Add PR check for CSRA artifact upload

Bump the npm-minor group with 2 updates

.github/workflows/__all-platform-bundle.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   all-platform-bundle:
     strategy:
@@ -75,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -82,15 +91,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'true'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - id: init
         uses: ./../action/init
         with:

.github/workflows/__analysis-kinds.yml

@@ -92,7 +92,7 @@ jobs:
           post-processed-sarif-path: '${{ runner.temp }}/post-processed'
 
       - name: Upload SARIF files
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -100,7 +100,7 @@ jobs:
           retention-days: 7
 
       - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}

.github/workflows/__analyze-ref-input.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   analyze-ref-input:
     strategy:
@@ -81,6 +71,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,20 +87,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__autobuild-action.yml

@@ -65,6 +65,10 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -72,10 +76,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           languages: csharp

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -67,6 +67,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -74,11 +79,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...

.github/workflows/__build-mode-autobuild.yml

@@ -67,13 +67,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
       - name: Install Java
         uses: actions/setup-java@v5
         with:
@@ -87,6 +80,13 @@ jobs:
         run: |-
           gh release download --repo mikefarah/yq --pattern "yq_windows_amd64.exe" "$YQ_VERSION" -O "$YQ_PATH/yq.exe"
           echo "$YQ_PATH" >> "$GITHUB_PATH"
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/

.github/workflows/__build-mode-manual.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   build-mode-manual:
     strategy:
@@ -71,6 +71,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -78,15 +87,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__bundle-toolcache.yml

@@ -39,10 +39,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
-            version: linked
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
           - os: windows-latest
             version: linked
     name: 'Bundle: Caching checks'

.github/workflows/__bundle-zstd.yml

@@ -39,10 +39,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
-            version: linked
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
           - os: windows-latest
             version: linked
     name: 'Bundle: Zstandard checks'
@@ -82,7 +82,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.os }}-zstd-bundle.sarif
           path: ${{ runner.temp }}/results/javascript.sarif

.github/workflows/__config-export.yml

@@ -70,7 +70,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'

.github/workflows/__diagnostics-export.yml

@@ -81,7 +81,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'

.github/workflows/__export-file-baseline-information.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   export-file-baseline-information:
     strategy:
@@ -75,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -82,15 +91,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         id: init
         with:
@@ -102,7 +102,7 @@ jobs:
         with:
           output: '${{ runner.temp }}/results'
       - name: Upload SARIF
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'

.github/workflows/__go-custom-queries.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   go-custom-queries:
     strategy:
@@ -73,6 +73,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -80,15 +89,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -61,6 +61,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -68,11 +73,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -61,6 +61,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -68,11 +73,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - name: Remove `file` program
         run: |
           echo $(which file)

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -61,6 +61,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -68,11 +73,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -51,32 +51,18 @@ jobs:
         include:
           - os: ubuntu-latest
             version: stable-v2.17.6
-          - os: macos-latest
-            version: stable-v2.17.6
           - os: ubuntu-latest
             version: stable-v2.18.4
-          - os: macos-latest
-            version: stable-v2.18.4
           - os: ubuntu-latest
             version: stable-v2.19.4
-          - os: macos-latest
-            version: stable-v2.19.4
           - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: macos-latest
-            version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: macos-latest
-            version: stable-v2.21.4
           - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: macos-latest
-            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
-          - os: macos-latest
-            version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
@@ -95,6 +81,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -102,11 +93,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -51,32 +51,18 @@ jobs:
         include:
           - os: ubuntu-latest
             version: stable-v2.17.6
-          - os: macos-latest
-            version: stable-v2.17.6
           - os: ubuntu-latest
             version: stable-v2.18.4
-          - os: macos-latest
-            version: stable-v2.18.4
           - os: ubuntu-latest
             version: stable-v2.19.4
-          - os: macos-latest
-            version: stable-v2.19.4
           - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: macos-latest
-            version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: macos-latest
-            version: stable-v2.21.4
           - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: macos-latest
-            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
-          - os: macos-latest
-            version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
@@ -95,6 +81,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -102,11 +93,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -51,32 +51,18 @@ jobs:
         include:
           - os: ubuntu-latest
             version: stable-v2.17.6
-          - os: macos-latest
-            version: stable-v2.17.6
           - os: ubuntu-latest
             version: stable-v2.18.4
-          - os: macos-latest
-            version: stable-v2.18.4
           - os: ubuntu-latest
             version: stable-v2.19.4
-          - os: macos-latest
-            version: stable-v2.19.4
           - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: macos-latest
-            version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: macos-latest
-            version: stable-v2.21.4
           - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: macos-latest
-            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
-          - os: macos-latest
-            version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
@@ -95,6 +81,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -102,11 +93,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go.yml

@@ -10,16 +10,16 @@ env:
 on:
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 jobs:
   go-custom-queries:
     name: 'Go: Custom queries'
@@ -28,8 +28,8 @@ jobs:
       security-events: read
     uses: ./.github/workflows/__go-custom-queries.yml
     with:
-      go-version: ${{ inputs.go-version }}
       dotnet-version: ${{ inputs.dotnet-version }}
+      go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-diagnostic:
     name: 'Go: diagnostic when Go is changed after init step'
     permissions:

.github/workflows/__job-run-uuid-sarif.yml

@@ -67,7 +67,7 @@ jobs:
         with:
           output: '${{ runner.temp }}/results'
       - name: Upload SARIF
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'

.github/workflows/__local-bundle.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   local-bundle:
     strategy:
@@ -81,6 +71,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,20 +87,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst

.github/workflows/__multi-language-autodetect.yml

@@ -25,85 +25,75 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   multi-language-autodetect:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
-            version: stable-v2.17.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
-            version: stable-v2.18.4
+            version: stable-v2.17.6
           - os: ubuntu-latest
             version: stable-v2.18.4
           - os: macos-latest
-            version: stable-v2.19.4
+            version: stable-v2.18.4
           - os: ubuntu-latest
             version: stable-v2.19.4
           - os: macos-latest
-            version: stable-v2.20.7
+            version: stable-v2.19.4
           - os: ubuntu-latest
             version: stable-v2.20.7
           - os: macos-latest
-            version: stable-v2.21.4
+            version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
           - os: macos-latest
-            version: stable-v2.22.4
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: stable-v2.22.4
           - os: macos-latest
-            version: default
+            version: stable-v2.22.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
-            version: linked
+            version: default
           - os: ubuntu-latest
             version: linked
           - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
             version: nightly-latest
-          - os: ubuntu-latest
+          - os: macos-latest
             version: nightly-latest
     name: Multi-language repository
     if: github.triggering_actor != 'dependabot[bot]'
@@ -115,6 +105,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -122,20 +121,14 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
+      - name: Install Python 3.13 for older CLI versions
+        # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
+        # See https://github.com/github/codeql-action/pull/3212
+        if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
         uses: actions/setup-python@v6
         with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+          python-version: '3.13'
+
       - name: Use Xcode 16
         if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   packaging-codescanning-config-inputs-js:
     strategy:
@@ -85,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -99,20 +98,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging3.yml'

.github/workflows/__packaging-config-inputs-js.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   packaging-config-inputs-js:
     strategy:
@@ -75,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -89,15 +98,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging3.yml'

.github/workflows/__packaging-config-js.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   packaging-config-js:
     strategy:
@@ -75,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -89,15 +98,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging.yml'

.github/workflows/__packaging-inputs-js.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   packaging-inputs-js:
     strategy:
@@ -75,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -89,15 +98,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging2.yml'

.github/workflows/__remote-config.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   remote-config:
     strategy:
@@ -83,6 +73,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -90,20 +89,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__resolve-environment-action.yml

@@ -39,10 +39,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: default
           - os: ubuntu-latest
             version: linked
+          - os: ubuntu-latest
+            version: default
           - os: ubuntu-latest
             version: nightly-latest
     name: Resolve environment

