Add PR check for CSRA artifact upload

2026-05-09 15:20:28 +00:00 · 2026-03-12 12:24:25 +00:00
140 changed files with 313111 additions and 39667 deletions
@@ -22,8 +22,7 @@ runs:
        MAJOR_VERSION: ${{ inputs.major_version }}
        LATEST_TAG: ${{ inputs.latest_tag }}
      run: |
-        npm ci
-        npx tsx ./pr-checks/release-branches.ts \
+        python ${{ github.action_path }}/release-branches.py \
            --major-version "$MAJOR_VERSION" \
            --latest-tag "$LATEST_TAG"
      shell: bash
@@ -0,0 +1,55 @@
+import argparse
+import json
+import os
+import configparser
+
+# Name of the remote
+ORIGIN = 'origin'
+
+script_dir = os.path.dirname(os.path.realpath(__file__))
+grandparent_dir = os.path.dirname(os.path.dirname(script_dir))
+
+config = configparser.ConfigParser()
+with open(os.path.join(grandparent_dir, 'releases.ini')) as stream:
+    config.read_string('[default]\n' + stream.read())
+
+OLDEST_SUPPORTED_MAJOR_VERSION = int(config['default']['OLDEST_SUPPORTED_MAJOR_VERSION'])
+
+def main():
+
+  parser = argparse.ArgumentParser()
+  parser.add_argument("--major-version", required=True, type=str, help="The major version of the release")
+  parser.add_argument("--latest-tag", required=True, type=str, help="The most recent tag published to the repository")
+  args = parser.parse_args()
+
+  major_version = args.major_version
+  latest_tag = args.latest_tag
+
+  print("major_version: " + major_version)
+  print("latest_tag: " + latest_tag)
+
+  # If this is a primary release, we backport to all supported branches,
+  # so we check whether the major_version taken from the package.json
+  # is greater than or equal to the latest tag pulled from the repo.
+  # For example...
+  #     'v1' >= 'v2' is False # we're operating from an older release branch and should not backport
+  #     'v2' >= 'v2' is True  # the normal case where we're updating the current version
+  #     'v3' >= 'v2' is True  # in this case we are making the first release of a new major version
+  consider_backports = ( major_version >= latest_tag.split(".")[0] )
+
+  with open(os.environ["GITHUB_OUTPUT"], "a") as f:
+
+    f.write(f"backport_source_branch=releases/{major_version}\n")
+
+    backport_target_branches = []
+
+    if consider_backports:
+      for i in range(int(major_version.strip("v"))-1, 0, -1):
+        branch_name = f"releases/v{i}"
+        if i >= OLDEST_SUPPORTED_MAJOR_VERSION:
+          backport_target_branches.append(branch_name)
+
+    f.write("backport_target_branches="+json.dumps(backport_target_branches)+"\n")
+
+if __name__ == "__main__":
+  main()
@@ -15,12 +15,6 @@ runs:
      run: echo "$GITHUB_CONTEXT"
      shell: bash

-    - name: Set up Node
-      uses: actions/setup-node@v6
-      with:
-        node-version: 20
-        cache: 'npm'
-
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
@@ -1,5 +1,5 @@
 name: "CodeQL config"
-queries:
+queries: 
  - name: Run custom queries
    uses: ./queries
  # Run all extra query suites, both because we want to
@@ -13,5 +13,3 @@ queries:
 paths-ignore:
  - lib
  - tests
-  - "**/*.test.ts"
-  - "**/testing-util.ts"
@@ -1,9 +1,7 @@
 version: 2
 updates:
  - package-ecosystem: npm
-    directories:
-      - "/"
-      - "/pr-checks"
+    directory: "/"
    schedule:
      interval: weekly
    cooldown:
@@ -0,0 +1 @@
+OLDEST_SUPPORTED_MAJOR_VERSION=3
@@ -60,12 +60,12 @@ jobs:
          setup-kotlin: 'true'
      - uses: ./../action/init
        with:
-          languages: C#,java-kotlin,typescript
+          languages: C#,java-kotlin,swift,typescript
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - name: 'Check languages'
        run: |
-          expected_languages="csharp,java,javascript"
+          expected_languages="csharp,java,swift,javascript"
          actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

          if [ "$expected_languages" != "$actual_languages" ]; then
@@ -0,0 +1,94 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Risk Assessment analysis failure uploads SARIF artifact
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: risk-assessment-failure-${{github.ref}}
+jobs:
+  risk-assessment-failure:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: Risk Assessment analysis failure uploads SARIF artifact
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: write
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Initialise CodeQL
+        uses: ./../action/init
+        id: init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: javascript
+          analysis-kinds: risk-assessment
+
+      - name: Fail
+        run: exit 1
+    env:
+      CODEQL_ACTION_TEST_MODE: true
+  artifact-present:
+    name: Check artifact
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - risk-assessment-failure
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          pattern: sarif-artifact-*
+          path: ${{ runner.temp }}/results
+          merge-multiple: true
+      - name: List contents
+        run: |
+          ls -lr
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -59,7 +59,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@0cb964fd540e0a24c900370abf38a33466142735 # v1.305.0
+        uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -71,17 +71,7 @@ jobs:
        id: proxy
        uses: ./../action/start-proxy
        with:
-          registry_secrets: |
-            [
-              {
-                "type": "maven_repository",
-                "url": "https://repo.maven.apache.org/maven2/"
-              },
-              {
-                "type": "maven_repository",
-                "url": "https://repo1.maven.org/maven2"
-              }
-            ]
+          registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

      - name: Print proxy outputs
        run: |
@@ -92,12 +82,5 @@ jobs:
      - name: Fail if proxy outputs are not set
        if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
        run: exit 1
-
-      - name: Fail if proxy_urls does not contain all registries
-        if: |
-          join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-        run: exit 1
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -6,6 +6,13 @@ env:
  # Diff informed queries add an additional query filter which is not yet
  # taken into account by these tests.
  CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
+  # Specify overlay enablement manually to ensure stability around the exclude-from-incremental
+  # query filter. Here we only enable for the default code scanning suite.
+  CODEQL_ACTION_OVERLAY_ANALYSIS: true
+  CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT: false
+  CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT: true
+  CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK: false
+  CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS: true

 on:
  push:
@@ -72,13 +79,33 @@ jobs:
      with:
        version: ${{ matrix.version }}

-    - name: Empty file
+    # On PRs, overlay analysis may change the config that is passed to the CLI.
+    # Therefore, we have two variants of the following test, one for PRs and one for other events.
+    - name: Empty file (non-PR)
+      if: github.event_name != 'pull_request'
      uses: ./../action/.github/actions/check-codescanning-config
      with:
        expected-config-file-contents: "{}"
        languages: javascript
        tools: ${{ steps.prepare-test.outputs.tools-url }}

