined &&
+        isDefaultSetup() &&
+        category.startsWith("/language:")) {
+        const language = category.substring("/language:".length);
+        const mappedLanguage = qualityCategoryMapping[language];
+        if (mappedLanguage) {
+            const newCategory = `/language:${mappedLanguage}`;
+            logger.info(`Adjusted category for Code Quality from '${category}' to '${newCategory}'.`);
+            return newCategory;
+        }
+    }
+    return category;
+}
+//# sourceMappingURL=actions-util.js.map

lib/actions-util.test.js

@@ -0,0 +1,192 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const github = __importStar(require("@actions/github"));
+const ava_1 = __importDefault(require("ava"));
+const actions_util_1 = require("./actions-util");
+const api_client_1 = require("./api-client");
+const environment_1 = require("./environment");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+function withMockedContext(mockPayload, testFn) {
+    const originalPayload = github.context.payload;
+    github.context.payload = mockPayload;
+    try {
+        return testFn();
+    }
+    finally {
+        github.context.payload = originalPayload;
+    }
+}
+function withMockedEnv(envVars, testFn) {
+    const originalEnv = { ...process.env };
+    // Apply environment changes
+    for (const [key, value] of Object.entries(envVars)) {
+        if (value === undefined) {
+            delete process.env[key];
+        }
+        else {
+            process.env[key] = value;
+        }
+    }
+    try {
+        return testFn();
+    }
+    finally {
+        // Restore original environment
+        process.env = originalEnv;
+    }
+}
+(0, ava_1.default)("computeAutomationID()", async (t) => {
+    let actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"language": "javascript", "os": "linux"}');
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
+    // check the environment sorting
+    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"os": "linux", "language": "javascript"}');
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
+    // check that an empty environment produces the right results
+    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", "{}");
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
+    // check non string environment values
+    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"number": 1, "object": {"language": "javascript"}}');
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/number:/object:/");
+    // check undefined environment
+    actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", undefined);
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
+});
+(0, ava_1.default)("getPullRequestBranches() with pull request context", (t) => {
+    withMockedContext({
+        pull_request: {
+            number: 123,
+            base: { ref: "main" },
+            head: { label: "user:feature-branch" },
+        },
+    }, () => {
+        t.deepEqual((0, actions_util_1.getPullRequestBranches)(), {
+            base: "main",
+            head: "user:feature-branch",
+        });
+        t.is((0, actions_util_1.isAnalyzingPullRequest)(), true);
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined with push context", (t) => {
+    withMockedContext({
+        push: {
+            ref: "refs/heads/main",
+        },
+    }, () => {
+        t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+        t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() with Default Setup environment variables", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: "refs/heads/feature-branch",
+            CODE_SCANNING_BASE_BRANCH: "main",
+        }, () => {
+            t.deepEqual((0, actions_util_1.getPullRequestBranches)(), {
+                base: "main",
+                head: "refs/heads/feature-branch",
+            });
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), true);
+        });
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined when only CODE_SCANNING_REF is set", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: "refs/heads/feature-branch",
+            CODE_SCANNING_BASE_BRANCH: undefined,
+        }, () => {
+            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+        });
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined when only CODE_SCANNING_BASE_BRANCH is set", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: undefined,
+            CODE_SCANNING_BASE_BRANCH: "main",
+        }, () => {
+            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+        });
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined when no PR context", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: undefined,
+            CODE_SCANNING_BASE_BRANCH: undefined,
+        }, () => {
+            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+        });
+    });
+});
+(0, ava_1.default)("initializeEnvironment", (t) => {
+    (0, util_1.initializeEnvironment)("1.2.3");
+    t.deepEqual(process.env[environment_1.EnvVar.VERSION], "1.2.3");
+});
+(0, ava_1.default)("fixCodeQualityCategory", (t) => {
+    withMockedEnv({
+        GITHUB_EVENT_NAME: "dynamic",
+    }, () => {
+        const logger = (0, logging_1.getRunnerLogger)(true);
+        // Categories that should get adjusted.
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:c#"), "/language:csharp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:cpp"), "/language:c-cpp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:c"), "/language:c-cpp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:java"), "/language:java-kotlin");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:javascript"), "/language:javascript-typescript");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:typescript"), "/language:javascript-typescript");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:kotlin"), "/language:java-kotlin");
+        // Categories that should not get adjusted.
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:csharp"), "/language:csharp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:go"), "/language:go");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:actions"), "/language:actions");
+        // Other cases.
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, undefined), undefined);
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "random string"), "random string");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "kotlin"), "kotlin");
+    });
+});
+//# sourceMappingURL=actions-util.test.js.map

lib/analyze-action-env.test.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const analyze = __importStar(require("./analyze"));
+const api = __importStar(require("./api-client"));
+const configUtils = __importStar(require("./config-utils"));
+const gitUtils = __importStar(require("./git-utils"));
+const statusReport = __importStar(require("./status-report"));
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+// This test needs to be in its own file so that ava would run it in its own
+// nodejs process. The code being tested is in analyze-action.ts, which runs
+// immediately on load. So the file needs to be loaded during part of the test,
+// and that can happen only once per nodejs process. If multiple such tests are
+// in the same test file, ava would run them in the same nodejs process, and all
+// but the first test would fail.
+(0, ava_1.default)("analyze action with RAM & threads from environment variables", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        process.env["GITHUB_SERVER_URL"] = util.GITHUB_DOTCOM_URL;
+        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
+        process.env["GITHUB_API_URL"] = "https://api.github.com";
+        sinon
+            .stub(statusReport, "createStatusReportBase")
+            .resolves({});
+        sinon.stub(statusReport, "sendStatusReport").resolves();
+        sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            gitHubVersion,
+            augmentationProperties: {},
+            languages: [],
+            packs: [],
+            trapCaches: {},
+        });
+        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
+        requiredInputStub.withArgs("token").returns("fake-token");
+        requiredInputStub.withArgs("upload-database").returns("false");
+        requiredInputStub.withArgs("output").returns("out");
+        const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
+        optionalInputStub.withArgs("expect-error").returns("false");
+        sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
+        // When there are no action inputs for RAM and threads, the action uses
+        // environment variables (passed down from the init action) to set RAM and
+        // threads usage.
+        process.env["CODEQL_THREADS"] = "-1";
+        process.env["CODEQL_RAM"] = "4992";
+        const runFinalizeStub = sinon.stub(analyze, "runFinalize");
+        const runQueriesStub = sinon.stub(analyze, "runQueries");
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const analyzeAction = require("./analyze-action");
+        // When analyze-action.ts loads, it runs an async function from the top
+        // level but does not wait for it to finish. To ensure that calls to
+        // runFinalize and runQueries are correctly captured by spies, we explicitly
+        // wait for the action promise to complete before starting verification.
+        await analyzeAction.runPromise;
+        t.assert(runFinalizeStub.calledOnce);
+        t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
+        t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=4992");
+        t.assert(runQueriesStub.calledOnce);
+        t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
+        t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=4992");
+    });
+});
+//# sourceMappingURL=analyze-action-env.test.js.map