.github/workflows/__risk-assessment-failure.yml

@@ -0,0 +1,94 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Risk Assessment analysis failure uploads SARIF artifact
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: risk-assessment-failure-${{github.ref}}
+jobs:
+  risk-assessment-failure:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: Risk Assessment analysis failure uploads SARIF artifact
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: write
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Initialise CodeQL
+        uses: ./../action/init
+        id: init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: javascript
+          analysis-kinds: risk-assessment
+
+      - name: Fail
+        run: exit 1
+    env:
+      CODEQL_ACTION_TEST_MODE: true
+  artifact-present:
+    name: Check artifact
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - risk-assessment-failure
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          pattern: sarif-artifact-*
+          path: ${{ runner.temp }}/results
+          merge-multiple: true
+      - name: List contents
+        run: |
+          ls -lr
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__split-workflow.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   split-workflow:
     strategy:
@@ -81,6 +81,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,15 +97,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging3.yml'

.github/workflows/__swift-custom-build.yml

@@ -25,34 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   swift-custom-build:
     strategy:
@@ -75,6 +75,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -82,15 +91,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Use Xcode 16
         if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"

.github/workflows/__unset-environment.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   unset-environment:
     strategy:
@@ -83,6 +73,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -90,20 +89,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__upload-ref-sha-input.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   upload-ref-sha-input:
     strategy:
@@ -81,6 +71,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,20 +87,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__upload-sarif.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   upload-sarif:
     strategy:
@@ -88,6 +78,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -95,20 +94,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__with-checkout-path.yml

@@ -25,44 +25,34 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-      python-version:
-        type: string
-        description: The version of Python to install
-        required: false
-        default: '3.13'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
   with-checkout-path:
     strategy:
@@ -82,6 +72,15 @@ jobs:
       # This ensures we don't accidentally use the original checkout for any part of the test.
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -89,20 +88,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.

.github/workflows/debug-artifacts-failure-safe.yml

@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
       - name: Check expected artifacts exist
         run: |
           LANGUAGES="cpp csharp go java javascript python"

.github/workflows/debug-artifacts-safe.yml

@@ -83,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
       - name: Check expected artifacts exist
         run: |
           VERSIONS="stable-v2.20.3 default linked nightly-latest"

.github/workflows/pr-checks.yml

@@ -52,19 +52,10 @@ jobs:
       - name: Verify compiled JS up to date
         run: .github/workflows/script/check-js.sh
 
-      - name: Verify PR checks up to date
-        if: always()
-        run: .github/workflows/script/verify-pr-checks.sh
-
       - name: Run unit tests
         if: always()
         run: npm test
 
-      - name: Run pr-checks tests
-        if: always()
-        working-directory: pr-checks
-        run: npm ci && npx tsx --test
-
       - name: Lint
         if: always() && matrix.os != 'windows-latest'
         run: npm run lint-ci
@@ -76,6 +67,40 @@ jobs:
           sarif_file: eslint.sarif
           category: eslint
 
+  # Verifying the PR checks are up-to-date requires Node 24. The PR checks are not dependent
+  # on the main codebase and therefore do not need to be run as part of the same matrix that
+  # we use for the `unit-tests` job.
+  verify-pr-checks:
+    name: Verify PR checks
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+
+    steps:
+      - name: Prepare git (Windows)
+        if: runner.os == 'Windows'
+        run: git config --global core.autocrlf false
+
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: 'npm'
+
+      - name: Verify PR checks up to date
+        if: always()
+        run: .github/workflows/script/verify-pr-checks.sh
+
+      - name: Run pr-checks tests
+        if: always()
+        working-directory: pr-checks
+        run: npm ci && npx tsx --test
+
   check-node-version:
     if: github.triggering_actor != 'dependabot[bot]'
     name: Check Action Node versions

.github/workflows/rebuild.yml

@@ -29,6 +29,15 @@ jobs:
           fetch-depth: 0
           ref: ${{ env.HEAD_REF }}
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            pr-checks/package-lock.json
+
       - name: Remove label
         if: github.event_name == 'pull_request'
         env:
@@ -49,9 +58,18 @@ jobs:
           git fetch origin "$BASE_BRANCH"
 
           # Allow merge conflicts in `lib`, since rebuilding should resolve them.
-          git merge "origin/$BASE_BRANCH" || echo "Merge conflicts detected, continuing."
+          git merge "origin/$BASE_BRANCH"
           MERGE_RESULT=$?
 
+          if [ "$MERGE_RESULT" -eq 0 ]; then
+            echo "Merge succeeded cleanly."
+          elif [ "$MERGE_RESULT" -eq 1 ]; then
+            echo "Merge conflicts detected (exit code $MERGE_RESULT), continuing."
+          else
+            echo "git merge failed with unexpected exit code $MERGE_RESULT."
+            exit 1
+          fi
+
           if [ "$MERGE_RESULT" -ne 0 ]; then
             echo "merge-in-progress=true" >> $GITHUB_OUTPUT
 
@@ -104,7 +122,7 @@ jobs:
             # Otherwise, just commit the changes.
             if git rev-parse --verify MERGE_HEAD >/dev/null 2>&1; then
               echo "In progress merge detected, finishing it up."
-              git merge --continue --no-edit
+              git commit --no-edit
             else
               echo "No in-progress merge detected, committing changes."
               git commit -m "Rebuild"

CHANGELOG.md

@@ -4,7 +4,19 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-No user facing changes.
+- Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)
+
+  To opt out of this change:
+  - **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
+  - **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
+  - **User-owned repositories using advanced setup:** Set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
+- Fixed [a bug](https://github.com/github/codeql-action/issues/3555) which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. [#3557](https://github.com/github/codeql-action/pull/3557)
+- The CodeQL Action now loads [custom repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) on GitHub Enterprise Server, enabling the customization of features such as `github-codeql-disable-overlay` that was previously only available on GitHub.com. [#3559](https://github.com/github/codeql-action/pull/3559)
+- Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
+
+## 4.32.6 - 05 Mar 2026
+
+- Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)
 
 ## 4.32.5 - 02 Mar 2026
 

eslint.config.mjs

@@ -161,6 +161,7 @@ export default [
       "@typescript-eslint/no-unused-vars": [
         "error",
         {
+          "args": "all",
           "argsIgnorePattern": "^_",
         }
       ],

lib/analyze-action-post.js

@@ -45986,7 +45986,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.32.6",
+      version: "4.32.7",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -46047,20 +46047,20 @@ var require_package = __commonJS({
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^21.0.0",
-        ava: "^6.4.1",
+        ava: "^7.0.0",
         esbuild: "^0.27.3",
         eslint: "^9.39.2",
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.6.0",
+        "eslint-plugin-jsdoc": "^62.7.1",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
-        globals: "^17.3.0",
+        globals: "^17.4.0",
         nock: "^14.0.11",
-        sinon: "^21.0.1",
+        sinon: "^21.0.2",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.0"
+        "typescript-eslint": "^8.56.1"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -161404,6 +161404,7 @@ retry.VERSION = VERSION7;
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
@@ -161418,10 +161419,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         error: core5.error
       },
       retry: {
-        // The default is 400, 401, 403, 404, 410, 422, and 451. We have observed transient errors
-        // with authentication, so we remove 401, 403, and 404 from the default list to ensure that
-        // these errors are retried.
-        doNotRetry: [400, 410, 422, 451]
+        doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
@@ -161733,6 +161731,7 @@ var semver2 = __toESM(require_semver2());
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
+  RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
@@ -161944,6 +161943,12 @@ async function isAnalyzingDefaultBranch() {
 