+    - name: Empty file (PR)
+      if: github.event_name == 'pull_request'
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "query-filters": [
+              {
+                "exclude": {
+                  "tags": "exclude-from-incremental"
+                }
+              }
+            ]
+          }
+        languages: javascript
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
    - name: Packs from input
      if: success() || failure()
      uses: ./../action/.github/actions/check-codescanning-config
@@ -66,7 +66,6 @@ jobs:
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
        with:
-          languages: cpp,csharp,go,java,javascript,python
          tools: ${{ steps.prepare-test.outputs.tools-url }}
          debug: true
          debug-artifact-name: my-debug-artifacts
@@ -1,106 +0,0 @@
-# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
-# already passed CI before being merged. Therefore if they fail, we should make sure that there
-# wasn't a transient failure by rerunning the failed jobs once before investigating further.
-name: Deflake
-
-on:
-  workflow_run:
-    types: [completed]
-    # Exclude workflows that have significant side effects, like publishing releases. It's OK to
-    # retry CodeQL analysis.
-    workflows:
-      - Check Expected Release Files
-      - Code-Scanning config CLI tests
-      - CodeQL action
-      - Manual Check - go
-      - "PR Check - All-platform bundle"
-      - "PR Check - Analysis kinds"
-      - "PR Check - Analyze: 'ref' and 'sha' from inputs"
-      - "PR Check - autobuild-action"
-      - "PR Check - Autobuild direct tracing (custom working directory)"
-      - "PR Check - Autobuild working directory"
-      - "PR Check - Build mode autobuild"
-      - "PR Check - Build mode manual"
-      - "PR Check - Build mode none"
-      - "PR Check - Build mode rollback"
-      - "PR Check - Bundle: Caching checks"
-      - "PR Check - Bundle: From nightly"
-      - "PR Check - Bundle: From toolcache"
-      - "PR Check - Bundle: Zstandard checks"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
-      - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
-      - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
-      - "PR Check - Config export"
-      - "PR Check - Config input"
-      - "PR Check - Custom source root"
-      - "PR Check - Debug artifact upload"
-      - "PR Check - Debug artifacts after failure"
-      - "PR Check - Diagnostic export"
-      - "PR Check - Export file baseline information"
-      - "PR Check - Extractor ram and threads options test"
-      - "PR Check - Go: Custom queries"
-      - "PR Check - Go: diagnostic when Go is changed after init step"
-      - "PR Check - Go: diagnostic when `file` is not installed"
-      - "PR Check - Go: tracing with autobuilder step"
-      - "PR Check - Go: tracing with custom build steps"
-      - "PR Check - Go: tracing with legacy workflow"
-      - "PR Check - Go: workaround for indirect tracing"
-      - "PR Check - Job run UUID added to SARIF"
-      - "PR Check - Language aliases"
-      - "PR Check - Local CodeQL bundle"
-      - "PR Check - Multi-language repository"
-      - "PR Check - Overlay database init fallback"
-      - "PR Check - Packaging: Action input"
-      - "PR Check - Packaging: Config and input"
-      - "PR Check - Packaging: Config and input passed to the CLI"
-      - "PR Check - Packaging: Config file"
-      - "PR Check - Packaging: Download using registries"
-      - "PR Check - Proxy test"
-      - "PR Check - Remote config file"
-      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
-      - "PR Check - Ruby analysis"
-      - "PR Check - Rust analysis"
-      - "PR Check - Split workflow"
-      - "PR Check - Start proxy"
-      - "PR Check - Submit SARIF after failure"
-      - "PR Check - Swift analysis using a custom build command"
-      - "PR Check - Swift analysis using autobuild"
-      - "PR Check - Test different uses of `upload-sarif`"
-      - "PR Check - Test unsetting environment variables"
-      - "PR Check - Upload-sarif: ref and sha from inputs"
-      - "PR Check - Use a custom `checkout_path`"
-      - PR Checks
-      - Query filters tests
-      - Test that the workaround for python 3.12 on windows works
-
-jobs:
-  rerun-on-failure:
-    name: Rerun failed jobs
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      github.event.workflow_run.run_attempt == 1 &&
-      (
-        github.event.workflow_run.head_branch == 'main' ||
-        startsWith(github.event.workflow_run.head_branch, 'releases/') ||
-        github.event.workflow_run.event == 'merge_group'
-      )
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NAME: ${{ github.event.workflow_run.name }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          echo "Rerunning failed jobs for workflow run ${RUN_ID}"
-          gh run rerun "${RUN_ID}" --failed
-          echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"
@@ -24,7 +24,7 @@ defaults:

 jobs:
  merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    if: github.repository == 'github/codeql-action'
    env:
@@ -131,7 +131,7 @@ jobs:
          echo "::endgroup::"

      - name: Generate token
-        uses: actions/create-github-app-token@v3.1.1
+        uses: actions/create-github-app-token@v2.2.1
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -92,9 +92,6 @@ jobs:
          node-version: 24
          cache: 'npm'

-      - name: Install dependencies
-        run: npm ci
-
      - name: Verify PR checks up to date
        if: always()
        run: .github/workflows/script/verify-pr-checks.sh
@@ -102,7 +99,7 @@ jobs:
      - name: Run pr-checks tests
        if: always()
        working-directory: pr-checks
-        run: npx tsx --test
+        run: npm ci && npx tsx --test

  check-node-version:
    if: github.triggering_actor != 'dependabot[bot]'
@@ -29,7 +29,7 @@ defaults:
 jobs:
  prepare:
    name: "Prepare release"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.repository == 'github/codeql-action'

    permissions:
@@ -34,6 +34,9 @@ jobs:
        with:
          node-version: 24
          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            pr-checks/package-lock.json

      - name: Remove label
        if: github.event_name == 'pull_request'
@@ -94,7 +97,7 @@ jobs:
        working-directory: pr-checks
        run: |
          npm ci
-          npx tsx sync-back.ts --verbose
+          npx tsx sync_back.ts --verbose

      - name: Generate workflows
        working-directory: pr-checks
@@ -136,7 +136,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v3.1.1
+        uses: actions/create-github-app-token@v2.2.1
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Update the required checks based on the current branch.
+
+set -euo pipefail
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+REPO_DIR="$(dirname "$SCRIPT_DIR")"
+GRANDPARENT_DIR="$(dirname "$REPO_DIR")"
+source "$GRANDPARENT_DIR/releases.ini"
+
+if ! gh auth status 2>/dev/null; then
+  gh auth status
+  echo "Failed: Not authorized. This script requires admin access to github/codeql-action through the gh CLI."
+  exit 1
+fi
+
+if [ "$#" -eq 1 ]; then
+  # If we were passed an argument, use that as the SHA
+  GITHUB_SHA="$1"
+elif [ "$#" -gt 1 ]; then
+  echo "Usage: $0 [SHA]"
+  echo "Update the required checks based on the SHA, or main."
+  exit 1
+elif [ -z "$GITHUB_SHA" ]; then
+  # If we don't have a SHA, use main
+  GITHUB_SHA="$(git rev-parse main)"
+fi
+
+echo "Getting checks for $GITHUB_SHA"
+
+# Ignore any checks with "https://", CodeQL, LGTM, Update, and ESLint checks.
+CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") or . == "Agent" or . == "Cleanup artifacts" or . == "Prepare" or . == "Upload results" or . == "Label PR with size" | not)] | unique | sort')"
+
+echo "$CHECKS" | jq
+
+# Fail if there are no checks
+if [ -z "$CHECKS" ] || [ "$(echo "$CHECKS" | jq '. | length')" -eq 0 ]; then
+  echo "No checks found for $GITHUB_SHA"
+  exit 1
+fi
+
+echo "{\"contexts\": ${CHECKS}}" > checks.json
+
+echo "Updating main"
+gh api --silent -X "PATCH" "repos/github/codeql-action/branches/main/protection/required_status_checks" --input checks.json
+
+# list all branchs on origin remote matching releases/v*
+BRANCHES="$(git ls-remote --heads origin 'releases/v*' | sed 's?.*refs/heads/??' | sort -V)"
+
+for BRANCH in $BRANCHES; do
+
+  # strip exact 'releases/v' prefix from $BRANCH using count of characters
+  VERSION="${BRANCH:10}"
+
+  if [ "$VERSION" -lt "$OLDEST_SUPPORTED_MAJOR_VERSION" ]; then
+    echo "Skipping $BRANCH"
+    continue
+  fi
+
+  echo "Updating $BRANCH"
+  gh api --silent -X "PATCH" "repos/github/codeql-action/branches/$BRANCH/protection/required_status_checks" --input checks.json
+done
+
+rm checks.json
@@ -20,7 +20,7 @@ defaults:
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
@@ -57,17 +57,6 @@ jobs:
      - name: Update bundle
        uses: ./.github/actions/update-bundle