 // src/overlay/index.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1";
+var CODEQL_OVERLAY_MINIMUM_VERSION_GO = "2.24.2";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVA = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -162086,70 +162091,48 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION
   },
-  ["overlay_analysis_actions" /* OverlayAnalysisActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: void 0
-  },
+  // Per-language overlay feature flags. Each has minimumVersion set to the
+  // minimum CLI version that supports overlay analysis for that language.
+  // Only languages that are GA or in staff-ship should have feature flags here.
   ["overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
   },
   ["overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_cpp" /* OverlayAnalysisCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_csharp" /* OverlayAnalysisCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
+  },
+  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: {
     defaultValue: false,
@@ -162161,25 +162144,20 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
     minimumVersion: void 0
   },
-  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_java" /* OverlayAnalysisJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_javascript" /* OverlayAnalysisJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
@@ -162189,23 +162167,13 @@ var featureConfig = {
   ["overlay_analysis_ruby" /* OverlayAnalysisRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_rust" /* OverlayAnalysisRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
     minimumVersion: void 0
   },
-  ["overlay_analysis_swift" /* OverlayAnalysisSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
-    minimumVersion: void 0
-  },
   ["python_default_is_to_not_extract_stdlib" /* PythonDefaultIsToNotExtractStdlib */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -162221,11 +162189,8 @@ var featureConfig = {
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
-    // For testing, this is not behind a CLI version check yet. However
-    // before rolling this out externally, we should set a minimum version here
-    // since current versions of the CodeQL CLI will log if baseline information
-    // cannot be found when interpreting results.
-    minimumVersion: void 0
+    minimumVersion: void 0,
+    toolsFeature: "suppressesMissingFileBaselineWarning" /* SuppressesMissingFileBaselineWarning */
   },
   ["start_proxy_remove_unused_registries" /* StartProxyRemoveUnusedRegistries */]: {
     defaultValue: false,
@@ -162243,11 +162208,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "bundleSupportsOverlay" /* BundleSupportsOverlay */
   },
-  ["use_repository_properties_v2" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["validate_db_config" /* ValidateDbConfig */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_VALIDATE_DB_CONFIG",
@@ -162268,28 +162228,20 @@ var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3;
 var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6;
 var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024;
 var OVERLAY_ANALYSIS_FEATURES = {
-  actions: "overlay_analysis_actions" /* OverlayAnalysisActions */,
-  cpp: "overlay_analysis_cpp" /* OverlayAnalysisCpp */,
   csharp: "overlay_analysis_csharp" /* OverlayAnalysisCsharp */,
   go: "overlay_analysis_go" /* OverlayAnalysisGo */,
   java: "overlay_analysis_java" /* OverlayAnalysisJava */,
   javascript: "overlay_analysis_javascript" /* OverlayAnalysisJavascript */,
   python: "overlay_analysis_python" /* OverlayAnalysisPython */,
-  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */,
-  rust: "overlay_analysis_rust" /* OverlayAnalysisRust */,
-  swift: "overlay_analysis_swift" /* OverlayAnalysisSwift */
+  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */
 };
 var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-  actions: "overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */,
-  cpp: "overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */,
   csharp: "overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */,
   go: "overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */,
   java: "overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */,
   javascript: "overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */,
   python: "overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */,
-  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */,
-  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
-  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
+  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */
 };
 function getPathToParsedConfigFile(tempDir) {
   return path3.join(tempDir, "config");

lib/autobuild-action.js

@@ -45986,7 +45986,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.32.6",
+      version: "4.32.7",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -46047,20 +46047,20 @@ var require_package = __commonJS({
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^21.0.0",
-        ava: "^6.4.1",
+        ava: "^7.0.0",
         esbuild: "^0.27.3",
         eslint: "^9.39.2",
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.6.0",
+        "eslint-plugin-jsdoc": "^62.7.1",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
-        globals: "^17.3.0",
+        globals: "^17.4.0",
         nock: "^14.0.11",
-        sinon: "^21.0.1",
+        sinon: "^21.0.2",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.0"
+        "typescript-eslint": "^8.56.1"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -103423,6 +103423,7 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
@@ -103437,10 +103438,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         error: core5.error
       },
       retry: {
-        // The default is 400, 401, 403, 404, 410, 422, and 451. We have observed transient errors
-        // with authentication, so we remove 401, 403, and 404 from the default list to ensure that
-        // these errors are retried.
-        doNotRetry: [400, 410, 422, 451]
+        doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
@@ -103786,6 +103784,7 @@ var semver2 = __toESM(require_semver2());
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
+  RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
@@ -103820,8 +103819,8 @@ var path3 = __toESM(require("path"));
 var semver5 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.24.2";
-var cliVersion = "2.24.2";
+var bundleVersion = "codeql-bundle-v2.24.3";
+var cliVersion = "2.24.3";
 
 // src/overlay/index.ts
 var fs2 = __toESM(require("fs"));
@@ -103995,6 +103994,12 @@ async function isAnalyzingDefaultBranch() {
 
 // src/overlay/index.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1";
+var CODEQL_OVERLAY_MINIMUM_VERSION_GO = "2.24.2";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVA = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -104135,70 +104140,48 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION
   },
-  ["overlay_analysis_actions" /* OverlayAnalysisActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: void 0
-  },
+  // Per-language overlay feature flags. Each has minimumVersion set to the
+  // minimum CLI version that supports overlay analysis for that language.
+  // Only languages that are GA or in staff-ship should have feature flags here.
   ["overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
   },
   ["overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_cpp" /* OverlayAnalysisCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_csharp" /* OverlayAnalysisCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
+  },
+  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: {
     defaultValue: false,
@@ -104210,25 +104193,20 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
     minimumVersion: void 0
   },
-  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_java" /* OverlayAnalysisJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_javascript" /* OverlayAnalysisJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
@@ -104238,23 +104216,13 @@ var featureConfig = {
   ["overlay_analysis_ruby" /* OverlayAnalysisRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_rust" /* OverlayAnalysisRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
     minimumVersion: void 0
   },
-  ["overlay_analysis_swift" /* OverlayAnalysisSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
-    minimumVersion: void 0
-  },
   ["python_default_is_to_not_extract_stdlib" /* PythonDefaultIsToNotExtractStdlib */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -104270,11 +104238,8 @@ var featureConfig = {
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
-    // For testing, this is not behind a CLI version check yet. However
-    // before rolling this out externally, we should set a minimum version here
-    // since current versions of the CodeQL CLI will log if baseline information
-    // cannot be found when interpreting results.
-    minimumVersion: void 0
+    minimumVersion: void 0,
+    toolsFeature: "suppressesMissingFileBaselineWarning" /* SuppressesMissingFileBaselineWarning */
   },
   ["start_proxy_remove_unused_registries" /* StartProxyRemoveUnusedRegistries */]: {
     defaultValue: false,
@@ -104292,11 +104257,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "bundleSupportsOverlay" /* BundleSupportsOverlay */
   },
-  ["use_repository_properties_v2" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["validate_db_config" /* ValidateDbConfig */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_VALIDATE_DB_CONFIG",
@@ -104640,28 +104600,20 @@ var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3;
 var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6;
 var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024;
 var OVERLAY_ANALYSIS_FEATURES = {
-  actions: "overlay_analysis_actions" /* OverlayAnalysisActions */,
-  cpp: "overlay_analysis_cpp" /* OverlayAnalysisCpp */,
   csharp: "overlay_analysis_csharp" /* OverlayAnalysisCsharp */,
   go: "overlay_analysis_go" /* OverlayAnalysisGo */,
   java: "overlay_analysis_java" /* OverlayAnalysisJava */,
   javascript: "overlay_analysis_javascript" /* OverlayAnalysisJavascript */,
   python: "overlay_analysis_python" /* OverlayAnalysisPython */,
-  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */,
-  rust: "overlay_analysis_rust" /* OverlayAnalysisRust */,
-  swift: "overlay_analysis_swift" /* OverlayAnalysisSwift */
+  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */
 };
 var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-  actions: "overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */,
-  cpp: "overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */,
   csharp: "overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */,
   go: "overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */,
   java: "overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */,
   javascript: "overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */,
   python: "overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */,
-  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */,
-  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
-  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
+  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */
 };
 function getPathToParsedConfigFile(tempDir) {
   return path4.join(tempDir, "config");

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.24.2",
-  "cliVersion": "2.24.2",
-  "priorBundleVersion": "codeql-bundle-v2.24.1",
-  "priorCliVersion": "2.24.1"
+  "bundleVersion": "codeql-bundle-v2.24.3",
+  "cliVersion": "2.24.3",
+  "priorBundleVersion": "codeql-bundle-v2.24.2",
+  "priorCliVersion": "2.24.2"
 }

lib/resolve-environment-action.js

@@ -45986,7 +45986,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.32.6",
+      version: "4.32.7",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -46047,20 +46047,20 @@ var require_package = __commonJS({
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^21.0.0",
-        ava: "^6.4.1",
+        ava: "^7.0.0",
         esbuild: "^0.27.3",
         eslint: "^9.39.2",
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.6.0",
+        "eslint-plugin-jsdoc": "^62.7.1",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
-        globals: "^17.3.0",
+        globals: "^17.4.0",
         nock: "^14.0.11",
-        sinon: "^21.0.1",
+        sinon: "^21.0.2",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.0"
+        "typescript-eslint": "^8.56.1"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -103431,6 +103431,7 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
@@ -103445,10 +103446,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         error: core5.error
       },
       retry: {
-        // The default is 400, 401, 403, 404, 410, 422, and 451. We have observed transient errors
-        // with authentication, so we remove 401, 403, and 404 from the default list to ensure that
-        // these errors are retried.
-        doNotRetry: [400, 410, 422, 451]
+        doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
@@ -103785,6 +103783,7 @@ var semver2 = __toESM(require_semver2());
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
+  RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
@@ -103988,6 +103987,12 @@ async function isAnalyzingDefaultBranch() {
 
 // src/overlay/index.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1";
+var CODEQL_OVERLAY_MINIMUM_VERSION_GO = "2.24.2";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVA = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -104126,70 +104131,48 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION
   },
-  ["overlay_analysis_actions" /* OverlayAnalysisActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: void 0
-  },
+  // Per-language overlay feature flags. Each has minimumVersion set to the
+  // minimum CLI version that supports overlay analysis for that language.
+  // Only languages that are GA or in staff-ship should have feature flags here.
   ["overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
   },
   ["overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_cpp" /* OverlayAnalysisCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_csharp" /* OverlayAnalysisCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
+  },
+  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: {
     defaultValue: false,
@@ -104201,25 +104184,20 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
     minimumVersion: void 0
   },
-  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_java" /* OverlayAnalysisJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_javascript" /* OverlayAnalysisJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
@@ -104229,23 +104207,13 @@ var featureConfig = {
   ["overlay_analysis_ruby" /* OverlayAnalysisRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_rust" /* OverlayAnalysisRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
     minimumVersion: void 0
   },
-  ["overlay_analysis_swift" /* OverlayAnalysisSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
-    minimumVersion: void 0
-  },
   ["python_default_is_to_not_extract_stdlib" /* PythonDefaultIsToNotExtractStdlib */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -104261,11 +104229,8 @@ var featureConfig = {
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
-    // For testing, this is not behind a CLI version check yet. However
-    // before rolling this out externally, we should set a minimum version here
-    // since current versions of the CodeQL CLI will log if baseline information
-    // cannot be found when interpreting results.
-    minimumVersion: void 0
+    minimumVersion: void 0,
+    toolsFeature: "suppressesMissingFileBaselineWarning" /* SuppressesMissingFileBaselineWarning */
   },
   ["start_proxy_remove_unused_registries" /* StartProxyRemoveUnusedRegistries */]: {
     defaultValue: false,
@@ -104283,11 +104248,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "bundleSupportsOverlay" /* BundleSupportsOverlay */
   },
-  ["use_repository_properties_v2" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["validate_db_config" /* ValidateDbConfig */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_VALIDATE_DB_CONFIG",
@@ -104308,28 +104268,20 @@ var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3;
 var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6;
 var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024;
 var OVERLAY_ANALYSIS_FEATURES = {
-  actions: "overlay_analysis_actions" /* OverlayAnalysisActions */,
-  cpp: "overlay_analysis_cpp" /* OverlayAnalysisCpp */,
   csharp: "overlay_analysis_csharp" /* OverlayAnalysisCsharp */,
   go: "overlay_analysis_go" /* OverlayAnalysisGo */,
   java: "overlay_analysis_java" /* OverlayAnalysisJava */,
   javascript: "overlay_analysis_javascript" /* OverlayAnalysisJavascript */,
   python: "overlay_analysis_python" /* OverlayAnalysisPython */,
-  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */,
-  rust: "overlay_analysis_rust" /* OverlayAnalysisRust */,
-  swift: "overlay_analysis_swift" /* OverlayAnalysisSwift */
+  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */
 };
 var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-  actions: "overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */,
-  cpp: "overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */,
   csharp: "overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */,
   go: "overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */,
   java: "overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */,
   javascript: "overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */,
   python: "overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */,
-  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */,
-  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
-  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
+  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */
 };
 function getPathToParsedConfigFile(tempDir) {
   return path3.join(tempDir, "config");

lib/start-proxy-action-post.js

@@ -45986,7 +45986,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.32.6",
+      version: "4.32.7",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -46047,20 +46047,20 @@ var require_package = __commonJS({
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^21.0.0",
-        ava: "^6.4.1",
+        ava: "^7.0.0",
         esbuild: "^0.27.3",
         eslint: "^9.39.2",
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.6.0",
+        "eslint-plugin-jsdoc": "^62.7.1",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
-        globals: "^17.3.0",
+        globals: "^17.4.0",
         nock: "^14.0.11",
-        sinon: "^21.0.1",
+        sinon: "^21.0.2",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.0"
+        "typescript-eslint": "^8.56.1"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -161287,6 +161287,7 @@ retry.VERSION = VERSION7;
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
@@ -161301,10 +161302,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         error: core5.error
       },
       retry: {
-        // The default is 400, 401, 403, 404, 410, 422, and 451. We have observed transient errors
-        // with authentication, so we remove 401, 403, and 404 from the default list to ensure that
-        // these errors are retried.
-        doNotRetry: [400, 410, 422, 451]
+        doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
@@ -161368,6 +161366,7 @@ var semver2 = __toESM(require_semver2());
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
+  RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
@@ -161410,6 +161409,12 @@ var semver3 = __toESM(require_semver2());
 
 // src/overlay/index.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1";
+var CODEQL_OVERLAY_MINIMUM_VERSION_GO = "2.24.2";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVA = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
@@ -161492,70 +161497,48 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION
   },
-  ["overlay_analysis_actions" /* OverlayAnalysisActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: void 0
-  },
+  // Per-language overlay feature flags. Each has minimumVersion set to the
+  // minimum CLI version that supports overlay analysis for that language.
+  // Only languages that are GA or in staff-ship should have feature flags here.
   ["overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
   },
   ["overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_cpp" /* OverlayAnalysisCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_csharp" /* OverlayAnalysisCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
+  },
+  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: {
     defaultValue: false,
@@ -161567,25 +161550,20 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
     minimumVersion: void 0
   },
-  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_java" /* OverlayAnalysisJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_javascript" /* OverlayAnalysisJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
@@ -161595,23 +161573,13 @@ var featureConfig = {
   ["overlay_analysis_ruby" /* OverlayAnalysisRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_rust" /* OverlayAnalysisRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
     minimumVersion: void 0
   },
-  ["overlay_analysis_swift" /* OverlayAnalysisSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
-    minimumVersion: void 0
-  },
   ["python_default_is_to_not_extract_stdlib" /* PythonDefaultIsToNotExtractStdlib */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -161627,11 +161595,8 @@ var featureConfig = {
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
-    // For testing, this is not behind a CLI version check yet. However
-    // before rolling this out externally, we should set a minimum version here
-    // since current versions of the CodeQL CLI will log if baseline information
-    // cannot be found when interpreting results.
-    minimumVersion: void 0
+    minimumVersion: void 0,
+    toolsFeature: "suppressesMissingFileBaselineWarning" /* SuppressesMissingFileBaselineWarning */
   },
   ["start_proxy_remove_unused_registries" /* StartProxyRemoveUnusedRegistries */]: {
     defaultValue: false,
@@ -161649,11 +161614,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "bundleSupportsOverlay" /* BundleSupportsOverlay */
   },
-  ["use_repository_properties_v2" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["validate_db_config" /* ValidateDbConfig */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_VALIDATE_DB_CONFIG",
@@ -161674,28 +161634,20 @@ var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3;
 var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6;
 var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024;
 var OVERLAY_ANALYSIS_FEATURES = {
-  actions: "overlay_analysis_actions" /* OverlayAnalysisActions */,
-  cpp: "overlay_analysis_cpp" /* OverlayAnalysisCpp */,
   csharp: "overlay_analysis_csharp" /* OverlayAnalysisCsharp */,
   go: "overlay_analysis_go" /* OverlayAnalysisGo */,
   java: "overlay_analysis_java" /* OverlayAnalysisJava */,
   javascript: "overlay_analysis_javascript" /* OverlayAnalysisJavascript */,
   python: "overlay_analysis_python" /* OverlayAnalysisPython */,
-  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */,
-  rust: "overlay_analysis_rust" /* OverlayAnalysisRust */,
-  swift: "overlay_analysis_swift" /* OverlayAnalysisSwift */
+  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */
 };
 var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-  actions: "overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */,
-  cpp: "overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */,
   csharp: "overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */,
   go: "overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */,
   java: "overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */,
   javascript: "overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */,
   python: "overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */,
-  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */,
-  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
-  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
+  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */
 };
 function getPathToParsedConfigFile(tempDir) {
   return path.join(tempDir, "config");