-      - name: Set up CodeQL CLI from new bundle
-        id: setup-codeql
-        uses: ./setup-codeql
-        with:
-          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
-
-      - name: Update built-in languages
-        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
-        env:
-          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
-
      - name: Bump Action minor version if new CodeQL minor version series
        id: bump-action-version
        run: |
@@ -26,7 +26,7 @@ jobs:

  update:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
@@ -77,7 +77,7 @@ jobs:

  backport:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -93,7 +93,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@v3.1.1
+      uses: actions/create-github-app-token@v2.2.1
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -11,5 +11,3 @@ build/
 eslint.sarif
 # for local incremental compilation
 tsconfig.tsbuildinfo
-# esbuild metadata file
-meta.json
@@ -1,30 +0,0 @@
-{
-  // Place your codeql-action workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and
-  // description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope
-  // is left empty or omitted, the snippet gets applied to all languages. The prefix is what is
-  // used to trigger the snippet and the body will be expanded and inserted. Possible variables are:
-  // $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders.
-  // Placeholders with the same ids are connected.
-  // Example:
-  // "Print to console": {
-  // 	"scope": "javascript,typescript",
-  // 	"prefix": "log",
-  // 	"body": [
-  // 		"console.log('$1');",
-  // 		"$2"
-  // 	],
-  // 	"description": "Log output to console"
-  // }
-  "Test Macro": {
-    "scope": "javascript, typescript",
-    "prefix": "testMacro",
-    "body": [
-      "const ${1:nameMacro} = test.macro({",
-      "  exec: async (t: ExecutionContext<unknown>) => {},",
-      "",
-      "  title: (providedTitle = \"\") => `${2:common title} - \\${providedTitle}`,",
-      "});",
-    ],
-    "description": "An Ava test macro",
-  },
-}
@@ -4,45 +4,6 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

 ## [UNRELEASED]

- For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
-
-## 4.35.3 - 01 May 2026
-
- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
- Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
- Best-effort connection tests for private registries now use `GET` requests instead of `HEAD` for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. [#3853](https://github.com/github/codeql-action/pull/3853)
- Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
- Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)
-
-## 4.35.2 - 15 Apr 2026
-
- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
- The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
- Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://github.com/github/codeql-action/pull/3794)
- Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
- Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
-
-## 4.35.1 - 27 Mar 2026
-
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
-
-## 4.35.0 - 27 Mar 2026
-
- Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
- Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)
-
-## 4.34.1 - 20 Mar 2026
-
- Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)
-
-## 4.34.0 - 20 Mar 2026
-
- Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
- We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
- Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)
-
-## 4.33.0 - 16 Mar 2026
-
 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)

  To opt out of this change:
@@ -51,9 +12,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
  - **User-owned repositories using advanced setup:** Set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
 - Fixed [a bug](https://github.com/github/codeql-action/issues/3555) which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. [#3557](https://github.com/github/codeql-action/pull/3557)
 - The CodeQL Action now loads [custom repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) on GitHub Enterprise Server, enabling the customization of features such as `github-codeql-disable-overlay` that was previously only available on GitHub.com. [#3559](https://github.com/github/codeql-action/pull/3559)
- Once [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. [#3563](https://github.com/github/codeql-action/pull/3563)
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
- A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

 ## 4.32.6 - 05 Mar 2026

@@ -69,14 +69,12 @@ Once the mergeback and backport pull request have been merged, the release is co

 ## Keeping the PR checks up to date (admin access required)

-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [sync-checks.ts](pr-checks/sync-checks.ts) script:
+Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:

- At a minimum, you must provide an argument for the `--token` input. For example, `--token "$(gh auth token)"` to use the same token that `gh` uses. If no token is provided or the token has insufficient permissions, the script will fail.
- By default, the script performs a dry run and outputs information about the changes it would make to the branch protection rules. To actually apply the changes, specify the `--apply` flag.
- If you run the script without any other arguments, it will retrieve the set of workflows that ran for the latest commit on `main`.
- You can specify a different git ref with the `--ref` input. You will likely want to use this if you have a PR that removes or adds PR checks. For example, `--ref "some/branch/name"` to use the HEAD of the `some/branch/name` branch.
+- If you run the script without an argument, it will retrieve the set of workflows that ran for the latest commit on `main`. Make sure that your local `main` branch is up to date before running the script.
+- You can specify a commit SHA as argument to retrieve the set of workflows for that commit instead. You will likely want to use this if you have a PR that removes or adds PR checks.

-After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v4`, and any other currently supported major versions have been updated.
+After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.

 Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.

@@ -124,7 +122,7 @@ To deprecate an older version of the Action:
   - Implement an Actions warning for customers using the deprecated version.
 1. Wait for the deprecation period to pass.
 1. Upgrade the Actions warning for customers using the deprecated version to a non-fatal error, and mention that this version of the Action is no longer supported.
-1. Make a PR to bump the `OLDEST_SUPPORTED_MAJOR_VERSION` in [config.ts](pr-checks/config.ts).  Once this PR is merged, the release process will no longer backport changes to the deprecated release version.
+1. Make a PR to bump the `OLDEST_SUPPORTED_MAJOR_VERSION` in [releases.ini](.github/releases.ini).  Once this PR is merged, the release process will no longer backport changes to the deprecated release version.

 ## Resources

@@ -72,7 +72,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n

 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
@@ -1,9 +0,0 @@
-export default {
-  typescript: {
-    rewritePaths: {
-      "src/": "build/",
-    },
-    compile: false,
-  },
-  require: ["./ava.setup.mjs"],
-};
@@ -1,3 +0,0 @@
-import pkg from "./package.json" with { type: "json" };
-
-globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;
@@ -1,12 +1,10 @@
-import { copyFile, rm, writeFile } from "node:fs/promises";
+import { copyFile, rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

 import * as esbuild from "esbuild";
 import { globSync } from "glob";

-import pkg from "./package.json" with { type: "json" };
-
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

@@ -15,7 +13,7 @@ const OUT_DIR = join(__dirname, "lib");

 /**
 * Clean the output directory before building.
- *
+ * 
 * @type {esbuild.Plugin}
 */
 const cleanPlugin = {
@@ -29,7 +27,7 @@ const cleanPlugin = {

 /**
 * Copy defaults.json to the output directory since other projects depend on it.
- *
+ * 
 * @type {esbuild.Plugin}
 */
 const copyDefaultsPlugin = {
@@ -64,24 +62,14 @@ const onEndPlugin = {

 const context = await esbuild.context({
  // Include upload-lib.ts as an entry point for use in testing environments.
-  entryPoints: globSync([
-    `${SRC_DIR}/*-action.ts`,
-    `${SRC_DIR}/*-action-post.ts`,
-    "src/upload-lib.ts",
-  ]),
+  entryPoints: globSync([`${SRC_DIR}/*-action.ts`, `${SRC_DIR}/*-action-post.ts`, "src/upload-lib.ts"]),
  bundle: true,
  format: "cjs",
  outdir: OUT_DIR,
  platform: "node",
  plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
  target: ["node20"],
-  define: {
-    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
-  },
-  metafile: true,
 });

-const result = await context.rebuild();
-await writeFile(join(__dirname, "meta.json"), JSON.stringify(result.metafile));
-
+await context.rebuild();
 await context.dispose();
@@ -7,11 +7,7 @@ import noAsyncForeach from "eslint-plugin-no-async-foreach";
 import jsdoc from "eslint-plugin-jsdoc";
 import tseslint from "typescript-eslint";
 import globals from "globals";
-import path from "path";
-import { fileURLToPath } from "url";