lib/start-proxy-action.js

@@ -45986,7 +45986,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.32.6",
+      version: "4.32.7",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -46047,20 +46047,20 @@ var require_package = __commonJS({
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^21.0.0",
-        ava: "^6.4.1",
+        ava: "^7.0.0",
         esbuild: "^0.27.3",
         eslint: "^9.39.2",
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.6.0",
+        "eslint-plugin-jsdoc": "^62.7.1",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
-        globals: "^17.3.0",
+        globals: "^17.4.0",
         nock: "^14.0.11",
-        sinon: "^21.0.1",
+        sinon: "^21.0.2",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.0"
+        "typescript-eslint": "^8.56.1"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -120510,6 +120510,7 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
@@ -120524,10 +120525,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         error: core5.error
       },
       retry: {
-        // The default is 400, 401, 403, 404, 410, 422, and 451. We have observed transient errors
-        // with authentication, so we remove 401, 403, and 404 from the default list to ensure that
-        // these errors are retried.
-        doNotRetry: [400, 410, 422, 451]
+        doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
@@ -120612,8 +120610,8 @@ var path = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.24.2";
-var cliVersion = "2.24.2";
+var bundleVersion = "codeql-bundle-v2.24.3";
+var cliVersion = "2.24.3";
 
 // src/overlay/index.ts
 var actionsCache = __toESM(require_cache5());
@@ -120731,6 +120729,12 @@ function getActionsLogger() {
 
 // src/overlay/index.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1";
+var CODEQL_OVERLAY_MINIMUM_VERSION_GO = "2.24.2";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVA = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
@@ -120815,70 +120819,48 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION
   },
-  ["overlay_analysis_actions" /* OverlayAnalysisActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: void 0
-  },
+  // Per-language overlay feature flags. Each has minimumVersion set to the
+  // minimum CLI version that supports overlay analysis for that language.
+  // Only languages that are GA or in staff-ship should have feature flags here.
   ["overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
   },
   ["overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_cpp" /* OverlayAnalysisCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_csharp" /* OverlayAnalysisCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
+  },
+  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: {
     defaultValue: false,
@@ -120890,25 +120872,20 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
     minimumVersion: void 0
   },
-  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_java" /* OverlayAnalysisJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_javascript" /* OverlayAnalysisJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
@@ -120918,23 +120895,13 @@ var featureConfig = {
   ["overlay_analysis_ruby" /* OverlayAnalysisRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_rust" /* OverlayAnalysisRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
     minimumVersion: void 0
   },
-  ["overlay_analysis_swift" /* OverlayAnalysisSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
-    minimumVersion: void 0
-  },
   ["python_default_is_to_not_extract_stdlib" /* PythonDefaultIsToNotExtractStdlib */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -120950,11 +120917,8 @@ var featureConfig = {
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
-    // For testing, this is not behind a CLI version check yet. However
-    // before rolling this out externally, we should set a minimum version here
-    // since current versions of the CodeQL CLI will log if baseline information
-    // cannot be found when interpreting results.
-    minimumVersion: void 0
+    minimumVersion: void 0,
+    toolsFeature: "suppressesMissingFileBaselineWarning" /* SuppressesMissingFileBaselineWarning */
   },
   ["start_proxy_remove_unused_registries" /* StartProxyRemoveUnusedRegistries */]: {
     defaultValue: false,
@@ -120972,11 +120936,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "bundleSupportsOverlay" /* BundleSupportsOverlay */
   },
-  ["use_repository_properties_v2" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["validate_db_config" /* ValidateDbConfig */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_VALIDATE_DB_CONFIG",
@@ -121391,6 +121350,7 @@ var semver5 = __toESM(require_semver2());
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
+  RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
@@ -121418,28 +121378,20 @@ var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3;
 var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6;
 var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024;
 var OVERLAY_ANALYSIS_FEATURES = {
-  actions: "overlay_analysis_actions" /* OverlayAnalysisActions */,
-  cpp: "overlay_analysis_cpp" /* OverlayAnalysisCpp */,
   csharp: "overlay_analysis_csharp" /* OverlayAnalysisCsharp */,
   go: "overlay_analysis_go" /* OverlayAnalysisGo */,
   java: "overlay_analysis_java" /* OverlayAnalysisJava */,
   javascript: "overlay_analysis_javascript" /* OverlayAnalysisJavascript */,
   python: "overlay_analysis_python" /* OverlayAnalysisPython */,
-  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */,
-  rust: "overlay_analysis_rust" /* OverlayAnalysisRust */,
-  swift: "overlay_analysis_swift" /* OverlayAnalysisSwift */
+  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */
 };
 var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-  actions: "overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */,
-  cpp: "overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */,
   csharp: "overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */,
   go: "overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */,
   java: "overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */,
   javascript: "overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */,
   python: "overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */,
-  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */,
-  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
-  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
+  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */
 };
 
 // src/status-report.ts

lib/upload-sarif-action-post.js

@@ -45986,7 +45986,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.32.6",
+      version: "4.32.7",
       private: true,
       description: "CodeQL action",
       scripts: {
@@ -46047,20 +46047,20 @@ var require_package = __commonJS({
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^21.0.0",
-        ava: "^6.4.1",
+        ava: "^7.0.0",
         esbuild: "^0.27.3",
         eslint: "^9.39.2",
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.6.0",
+        "eslint-plugin-jsdoc": "^62.7.1",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
-        globals: "^17.3.0",
+        globals: "^17.4.0",
         nock: "^14.0.11",
-        sinon: "^21.0.1",
+        sinon: "^21.0.2",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.0"
+        "typescript-eslint": "^8.56.1"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -161287,6 +161287,7 @@ retry.VERSION = VERSION7;
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
@@ -161301,10 +161302,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         error: core5.error
       },
       retry: {
-        // The default is 400, 401, 403, 404, 410, 422, and 451. We have observed transient errors
-        // with authentication, so we remove 401, 403, and 404 from the default list to ensure that
-        // these errors are retried.
-        doNotRetry: [400, 410, 422, 451]
+        doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
@@ -161518,6 +161516,7 @@ var semver2 = __toESM(require_semver2());
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
+  RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
@@ -161568,6 +161567,12 @@ var semver3 = __toESM(require_semver2());
 