-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
 const githubFlatConfigs = github.getFlatConfigs();

 export default [
@@ -23,10 +19,9 @@ export default [
      "src/testdata/**/*",
      "tests/**/*",
      "build.mjs",
-      "ava.config.mjs",
-      "ava.setup.mjs",
      "eslint.config.mjs",
      ".github/**/*",
+      "pr-checks/**/*",
    ],
  },
  // eslint recommended config
@@ -47,7 +42,7 @@ export default [
    plugins: {
      "import-x": importX,
      "no-async-foreach": fixupPluginRules(noAsyncForeach),
-      jsdoc: jsdoc,
+      "jsdoc": jsdoc,
    },

    languageOptions: {
@@ -71,13 +66,7 @@ export default [

        typescript: {},
      },
-      "import/ignore": [
-        "sinon",
-        "uuid",
-        "@octokit/plugin-retry",
-        "del",
-        "get-folder-size",
-      ],
+      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size"],
      "import-x/resolver-next": [
        createTypeScriptImportResolver(),
        createNodeResolver({
@@ -153,7 +142,7 @@ export default [
          // We don't currently require full JSDoc coverage, so this rule
          // should not error on missing @param annotations.
          disableMissingParamChecks: true,
-        },
+        }
      ],
    },
  },
@@ -172,41 +161,11 @@ export default [
      "@typescript-eslint/no-unused-vars": [
        "error",
        {
-          args: "all",
-          argsIgnorePattern: "^_",
-        },
+          "args": "all",
+          "argsIgnorePattern": "^_",
+        }
      ],
      "func-style": "off",
    },
  },
-  {
-    files: ["pr-checks/**/*.ts"],
-
-    languageOptions: {
-      parserOptions: {
-        // Use the correct `tsconfig.json` for `pr-checks`.
-        project: "./pr-checks/tsconfig.json",
-      },
-    },
-
-    rules: {
-      // The scripts in `pr-checks` are expected to output to the console.
-      "no-console": "off",
-
-      "import/no-extraneous-dependencies": [
-        "error",
-        { packageDir: [__dirname, path.resolve(__dirname, "pr-checks")] },
-      ],
-
-      "@typescript-eslint/no-floating-promises": [
-        "error",
-        {
-          allowForKnownSafeCalls: [
-            // Avoid needing explicit `void` in front of `describe` calls in test files.
-            { from: "package", name: ["describe"], package: "node:test" },
-          ],
-        },
-      ],
-    },
-  },
 ];
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.3",
-  "cliVersion": "2.25.3",
-  "priorBundleVersion": "codeql-bundle-v2.25.2",
-  "priorCliVersion": "2.25.2"
+  "bundleVersion": "codeql-bundle-v2.24.3",
+  "cliVersion": "2.24.3",
+  "priorBundleVersion": "codeql-bundle-v2.24.2",
+  "priorCliVersion": "2.24.2"
 }
@@ -1,23 +1,28 @@
 {
  "name": "codeql",
-  "version": "4.35.4",
+  "version": "4.32.7",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
    "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-    "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs && npx tsx ./pr-checks/bundle-metadata.ts",
+    "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
    "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
    "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
    "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
    "ava": "npm run transpile && ava --verbose",
    "test": "npm run ava -- src/",
    "test-debug": "npm run test -- --timeout=20m",
-    "transpile": "tsc --build --verbose tsconfig.json"
+    "transpile": "tsc --build --verbose"
+  },
+  "ava": {
+    "typescript": {
+      "rewritePaths": {
+        "src/": "build/"
+      },
+      "compile": false
+    }
  },
  "license": "MIT",
-  "workspaces": [
-    "pr-checks"
-  ],
  "dependencies": {
    "@actions/artifact": "^5.0.3",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
@@ -29,22 +34,23 @@
    "@actions/http-client": "^3.0.0",
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
-    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-retry": "^8.0.0",
+    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
    "fast-deep-equal": "^3.1.3",
-    "follow-redirects": "^1.16.0",
+    "follow-redirects": "^1.15.11",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
    "js-yaml": "^4.1.1",
-    "jsonschema": "1.5.0",
+    "jsonschema": "1.4.1",
    "long": "^5.3.2",
-    "node-forge": "^1.4.0",
+    "node-forge": "^1.3.3",
    "semver": "^7.7.4",
-    "uuid": "^14.0.0"
+    "uuid": "^13.0.0"
  },
  "devDependencies": {
-    "@ava/typescript": "7.0.0",
-    "@eslint/compat": "^2.0.5",
+    "@ava/typescript": "6.0.0",
+    "@eslint/compat": "^2.0.2",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
    "@octokit/types": "^16.0.0",
    "@types/archiver": "^7.0.0",
@@ -54,21 +60,21 @@
    "@types/node-forge": "^1.3.14",
    "@types/sarif": "^2.1.7",
    "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.1",
+    "@types/sinon": "^21.0.0",
    "ava": "^7.0.0",
-    "esbuild": "^0.28.0",
+    "esbuild": "^0.27.3",
    "eslint": "^9.39.2",
-    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-import-resolver-typescript": "^3.8.7",
    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jsdoc": "^62.9.0",
+    "eslint-plugin-import-x": "^4.16.1",
+    "eslint-plugin-jsdoc": "^62.7.1",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^11.1.0",
-    "globals": "^17.5.0",
-    "nock": "^14.0.12",
-    "sinon": "^21.1.2",
-    "typescript": "^6.0.2",
-    "typescript-eslint": "^8.58.2"
+    "globals": "^17.4.0",
+    "nock": "^14.0.11",
+    "sinon": "^21.0.2",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.1"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -90,7 +96,6 @@
      "semver": ">=6.3.1"
    },
    "brace-expansion@2.0.1": "2.0.2",
-    "glob": "^11.1.0",
-    "undici": "^6.24.0"
+    "glob": "^11.1.0"
  }
 }
@@ -1,13 +0,0 @@
-import * as githubUtils from "@actions/github/lib/utils";
-import { type Octokit } from "@octokit/core";
-import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
-import { type Api } from "@octokit/plugin-rest-endpoint-methods";
-
-/** The type of the Octokit client. */
-export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
-
-/** Constructs an `ApiClient` using `token` for authentication. */
-export function getApiClient(token: string): ApiClient {
-  const opts = githubUtils.getOctokitOptions(token);
-  return new githubUtils.GitHub(opts);
-}
@@ -1,48 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs/promises";
-
-import { BUNDLE_METADATA_FILE } from "./config";
-
-interface InputInfo {
-  bytesInOutput: number;
-}
-
-type Inputs = Record<string, InputInfo>;
-
-interface Output {
-  bytes: number;
-  inputs: Inputs;
-}
-
-interface Metadata {
-  outputs: Record<string, Output>;
-}
-
-function toMB(bytes: number): string {
-  return `${(bytes / (1024 * 1024)).toFixed(2)}MB`;
-}
-
-async function main() {
-  const fileContents = await fs.readFile(BUNDLE_METADATA_FILE);
-  const metadata = JSON.parse(String(fileContents)) as Metadata;
-
-  for (const [outputFile, outputData] of Object.entries(
-    metadata.outputs,
-  ).reverse()) {
-    console.info(`${outputFile}: ${toMB(outputData.bytes)}`);
-
-    for (const [inputName, inputData] of Object.entries(outputData.inputs)) {
-      // Ignore any inputs that make up less than 5% of the output.
-      const percentage = (inputData.bytesInOutput / outputData.bytes) * 100.0;
-      if (percentage < 5.0) continue;
-
-      console.info(`  ${inputName}: ${toMB(inputData.bytesInOutput)}`);
-    }
-  }
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -5,12 +5,12 @@ versions:
 steps:
  - uses: ./../action/init
    with:
-      languages: C#,java-kotlin,typescript
+      languages: C#,java-kotlin,swift,typescript
      tools: ${{ steps.prepare-test.outputs.tools-url }}

  - name: "Check languages"
    run: |
-      expected_languages="csharp,java,javascript"
+      expected_languages="csharp,java,swift,javascript"
      actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

      if [ "$expected_languages" != "$actual_languages" ]; then
@@ -0,0 +1,33 @@
+name: Risk Assessment analysis failure uploads SARIF artifact
+description: Check that a SARIF file is uploaded as artifact if Risk Assessment fails
+versions: ["default"]
+
+permissions:
+  contents: read
+  security-events: write # needed to upload the SARIF file
+
+steps:
+  - name: Initialise CodeQL
+    uses: ./../action/init
+    id: init
+    with:
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      languages: javascript
+      analysis-kinds: risk-assessment
+
+  - name: Fail
+    run: exit 1
+
+validationJobs:
+  artifact-present:
+    name: Check artifact
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          pattern: sarif-artifact-*
+          path: ${{ runner.temp }}/results
+          merge-multiple: true
+      - name: List contents
+        run: |
+          ls -lr
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@0cb964fd540e0a24c900370abf38a33466142735 # v1.305.0
+    uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -16,17 +16,7 @@ steps:
    id: proxy
    uses: ./../action/start-proxy
    with:
-      registry_secrets: |
-        [
-          {
-            "type": "maven_repository",
-            "url": "https://repo.maven.apache.org/maven2/"
-          },
-          {
-            "type": "maven_repository",
-            "url": "https://repo1.maven.org/maven2"
-          }
-        ]
+      registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