 // src/overlay/index.ts
 var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1";
+var CODEQL_OVERLAY_MINIMUM_VERSION_GO = "2.24.2";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVA = "2.23.8";
+var CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON = "2.23.9";
+var CODEQL_OVERLAY_MINIMUM_VERSION_RUBY = "2.23.9";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
@@ -161654,70 +161659,48 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
     minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION
   },
-  ["overlay_analysis_actions" /* OverlayAnalysisActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: void 0
-  },
+  // Per-language overlay feature flags. Each has minimumVersion set to the
+  // minimum CLI version that supports overlay analysis for that language.
+  // Only languages that are GA or in staff-ship should have feature flags here.
   ["overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
   },
   ["overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_cpp" /* OverlayAnalysisCpp */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_csharp" /* OverlayAnalysisCsharp */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP
+  },
+  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO
   },
   ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: {
     defaultValue: false,
@@ -161729,25 +161712,20 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
     minimumVersion: void 0
   },
-  ["overlay_analysis_go" /* OverlayAnalysisGo */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
-    minimumVersion: void 0
-  },
   ["overlay_analysis_java" /* OverlayAnalysisJava */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVA
   },
   ["overlay_analysis_javascript" /* OverlayAnalysisJavascript */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_JAVASCRIPT
   },
   ["overlay_analysis_python" /* OverlayAnalysisPython */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON
   },
   ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: {
     defaultValue: false,
@@ -161757,23 +161735,13 @@ var featureConfig = {
   ["overlay_analysis_ruby" /* OverlayAnalysisRuby */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: void 0
-  },
-  ["overlay_analysis_rust" /* OverlayAnalysisRust */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
-    minimumVersion: void 0
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
   },
   ["overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
     minimumVersion: void 0
   },
-  ["overlay_analysis_swift" /* OverlayAnalysisSwift */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
-    minimumVersion: void 0
-  },
   ["python_default_is_to_not_extract_stdlib" /* PythonDefaultIsToNotExtractStdlib */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -161789,11 +161757,8 @@ var featureConfig = {
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
-    // For testing, this is not behind a CLI version check yet. However
-    // before rolling this out externally, we should set a minimum version here
-    // since current versions of the CodeQL CLI will log if baseline information
-    // cannot be found when interpreting results.
-    minimumVersion: void 0
+    minimumVersion: void 0,
+    toolsFeature: "suppressesMissingFileBaselineWarning" /* SuppressesMissingFileBaselineWarning */
   },
   ["start_proxy_remove_unused_registries" /* StartProxyRemoveUnusedRegistries */]: {
     defaultValue: false,
@@ -161811,11 +161776,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "bundleSupportsOverlay" /* BundleSupportsOverlay */
   },
-  ["use_repository_properties_v2" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["validate_db_config" /* ValidateDbConfig */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_VALIDATE_DB_CONFIG",
@@ -161836,28 +161796,20 @@ var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3;
 var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6;
 var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024;
 var OVERLAY_ANALYSIS_FEATURES = {
-  actions: "overlay_analysis_actions" /* OverlayAnalysisActions */,
-  cpp: "overlay_analysis_cpp" /* OverlayAnalysisCpp */,
   csharp: "overlay_analysis_csharp" /* OverlayAnalysisCsharp */,
   go: "overlay_analysis_go" /* OverlayAnalysisGo */,
   java: "overlay_analysis_java" /* OverlayAnalysisJava */,
   javascript: "overlay_analysis_javascript" /* OverlayAnalysisJavascript */,
   python: "overlay_analysis_python" /* OverlayAnalysisPython */,
-  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */,
-  rust: "overlay_analysis_rust" /* OverlayAnalysisRust */,
-  swift: "overlay_analysis_swift" /* OverlayAnalysisSwift */
+  ruby: "overlay_analysis_ruby" /* OverlayAnalysisRuby */
 };
 var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
-  actions: "overlay_analysis_code_scanning_actions" /* OverlayAnalysisCodeScanningActions */,
-  cpp: "overlay_analysis_code_scanning_cpp" /* OverlayAnalysisCodeScanningCpp */,
   csharp: "overlay_analysis_code_scanning_csharp" /* OverlayAnalysisCodeScanningCsharp */,
   go: "overlay_analysis_code_scanning_go" /* OverlayAnalysisCodeScanningGo */,
   java: "overlay_analysis_code_scanning_java" /* OverlayAnalysisCodeScanningJava */,
   javascript: "overlay_analysis_code_scanning_javascript" /* OverlayAnalysisCodeScanningJavascript */,
   python: "overlay_analysis_code_scanning_python" /* OverlayAnalysisCodeScanningPython */,
-  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */,
-  rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
-  swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
+  ruby: "overlay_analysis_code_scanning_ruby" /* OverlayAnalysisCodeScanningRuby */
 };
 
 // src/setup-codeql.ts

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.32.6",
+  "version": "4.32.7",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -61,20 +61,20 @@
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.7.1",
     "@types/sinon": "^21.0.0",
-    "ava": "^6.4.1",
+    "ava": "^7.0.0",
     "esbuild": "^0.27.3",
     "eslint": "^9.39.2",
     "eslint-import-resolver-typescript": "^3.8.7",
     "eslint-plugin-github": "^6.0.0",
     "eslint-plugin-import-x": "^4.16.1",
-    "eslint-plugin-jsdoc": "^62.6.0",
+    "eslint-plugin-jsdoc": "^62.7.1",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^11.1.0",
-    "globals": "^17.3.0",
+    "globals": "^17.4.0",
     "nock": "^14.0.11",
-    "sinon": "^21.0.1",
+    "sinon": "^21.0.2",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.56.0"
+    "typescript-eslint": "^8.56.1"
   },
   "overrides": {
     "@actions/tool-cache": {

pr-checks/checks/all-platform-bundle.yml

@@ -1,7 +1,11 @@
 name: "All-platform bundle"
 description: "Tests using an all-platform CodeQL Bundle"
-operatingSystems: ["ubuntu", "macos", "windows"]
-versions: ["nightly-latest"]
+operatingSystems:
+  - ubuntu
+  - macos
+  - windows
+versions:
+  - nightly-latest
 useAllPlatformBundle: "true"
 installGo: true
 installDotNet: true

pr-checks/checks/analysis-kinds.yml

@@ -1,7 +1,13 @@
 name: "Analysis kinds"
 description: "Tests basic functionality for different `analysis-kinds` inputs."
-versions: ["linked", "nightly-latest"]
-analysisKinds: ["code-scanning", "code-quality", "code-scanning,code-quality", "risk-assessment"]
+versions:
+  - linked
+  - nightly-latest
+analysisKinds:
+  - code-scanning
+  - code-quality
+  - code-scanning,code-quality
+  - risk-assessment
 env:
   CODEQL_ACTION_RISK_ASSESSMENT_ID: 1
   CHECK_SCRIPT: |
@@ -40,7 +46,7 @@ steps:
       post-processed-sarif-path: "${{ runner.temp }}/post-processed"
 
   - name: Upload SARIF files
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: |
         analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -48,7 +54,7 @@ steps:
       retention-days: 7
 