  - name: Print proxy outputs
    run: |
@@ -37,10 +27,3 @@ steps:
  - name: Fail if proxy outputs are not set
    if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
    run: exit 1
-
-  - name: Fail if proxy_urls does not contain all registries
-    if: |
-      join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-    run: exit 1
@@ -1,23 +0,0 @@
-import path from "path";
-
-/** The oldest supported major version of the CodeQL Action. */
-export const OLDEST_SUPPORTED_MAJOR_VERSION = 3;
-
-/** The `pr-checks` directory. */
-export const PR_CHECKS_DIR = __dirname;
-
-/** The path of the file configuring which checks shouldn't be required. */
-export const PR_CHECK_EXCLUDED_FILE = path.join(PR_CHECKS_DIR, "excluded.yml");
-
-/** The path to the esbuild metadata file. */
-export const BUNDLE_METADATA_FILE = path.join(PR_CHECKS_DIR, "..", "meta.json");
-
-/** The `src` directory. */
-const SOURCE_ROOT = path.join(PR_CHECKS_DIR, "..", "src");
-
-/** The path to the built-in languages file. */
-export const BUILTIN_LANGUAGES_FILE = path.join(
-  SOURCE_ROOT,
-  "languages",
-  "builtin.json",
-);
@@ -1,16 +0,0 @@
-# PR checks to exclude from required checks
-contains:
-  - "https://"
-  - "Update"
-  - "ESLint"
-  - "update"
-  - "test-setup-python-scripts"
-is:
-  - "CodeQL"
-  - "Dependabot"
-  - "check-expected-release-files"
-  - "Agent"
-  - "Cleanup artifacts"
-  - "Prepare"
-  - "Upload results"
-  - "Label PR with size"
@@ -0,0 +1,605 @@
+{
+  "name": "pr-checks",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "yaml": "^2.8.2"
+      },
+      "devDependencies": {
+        "@types/node": "^20.19.9",
+        "tsx": "^4.21.0",
+        "typescript": "^5.9.3"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
+      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
+      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
+      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
+      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
+      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
+      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
+      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
+      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
+      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
+      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
+      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
+      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
+      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
+      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
+      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
+      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
+      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
+      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
+      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
+      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
+      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.19.35",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.35.tgz",
+      "integrity": "sha512-Uarfe6J91b9HAUXxjvSOdiO2UPOKLm07Q1oh0JHxoZ1y8HoqxDAu3gVrsrOHeiio0kSsoVBt4wFrKOm0dKxVPQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
+      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.3",
+        "@esbuild/android-arm": "0.27.3",
+        "@esbuild/android-arm64": "0.27.3",
+        "@esbuild/android-x64": "0.27.3",
+        "@esbuild/darwin-arm64": "0.27.3",
+        "@esbuild/darwin-x64": "0.27.3",
+        "@esbuild/freebsd-arm64": "0.27.3",
+        "@esbuild/freebsd-x64": "0.27.3",
+        "@esbuild/linux-arm": "0.27.3",
+        "@esbuild/linux-arm64": "0.27.3",
+        "@esbuild/linux-ia32": "0.27.3",
+        "@esbuild/linux-loong64": "0.27.3",
+        "@esbuild/linux-mips64el": "0.27.3",
+        "@esbuild/linux-ppc64": "0.27.3",
+        "@esbuild/linux-riscv64": "0.27.3",
+        "@esbuild/linux-s390x": "0.27.3",
+        "@esbuild/linux-x64": "0.27.3",
+        "@esbuild/netbsd-arm64": "0.27.3",
+        "@esbuild/netbsd-x64": "0.27.3",
+        "@esbuild/openbsd-arm64": "0.27.3",
+        "@esbuild/openbsd-x64": "0.27.3",
+        "@esbuild/openharmony-arm64": "0.27.3",
+        "@esbuild/sunos-x64": "0.27.3",
+        "@esbuild/win32-arm64": "0.27.3",
+        "@esbuild/win32-ia32": "0.27.3",
+        "@esbuild/win32-x64": "0.27.3"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/get-tsconfig": {
+      "version": "4.13.6",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.13.6.tgz",
+      "integrity": "sha512-shZT/QMiSHc/YBLxxOkMtgSid5HFoauqCE3/exfsEcwg1WkeqjG+V40yBbBrsD+jW2HDXcs28xOfcbm2jI8Ddw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
+    "node_modules/resolve-pkg-maps": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
+      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
+      }
+    },
+    "node_modules/tsx": {
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.21.0.tgz",
+      "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.27.0",
+        "get-tsconfig": "^4.7.5"
+      },
+      "bin": {
+        "tsx": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/yaml": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
+      "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    }
+  }
+}
@@ -2,15 +2,11 @@
  "private": true,
  "description": "Dependencies for the sync.ts",
  "dependencies": {
-    "@actions/core": "^2.0.3",
-    "@actions/github": "^8.0.1",
-    "@octokit/core": "^7.0.6",
-    "@octokit/plugin-paginate-rest": ">=9.2.2",
-    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
-    "yaml": "^2.8.3"
+    "yaml": "^2.8.2"
  },
  "devDependencies": {
    "@types/node": "^20.19.9",
-    "tsx": "^4.21.0"
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3"
  }
 }
@@ -1,61 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Tests for the release-branches.ts script
-*/
-
-import * as assert from "node:assert/strict";
-import { describe, it } from "node:test";
-
-import { computeBackportBranches } from "./release-branches";
-
-describe("computeBackportBranches", async () => {
-  await it("rejects invalid major versions", () => {
-    // The majorVersion is expected to be in vN format.
-    assert.throws(() => computeBackportBranches("3", "v4.28.0", 3));
-    assert.throws(() => computeBackportBranches("v3.1", "v4.28.0", 3));
-  });
-
-  await it("rejects invalid latest tags", () => {
-    // The latestTag is expected to be in vN.M.P format.
-    assert.throws(() => computeBackportBranches("v3", "v4", 3));
-    assert.throws(() => computeBackportBranches("v3", "4", 3));
-    assert.throws(() => computeBackportBranches("v3", "v4.28", 3));
-    assert.throws(() => computeBackportBranches("v3", "4.28", 3));
-    assert.throws(() => computeBackportBranches("v3", "4.28.0", 3));
-  });
-
-  await it("sets backport source branch based on major version", () => {
-    // Test that the backport source branch is releases/v{majorVersion}
-    const result = computeBackportBranches("v3", "v4.28.0", 3);
-    assert.equal(result.backportSourceBranch, "releases/v3");
-  });
-
-  await it("no backport targets when major version is the oldest supported", () => {
-    // When majorVersion equals the major version of latestTag and we do not support older major versions,
-    // then there are no older supported branches to backport to.
-    const result = computeBackportBranches("v3", "v3.28.0", 3);
-    assert.deepEqual(result.backportTargetBranches, []);
-  });
-
-  await it("backports to older supported major versions", () => {
-    const result = computeBackportBranches("v4", "v4.1.0", 3);
-    assert.equal(result.backportSourceBranch, "releases/v4");
-    assert.deepEqual(result.backportTargetBranches, ["releases/v3"]);
-  });
-
-  await it("backports to multiple older supported branches", () => {
-    const result = computeBackportBranches("v5", "v5.0.0", 3);
-    assert.equal(result.backportSourceBranch, "releases/v5");
-    assert.deepEqual(result.backportTargetBranches, [
-      "releases/v4",
-      "releases/v3",
-    ]);
-  });
-
-  await it("does not backport when major version is older than latest tag", () => {
-    const result = computeBackportBranches("v2", "v3.28.0", 2);
-    assert.equal(result.backportSourceBranch, "releases/v2");
-    assert.deepEqual(result.backportTargetBranches, []);
-  });
-});
@@ -1,121 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import { parseArgs } from "node:util";
-
-import * as core from "@actions/core";
-
-import { OLDEST_SUPPORTED_MAJOR_VERSION } from "./config";
-
-/** The results of checking which release branches to backport to.  */
-export interface BackportInfo {
-  /** The source release branch. */
-  backportSourceBranch: string;
-  /**
-   * The computed release branches we should backport to.
-   * Will be empty if there are no branches we need to backport to.
-   */
-  backportTargetBranches: string[];
-}
-
-/**
- * Compute the backport source and target branches for a release.
- *
- * @param majorVersion - The major version string (e.g. "v4").
- * @param latestTag - The most recent tag published to the repository (e.g. "v4.32.6").
- * @param oldestSupportedMajorVersion - The oldest supported major version number.
- * @returns The names of the source branch and target branches.
- */
-export function computeBackportBranches(
-  majorVersion: string,
-  latestTag: string,
-  oldestSupportedMajorVersion: number,
-): BackportInfo {
-  // Perform some sanity checks on the inputs.
-  // For `majorVersion`, we expect exactly `vN` for some `N`.
-  const majorVersionMatch = majorVersion.match(/^v(\d+)$/);
-  if (!majorVersionMatch) {
-    throw new Error("--major-version value must be in `vN` format.");
-  }
-
-  // For latestTag, we expect something starting with `vN.M.P`
-  const latestTagMatch = latestTag.match(/^v(\d+)\.\d+\.\d+/);
-  if (!latestTagMatch) {
-    throw new Error(
-      `--latest-tag value must be in 'vN.M.P' format, but '${latestTag}' is not.`,
-    );
-  }
-
-  const majorVersionNumber = Number.parseInt(majorVersionMatch[1]);
-  const latestTagMajor = Number.parseInt(latestTagMatch[1]);
-
-  // If this is a primary release, we backport to all supported branches,
-  // so we check whether the majorVersion taken from the package.json
-  // is greater than or equal to the latest tag pulled from the repo.
-  // For example...
-  //     'v1' >= 'v2' is False # we're operating from an older release branch and should not backport
-  //     'v2' >= 'v2' is True  # the normal case where we're updating the current version
-  //     'v3' >= 'v2' is True  # in this case we are making the first release of a new major version
-  const considerBackports = majorVersionNumber >= latestTagMajor;
-
-  const backportSourceBranch = `releases/v${majorVersionNumber}`;
-  const backportTargetBranches: string[] = [];
-
-  if (considerBackports) {
-    for (let i = majorVersionNumber - 1; i > 0; i--) {
-      const branchName = `releases/v${i}`;
-      if (i >= oldestSupportedMajorVersion) {
-        backportTargetBranches.push(branchName);
-      }
-    }
-  }
-
-  return { backportSourceBranch, backportTargetBranches };
-}
-
-async function main() {
-  const { values: options } = parseArgs({
-    options: {
-      // The major version of the release in `vN` format (e.g. `v4`).
-      "major-version": {
-        type: "string",
-      },
-      // The most recent tag published to the repository (e.g. `v4.28.0`).
-      "latest-tag": {
-        type: "string",
-      },
-    },
-    strict: true,
-  });
-
-  if (options["major-version"] === undefined) {
-    throw Error("--major-version is required");
-  }
-  if (options["latest-tag"] === undefined) {
-    throw Error("--latest-tag is required");
-  }
-
-  const majorVersion = options["major-version"];
-  const latestTag = options["latest-tag"];
-
-  console.log(`Major version: ${majorVersion}`);
-  console.log(`Latest tag: ${latestTag}`);
-
-  const result = computeBackportBranches(
-    majorVersion,
-    latestTag,
-    OLDEST_SUPPORTED_MAJOR_VERSION,
-  );
-
-  core.setOutput("backport_source_branch", result.backportSourceBranch);
-  core.setOutput(
-    "backport_target_branches",
-    JSON.stringify(result.backportTargetBranches),
-  );
-
-  process.exit(0);
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -1,60 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Tests for the sync-checks.ts script
-*/
-
-import * as assert from "node:assert/strict";
-import { describe, it } from "node:test";
-
-import { CheckInfo, Exclusions, Options, removeExcluded } from "./sync-checks";
-
-const defaultOptions: Options = {
-  apply: false,
-  verbose: false,
-};
-
-const toCheckInfo = (name: string) =>
-  ({ context: name, app_id: -1 }) satisfies CheckInfo;
-
-const expectedPartialMatches = ["PR Check - Foo", "https://example.com"].map(
-  toCheckInfo,
-);
-
-const expectedExactMatches = ["CodeQL", "Update"].map(toCheckInfo);
-
-const testChecks = expectedExactMatches.concat(expectedPartialMatches);
-
-const emptyExclusions: Exclusions = {
-  is: [],
-  contains: [],
-};
-
-describe("removeExcluded", async () => {
-  await it("retains all checks if no exclusions are configured", () => {
-    const retained = removeExcluded(
-      defaultOptions,
-      emptyExclusions,
-      testChecks,
-    );
-    assert.deepEqual(retained, testChecks);
-  });
-
-  await it("removes exact matches", () => {
-    const retained = removeExcluded(
-      defaultOptions,
-      { ...emptyExclusions, is: ["CodeQL", "Update"] },
-      testChecks,
-    );
-    assert.deepEqual(retained, expectedPartialMatches);
-  });
-
-  await it("removes partial matches", () => {
-    const retained = removeExcluded(
-      defaultOptions,
-      { ...emptyExclusions, contains: ["https://", "PR Check"] },
-      testChecks,
-    );
-    assert.deepEqual(retained, expectedExactMatches);
-  });
-});
@@ -1,287 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/** Update the required checks based on the current branch. */
-
-import * as fs from "fs";
-import { parseArgs } from "node:util";
-
-import * as yaml from "yaml";
-
-import { type ApiClient, getApiClient } from "./api-client";
-import {
-  OLDEST_SUPPORTED_MAJOR_VERSION,
-  PR_CHECK_EXCLUDED_FILE,
-} from "./config";
-
-/** Represents the command-line options. */
-export interface Options {
-  /** The token to use to authenticate to the GitHub API. */
-  token?: string;
-  /** The git ref to use the checks for. */
-  ref?: string;
-  /** Whether to actually apply the changes or not. */
-  apply: boolean;
-  /** Whether to output additional information. */
-  verbose: boolean;
-}
-
-/** Identifies the CodeQL Action repository. */
-const codeqlActionRepo = {
-  owner: "github",
-  repo: "codeql-action",
-};
-
-/** Represents a configuration of which checks should not be set up as required checks. */
-export interface Exclusions {
-  /** A list of strings that, if contained in a check name, are excluded. */
-  contains: string[];
-  /** A list of check names that are excluded if their name is an exact match. */
-  is: string[];
-}
-
-/** Loads the configuration for which checks to exclude. */
-function loadExclusions(): Exclusions {
-  return yaml.parse(
-    fs.readFileSync(PR_CHECK_EXCLUDED_FILE, "utf-8"),
-  ) as Exclusions;
-}
-
-/**
- * Represents information about a check run. We track the `app_id` that generated the check,
- * because the API will require it in addition to the name in the future.
- */
-export interface CheckInfo {
-  /** The display name of the check. */
-  context: string;
-  /** The ID of the app that generated the check. */
-  app_id: number;
-}
-
-/** Removes entries from `checkInfos` based on the configuration. */
-export function removeExcluded(
-  options: Options,
-  exclusions: Exclusions,
-  checkInfos: CheckInfo[],
-): CheckInfo[] {
-  if (options.verbose) {
-    console.log(exclusions);
-  }
-
-  return checkInfos.filter((checkInfo) => {
-    if (exclusions.is.includes(checkInfo.context)) {
-      console.info(
-        `Excluding '${checkInfo.context}' because it is an exact exclusion.`,
-      );
-      return false;
-    }
-
-    for (const containsStr of exclusions.contains) {
-      if (checkInfo.context.includes(containsStr)) {
-        console.info(
-          `Excluding '${checkInfo.context}' because it contains '${containsStr}'.`,
-        );
-        return false;
-      }
-    }
-
-    // Keep.
-    return true;
-  });
-}
-
-/** Gets a list of check run names for `ref`. */
-async function getChecksFor(
-  options: Options,
-  client: ApiClient,
-  ref: string,
-): Promise<CheckInfo[]> {
-  console.info(`Getting checks for '${ref}'`);
-
-  const response = await client.paginate(
-    "GET /repos/{owner}/{repo}/commits/{ref}/check-runs",
-    {
-      ...codeqlActionRepo,
-      ref,
-    },
-  );
-
-  if (response.length === 0) {
-    throw new Error(`No checks found for '${ref}'.`);
-  }
-
-  console.info(`Retrieved ${response.length} check runs.`);
-
-  const notSkipped = response.filter(
-    (checkRun) => checkRun.conclusion !== "skipped",
-  );
-  console.info(`Of those: ${notSkipped.length} were not skipped.`);
-
-  // We use the ID of the app that generated the check run when returned by the API,
-  // but default to -1 to tell the API that any check with the given name should be
-  // required.
-  const checkInfos = notSkipped.map((check) => ({
-    context: check.name,
-    app_id: check.app?.id || -1,
-  }));
-
-  // Load the configuration for which checks to exclude and apply it before
-  // returning the checks.
-  const exclusions = loadExclusions();
-  return removeExcluded(options, exclusions, checkInfos);
-}
-
-/** Gets the current list of release branches. */
-async function getReleaseBranches(client: ApiClient): Promise<string[]> {
-  const refs = await client.rest.git.listMatchingRefs({
-    ...codeqlActionRepo,
-    ref: "heads/releases/v",
-  });
-  return refs.data.map((ref) => ref.ref).sort();
-}
-
-/** Updates the required status checks for `branch` to `checks`. */
-async function patchBranchProtectionRule(
-  client: ApiClient,
-  branch: string,
-  checks: Set<string>,
-) {
-  await client.rest.repos.setStatusCheckContexts({
-    ...codeqlActionRepo,
-    branch,
-    contexts: Array.from(checks),
-  });
-}
-
-/** Sets `checkNames` as required checks for `branch`. */
-async function updateBranch(
-  options: Options,
-  client: ApiClient,
-  branch: string,
-  checkNames: Set<string>,
-) {
-  console.info(`Updating '${branch}'...`);
-
-  // Query the current set of required checks for this branch.
-  const currentContexts = await client.rest.repos.getAllStatusCheckContexts({
-    ...codeqlActionRepo,
-    branch,
-  });
-
-  // Identify which required checks we will remove and which ones we will add.
-  const currentCheckNames = new Set(currentContexts.data);
-  let additions = 0;
-  let removals = 0;
-  let unchanged = 0;
-
-  for (const currentCheck of currentCheckNames) {
-    if (!checkNames.has(currentCheck)) {
-      console.info(`- Removing '${currentCheck}' for branch '${branch}'`);
-      removals++;
-    } else {
-      unchanged++;
-    }
-  }
-  for (const newCheck of checkNames) {
-    if (!currentCheckNames.has(newCheck)) {
-      console.info(`+ Adding '${newCheck}' for branch '${branch}'`);
-      additions++;
-    }
-  }
-
-  console.info(
-    `For '${branch}': ${removals} removals; ${additions} additions; ${unchanged} unchanged`,
-  );
-
-  // Perform the update if there are changes and `--apply` was specified.
-  if (unchanged === checkNames.size && removals === 0 && additions === 0) {
-    console.info("Not applying changes because there is nothing to do.");
-  } else if (options.apply) {
-    await patchBranchProtectionRule(client, branch, checkNames);
-  } else {
-    console.info("Not applying changes because `--apply` was not specified.");
-  }
-}
-
-async function main(): Promise<void> {
-  const { values: options } = parseArgs({
-    options: {
-      // The token to use to authenticate to the API.
-      token: {
-        type: "string",
-      },
-      // The git ref for which to retrieve the check runs.
-      ref: {
-        type: "string",
-        default: "main",
-      },
-      // By default, we perform a dry-run. Setting `apply` to `true` actually applies the changes.
-      apply: {
-        type: "boolean",
-        default: false,
-      },
-      // Whether to output additional information.
-      verbose: {
-        type: "boolean",
-        default: false,
-      },
-    },
-    strict: true,
-  });
-
-  if (options.token === undefined) {
-    throw new Error("Missing --token");
-  }
-
-  console.info(
-    `Oldest supported major version is: ${OLDEST_SUPPORTED_MAJOR_VERSION}`,
-  );
-
-  // Initialise the API client.
-  const client = getApiClient(options.token);
-
-  // Find the check runs for the specified `ref` that we will later set as the required checks
-  // for the main and release branches.
-  const checkInfos = await getChecksFor(options, client, options.ref);
-  const checkNames = new Set(checkInfos.map((info) => info.context));
-
-  // Update the main branch.
-  await updateBranch(options, client, "main", checkNames);
-
-  // Retrieve the refs of the release branches.
-  const releaseBranches = await getReleaseBranches(client);
-  console.info(
-    `Found ${releaseBranches.length} release branches: ${releaseBranches.join(", ")}`,
-  );
-
-  for (const releaseBranchRef of releaseBranches) {
-    // Sanity check that the ref name is in the expected format and extract the major version.
-    const releaseBranchMatch = releaseBranchRef.match(
-      /^refs\/heads\/(releases\/v(\d+))/,
-    );
-    if (!releaseBranchMatch) {
-      console.warn(
-        `Branch ref '${releaseBranchRef}' not in the expected format.`,
-      );
-      continue;
-    }
-    const releaseBranch = releaseBranchMatch[1];
-    const releaseBranchMajor = Number.parseInt(releaseBranchMatch[2]);
-
-    // Update the required checks for this major version if it is still supported.
-    if (releaseBranchMajor < OLDEST_SUPPORTED_MAJOR_VERSION) {
-      console.info(
-        `Skipping '${releaseBranch}' since it is older than v${OLDEST_SUPPORTED_MAJOR_VERSION}`,
-      );
-      continue;
-    } else {
-      await updateBranch(options, client, releaseBranch, checkNames);
-    }
-  }
-
-  process.exit(0);
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -5,7 +5,7 @@ import * as path from "path";