   - name: Upload post-processed SARIF
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: |
         post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}

pr-checks/checks/analyze-ref-input.yml

@@ -1,8 +1,8 @@
 name: "Analyze: 'ref' and 'sha' from inputs"
 description: "Checks that specifying 'ref' and 'sha' as inputs works"
-versions: ["default"]
+versions:
+  - default
 installGo: true
-installPython: true
 installDotNet: true
 steps:
   - uses: ./../action/init

pr-checks/checks/autobuild-action.yml

@@ -1,7 +1,11 @@
 name: "autobuild-action"
 description: "Tests that the C# autobuild action works"
-operatingSystems: ["ubuntu", "macos", "windows"]
-versions: ["linked"]
+operatingSystems:
+  - ubuntu
+  - macos
+  - windows
+versions:
+  - linked
 installDotNet: true
 steps:
   - uses: ./../action/init

pr-checks/checks/autobuild-direct-tracing-with-working-dir.yml

@@ -3,8 +3,12 @@ description: >
   An end-to-end integration test of a Java repository built using 'build-mode: autobuild',
   with direct tracing enabled and a custom working directory specified as the input to the
   autobuild Action.
-operatingSystems: ["ubuntu", "windows"]
-versions: ["linked", "nightly-latest"]
+operatingSystems:
+  - ubuntu
+  - windows
+versions:
+  - linked
+  - nightly-latest
 installJava: true
 env:
   CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true

pr-checks/checks/autobuild-working-dir.yml

@@ -1,6 +1,7 @@
 name: "Autobuild working directory"
 description: "Tests working-directory input of autobuild action"
-versions: ["linked"]
+versions:
+  - linked
 steps:
   - name: Test setup
     run: |

pr-checks/checks/build-mode-autobuild.yml

@@ -1,7 +1,11 @@
 name: "Build mode autobuild"
 description: "An end-to-end integration test of a Java repository built using 'build-mode: autobuild'"
-operatingSystems: ["ubuntu", "windows"]
-versions: ["linked", "nightly-latest"]
+operatingSystems:
+  - ubuntu
+  - windows
+versions:
+  - linked
+  - nightly-latest
 installJava: true
 installYq: true
 steps:

pr-checks/checks/build-mode-manual.yml

@@ -1,6 +1,7 @@
 name: "Build mode manual"
 description: "An end-to-end integration test of a Java repository built using 'build-mode: manual'"
-versions: ["nightly-latest"]
+versions:
+  - nightly-latest
 installGo: true
 installDotNet: true
 steps:

pr-checks/checks/build-mode-none.yml

@@ -1,6 +1,8 @@
 name: "Build mode none"
 description: "An end-to-end integration test of a Java repository built using 'build-mode: none'"
-versions: ["linked", "nightly-latest"]
+versions:
+  - linked
+  - nightly-latest
 steps:
   - uses: ./../action/init
     id: init

pr-checks/checks/build-mode-rollback.yml

@@ -1,6 +1,7 @@
 name: "Build mode rollback"
 description: "The build mode is rolled back from none to autobuild when the relevant feature flag is enabled."
-versions: ["nightly-latest"]
+versions:
+  - nightly-latest
 env:
   CODEQL_ACTION_DISABLE_JAVA_BUILDLESS: true
 steps:

pr-checks/checks/bundle-toolcache.yml

@@ -3,8 +3,8 @@ description: "The CodeQL bundle should be cached within the toolcache"
 versions:
   - linked
 operatingSystems:
-  - macos
   - ubuntu
+  - macos
   - windows
 steps:
   - name: Remove CodeQL from toolcache

pr-checks/checks/bundle-zstd.yml

@@ -3,8 +3,8 @@ description: "A Zstandard CodeQL bundle should be extracted on supported operati
 versions:
   - linked
 operatingSystems:
-  - macos
   - ubuntu
+  - macos
   - windows
 steps:
   - name: Remove CodeQL from toolcache
@@ -27,7 +27,7 @@ steps:
       output: ${{ runner.temp }}/results
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: ${{ matrix.os }}-zstd-bundle.sarif
       path: ${{ runner.temp }}/results/javascript.sarif

pr-checks/checks/cleanup-db-cluster-dir.yml

@@ -1,6 +1,7 @@
 name: "Clean up database cluster directory"
 description: "The database cluster directory is cleaned up if it is not empty."
-versions: ["linked"]
+versions:
+  - linked
 steps:
   - name: Add a file to the database cluster directory
     run: |

pr-checks/checks/config-export.yml

@@ -1,6 +1,8 @@
 name: "Config export"
 description: "Tests that the code scanning configuration file is exported to SARIF correctly."
-versions: ["linked", "nightly-latest"]
+versions:
+  - linked
+  - nightly-latest
 steps:
   - uses: ./../action/init
     with:
@@ -12,7 +14,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"

pr-checks/checks/config-input.yml

@@ -1,7 +1,8 @@
 name: "Config input"
 description: "Tests specifying configuration using the config input"
 installNode: true
-versions: ["linked"]
+versions:
+  - linked
 steps:
   - name: Copy queries into workspace
     run: |

pr-checks/checks/cpp-deptrace-disabled.yml

@@ -1,6 +1,9 @@
 name: "C/C++: disabling autoinstalling dependencies (Linux)"
 description: "Checks that running C/C++ autobuild with autoinstalling dependencies explicitly disabled works"
-versions: ["linked", "default", "nightly-latest"]
+versions:
+  - linked
+  - default
+  - nightly-latest
 env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:

pr-checks/checks/cpp-deptrace-enabled-on-macos.yml

@@ -1,7 +1,10 @@
 name: "C/C++: autoinstalling dependencies is skipped (macOS)"
 description: "Checks that running C/C++ autobuild with autoinstalling dependencies explicitly enabled is a no-op on macOS"
-operatingSystems: ["macos"]
-versions: ["linked", "nightly-latest"]
+operatingSystems:
+  - macos
+versions:
+  - linked
+  - nightly-latest
 env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:

pr-checks/checks/cpp-deptrace-enabled.yml

@@ -1,6 +1,9 @@
 name: "C/C++: autoinstalling dependencies (Linux)"
 description: "Checks that running C/C++ autobuild with autoinstalling dependencies works"
-versions: ["linked", "default", "nightly-latest"]
+versions:
+  - linked
+  - default
+  - nightly-latest
 env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:

pr-checks/checks/diagnostics-export.yml

@@ -1,6 +1,8 @@
 name: "Diagnostic export"
 description: "Tests that manually added diagnostics are correctly exported to SARIF."
-versions: ["linked", "nightly-latest"]
+versions:
+  - linked
+  - nightly-latest
 env:
   CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
 steps:
@@ -25,7 +27,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"

pr-checks/checks/export-file-baseline-information.yml

@@ -1,7 +1,11 @@
 name: "Export file baseline information"
 description: "Tests that file baseline information is exported when the feature is enabled"
-operatingSystems: ["ubuntu", "macos", "windows"]
-versions: ["nightly-latest"]
+operatingSystems:
+  - ubuntu
+  - macos
+  - windows
+versions:
+  - nightly-latest
 installGo: true
 installDotNet: true
 env:
@@ -19,7 +23,7 @@ steps:
     with:
       output: "${{ runner.temp }}/results"
   - name: Upload SARIF
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"

pr-checks/checks/extractor-ram-threads.yml

@@ -1,6 +1,7 @@
 name: "Extractor ram and threads options test"
 description: "Tests passing RAM and threads limits to extractors"
-versions: ["linked"]
+versions:
+  - linked
 steps:
   - uses: ./../action/init
     with:

pr-checks/checks/global-proxy.yml

@@ -1,6 +1,8 @@
 name: "Proxy test"
 description: "Tests using a proxy specified by the https_proxy environment variable"
-versions: ["linked", "nightly-latest"]
+versions:
+  - linked
+  - nightly-latest
 container:
   image: ubuntu:22.04
 services:

pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml

@@ -2,7 +2,8 @@ name: "Go: diagnostic when Go is changed after init step"
 description: "Checks that we emit a diagnostic if Go is changed after the init step"
 # only Linux is affected
 # pinned to a version which does not support statically linked binaries for indirect tracing
-versions: ["default"]
+versions:
+  - default
 installGo: true
 collection: go
 steps:

pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml

@@ -2,7 +2,8 @@ name: "Go: diagnostic when `file` is not installed"
 description: "Checks that we emit a diagnostic if the `file` program is not installed"
 # only Linux is affected
 # pinned to a version which does not support statically linked binaries for indirect tracing
-versions: ["default"]
+versions:
+  - default
 installGo: true
 collection: go
 steps:

pr-checks/checks/go-indirect-tracing-workaround.yml

@@ -2,7 +2,8 @@ name: "Go: workaround for indirect tracing"
 description: "Checks that our workaround for indirect tracing for Go 1.21+ on Linux works"
 # only Linux is affected
 # pinned to a version which does not support statically linked binaries for indirect tracing
-versions: ["default"]
+versions:
+  - default
 installGo: true
 collection: go
 steps:

pr-checks/checks/go-tracing-autobuilder.yml

@@ -1,7 +1,13 @@
 name: "Go: tracing with autobuilder step"
 description: "Checks that Go tracing works when using an autobuilder step"
 collection: go
-operatingSystems: ["ubuntu", "macos"]
+operatingSystems:
+  - ubuntu
+  - macos
+osCodeQlVersions:
+  macos:
+    - linked
+    - nightly-latest
 env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 installGo: true

pr-checks/checks/go-tracing-custom-build-steps.yml

@@ -1,7 +1,13 @@
 name: "Go: tracing with custom build steps"
 description: "Checks that Go tracing traces the build when using custom build steps"
 collection: go
-operatingSystems: ["ubuntu", "macos"]
+operatingSystems:
+  - ubuntu
+  - macos
+osCodeQlVersions:
+  macos:
+    - linked
+    - nightly-latest
 installGo: true
 steps:
   - uses: ./../action/init

pr-checks/checks/go-tracing-legacy-workflow.yml

@@ -1,7 +1,13 @@
 name: "Go: tracing with legacy workflow"
 description: "Checks that we run the autobuilder in legacy workflows with neither an autobuild step nor manual build steps"
 collection: go
-operatingSystems: ["ubuntu", "macos"]
+operatingSystems:
+  - ubuntu
+  - macos
+osCodeQlVersions:
+  macos:
+    - linked
+    - nightly-latest
 env:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 installGo: true

pr-checks/checks/init-with-registries.yml

@@ -4,12 +4,11 @@
 # basic mechanics of multi-registry auth is working.
 name: "Packaging: Download using registries"
 description: "Checks that specifying a registries block and associated auth works as expected"
-versions: [
-    # This feature is not compatible with older CLIs
-    "default",
-    "linked",
-    "nightly-latest",
-]
+versions:
+  # This feature is not compatible with older CLIs
+  - default
+  - linked
+  - nightly-latest
 
 permissions:
   contents: read

pr-checks/checks/javascript-source-root.yml

@@ -1,6 +1,10 @@
 name: "Custom source root"
 description: "Checks that the argument specifying a non-default source root works"
-versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
+# This feature is not compatible with old CLIs
+versions:
+  - linked
+  - default
+  - nightly-latest
 steps:
   - name: Move codeql-action
     run: |

pr-checks/checks/job-run-uuid-sarif.yml

@@ -1,6 +1,7 @@
 name: "Job run UUID added to SARIF"
 description: "Tests that the job run UUID is added to the SARIF output"
-versions: ["nightly-latest"]
+versions:
+  - nightly-latest
 steps:
   - uses: ./../action/init
     id: init
@@ -11,7 +12,7 @@ steps:
     with:
       output: "${{ runner.temp }}/results"
   - name: Upload SARIF
-    uses: actions/upload-artifact@v6
+    uses: actions/upload-artifact@v7
     with:
       name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"

pr-checks/checks/language-aliases.yml

@@ -1,6 +1,7 @@
 name: "Language aliases"
 description: "Tests that language aliases are resolved correctly"
-versions: ["linked"]
+versions:
+  - linked
 steps:
   - uses: ./../action/init
     with:

pr-checks/checks/local-bundle.yml

@@ -1,8 +1,8 @@
 name: "Local CodeQL bundle"
 description: "Tests using a CodeQL bundle from a local file rather than a URL"
-versions: ["linked"]
+versions:
+  - linked
 installGo: true
-installPython: true
 installDotNet: true
 steps:
   - name: Fetch latest CodeQL bundle

pr-checks/checks/multi-language-autodetect.yml

@@ -1,12 +1,21 @@
 name: "Multi-language repository"
-description: "An end-to-end integration test of a multi-language repository using automatic language detection for macOS"
-operatingSystems: ["macos", "ubuntu"]
+description: "An end-to-end integration test of a multi-language repository using automatic language detection"
+operatingSystems:
+  - ubuntu
+  - macos
 env:
   CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
 installGo: true
-installPython: true
 installDotNet: true
 steps:
+  - name: Install Python 3.13 for older CLI versions
+    # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
+    # See https://github.com/github/codeql-action/pull/3212
+    if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
+    uses: actions/setup-python@v6
+    with:
+      python-version: "3.13"
+
   - name: Use Xcode 16
     if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
     run: sudo xcode-select -s "/Applications/Xcode_16.app"

pr-checks/checks/overlay-init-fallback.yml

@@ -1,6 +1,8 @@
 name: "Overlay database init fallback"
 description: "Tests that overlay init action succeeds with non-overlay packs"
-versions: ["linked", "nightly-latest"]
+versions:
+  - linked
+  - nightly-latest
 steps:
   - uses: ./../action/init
     with:

pr-checks/checks/packaging-codescanning-config-inputs-js.yml

@@ -1,9 +1,12 @@
 name: "Packaging: Config and input passed to the CLI"
 description: "Checks that specifying packages using a combination of a config file and input to the Action works"
-versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
+# This feature is not compatible with old CLIs
+versions:
+  - linked
+  - default
+  - nightly-latest
 installGo: true
 installNode: true
-installPython: true
 installDotNet: true
 steps:
   - uses: ./../action/init

pr-checks/checks/packaging-config-inputs-js.yml

@@ -1,6 +1,10 @@
 name: "Packaging: Config and input"
 description: "Checks that specifying packages using a combination of a config file and input to the Action works"
-versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
+# This feature is not compatible with old CLIs
+versions:
+  - linked
+  - default
+  - nightly-latest
 installGo: true
 installNode: true
 installDotNet: true

pr-checks/checks/packaging-config-js.yml

@@ -1,6 +1,10 @@
 name: "Packaging: Config file"
 description: "Checks that specifying packages using only a config file works"
-versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
+# This feature is not compatible with old CLIs
+versions:
+  - linked
+  - default
+  - nightly-latest
 installGo: true
 installNode: true
 installDotNet: true

pr-checks/checks/packaging-inputs-js.yml

@@ -1,6 +1,10 @@
 name: "Packaging: Action input"
 description: "Checks that specifying packages using the input to the Action works"
-versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
+# This feature is not compatible with old CLIs
+versions:
+  - linked
+  - default
+  - nightly-latest
 installGo: true
 installNode: true
 installDotNet: true

pr-checks/checks/remote-config.yml

@@ -6,7 +6,6 @@ versions:
   - linked
   - nightly-latest
 installGo: true
-installPython: true
 installDotNet: true
 steps:
   - uses: ./../action/init

pr-checks/checks/resolve-environment-action.yml

@@ -1,6 +1,9 @@
 name: "Resolve environment"
 description: "Tests that the resolve-environment action works for Go and JavaScript/TypeScript"
-versions: ["default", "linked", "nightly-latest"]
+versions:
+  - linked
+  - default
+  - nightly-latest
 steps:
   - uses: ./../action/init
     with:

pr-checks/checks/risk-assessment-failure.yml

@@ -0,0 +1,33 @@
+name: Risk Assessment analysis failure uploads SARIF artifact
+description: Check that a SARIF file is uploaded as artifact if Risk Assessment fails
+versions: ["default"]
+
+permissions:
+  contents: read
+  security-events: write # needed to upload the SARIF file
+
+steps:
+  - name: Initialise CodeQL
+    uses: ./../action/init
+    id: init
+    with:
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      languages: javascript
+      analysis-kinds: risk-assessment
+
+  - name: Fail
+    run: exit 1
+
+validationJobs:
+  artifact-present:
+    name: Check artifact
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          pattern: sarif-artifact-*
+          path: ${{ runner.temp }}/results
+          merge-multiple: true
+      - name: List contents
+        run: |
+          ls -lr

pr-checks/checks/rubocop-multi-language.yml

@@ -1,7 +1,8 @@
 name: "RuboCop multi-language"
 description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
 # This check doesn't use CodeQL, so the `version` matrix variable is unused.
-versions: ["default"]
+versions:
+  - default
 steps:
   - name: Set up Ruby
     uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0