 import * as yaml from "yaml";

-import { BuiltInLanguage } from "../src/languages";
+import { KnownLanguage } from "../src/languages";

 /** Known workflow input names. */
 enum KnownInputName {
@@ -57,12 +57,6 @@ interface Specification extends JobSpecification {
  collection?: string;
 }

-/** Minimal type to represent steps in Actions workflows. */
-interface Step {
-  name?: string;
-  [other: string]: any;
-}
-
 /** Represents job specifications. */
 interface JobSpecification {
  /** The display name for the check. */
@@ -73,7 +67,7 @@ interface JobSpecification {
  env?: Record<string, any>;

  /** The workflow steps specific to this check. */
-  steps: Step[];
+  steps: any[];

  installNode?: boolean;
  installGo?: boolean;
@@ -88,11 +82,11 @@ interface LanguageSetup {
  specProperty: keyof JobSpecification;
  /** The names of the known inputs which are required for this setup step. */
  inputs?: KnownInputName[];
-  steps: Step[];
+  steps: any[];
 }

-/** Describes partial mappings from built-in languages to their specific setup information. */
-type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
+/** Describes partial mappings from known languages to their specific setup information. */
+type LanguageSetups = Partial<Record<KnownLanguage, LanguageSetup>>;

 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
@@ -125,7 +119,7 @@ const defaultLanguageVersions = {
  java: "17",
  python: "3.13",
  csharp: "9.x",
-} as const satisfies Partial<Record<BuiltInLanguage, string>>;
+} as const satisfies Partial<Record<KnownLanguage, string>>;

 /** A mapping from known input names to their specifications. */
 const inputSpecs: WorkflowInputs = {
@@ -194,7 +188,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Go",
        uses: "actions/setup-go@v6",
        with: {
-          "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`,
+          "go-version":
+            "${{ inputs.go-version || '" + defaultLanguageVersions.go + "' }}",
          // to avoid potentially misleading autobuilder results where we expect it to download
          // dependencies successfully, but they actually come from a warm cache
          cache: false,
@@ -210,7 +205,10 @@ const languageSetups: LanguageSetups = {
        name: "Install Java",
        uses: "actions/setup-java@v5",
        with: {
-          "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
+          "java-version":
+            "${{ inputs.java-version || '" +
+            defaultLanguageVersions.java +
+            "' }}",
          distribution: "temurin",
        },
      },
@@ -224,7 +222,10 @@ const languageSetups: LanguageSetups = {
        name: "Install Python",
        uses: "actions/setup-python@v6",
        with: {
-          "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`,
+          "python-version":
+            "${{ inputs.python-version || '" +
+            defaultLanguageVersions.python +
+            "' }}",
        },
      },
    ],
@@ -237,7 +238,10 @@ const languageSetups: LanguageSetups = {
        name: "Install .NET",
        uses: "actions/setup-dotnet@v5",
        with: {
-          "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`,
+          "dotnet-version":
+            "${{ inputs.dotnet-version || '" +
+            defaultLanguageVersions.csharp +
+            "' }}",
        },
      },
    ],
@@ -359,12 +363,12 @@ function generateJobMatrix(
 */
 function getSetupSteps(checkSpecification: JobSpecification): {
  inputs: Set<KnownInputName>;
-  steps: Step[];
+  steps: any[];
 } {
  const inputs: Array<Set<KnownInputName>> = [];
-  const steps: Step[] = [];
+  const steps: any[] = [];

-  for (const language of Object.values(BuiltInLanguage).sort()) {
+  for (const language of Object.values(KnownLanguage).sort()) {
    const setupSpec = languageSetups[language];

    if (
@@ -422,7 +426,7 @@ function generateJob(
  const workflowInputs = setupInfo.inputs;

  // Construct the workflow steps needed for this check.
-  const steps: Step[] = [
+  const steps: any[] = [
    {
      name: "Check out repository",
      uses: "actions/checkout@v6",
@@ -643,7 +647,7 @@ function main(): void {

    let extraGroupName = "";
    for (const inputName of Object.keys(combinedInputs)) {
-      extraGroupName += `-\${{inputs.${inputName}}}`;
+      extraGroupName += "-${{inputs." + inputName + "}}";
    }

    const cron = new yaml.Scalar("0 5 * * *");
@@ -681,7 +685,7 @@ function main(): void {
      concurrency: {
        "cancel-in-progress":
          "${{ github.event_name == 'pull_request' || false }}",
-        group: `${checkName}-\${{github.ref}}${extraGroupName}`,
+        group: checkName + "-${{github.ref}}" + extraGroupName,
      },
      jobs: {
        [checkName]: checkJob,
@@ -705,7 +709,7 @@ function main(): void {
      combinedInputs = { ...combinedInputs, ...checkInputs };

      for (const inputName of Object.keys(checkInputs)) {
-        checkWith[inputName] = `\${{ inputs.${inputName} }}`;
+        checkWith[inputName] = "${{ inputs." + inputName + " }}";
      }

      jobs[checkName] = {
@@ -1,7 +1,7 @@
 #!/usr/bin/env npx tsx

 /*
-Tests for the sync-back.ts script
+Tests for the sync_back.ts script
 */

 import * as assert from "node:assert/strict";
@@ -14,7 +14,7 @@ import {
  scanGeneratedWorkflows,
  updateSyncTs,
  updateTemplateFiles,
-} from "./sync-back";
+} from "./sync_back";

 let testDir: string;
 let workflowDir: string;
@@ -38,8 +38,8 @@ afterEach(() => {
  fs.rmSync(testDir, { recursive: true, force: true });
 });

-describe("scanGeneratedWorkflows", async () => {
-  await it("basic workflow scanning", () => {
+describe("scanGeneratedWorkflows", () => {
+  it("basic workflow scanning", () => {
    /** Test basic workflow scanning functionality */
    const workflowContent = `
 name: Test Workflow
@@ -61,7 +61,7 @@ jobs:
    assert.equal(result["actions/setup-go"], "v6");
  });

-  await it("scanning workflows with version comments", () => {
+  it("scanning workflows with version comments", () => {
    /** Test scanning workflows with version comments */
    const workflowContent = `
 name: Test Workflow
@@ -86,7 +86,7 @@ jobs:
    assert.equal(result["actions/setup-python"], "v6 # Latest Python");
  });

-  await it("ignores local actions", () => {
+  it("ignores local actions", () => {
    /** Test that local actions (starting with ./) are ignored */
    const workflowContent = `
 name: Test Workflow
@@ -109,8 +109,8 @@ jobs:
  });
 });

-describe("updateSyncTs", async () => {
-  await it("updates sync.ts file", () => {
+describe("updateSyncTs", () => {
+  it("updates sync.ts file", () => {
    /** Test updating sync.ts file */
    const syncTsContent = `
 const steps = [
@@ -141,7 +141,7 @@ const steps = [
    assert.ok(updatedContent.includes('uses: "actions/setup-go@v6"'));
  });

-  await it("strips comments from versions", () => {
+  it("strips comments from versions", () => {
    /** Test updating sync.ts file when versions have comments */
    const syncTsContent = `
 const steps = [
@@ -168,7 +168,7 @@ const steps = [
    assert.ok(!updatedContent.includes("# Latest version"));
  });

-  await it("returns false when no changes are needed", () => {
+  it("returns false when no changes are needed", () => {
    /** Test that updateSyncTs returns false when no changes are needed */
    const syncTsContent = `
 const steps = [
@@ -190,8 +190,8 @@ const steps = [
  });
 });

-describe("updateTemplateFiles", async () => {
-  await it("updates template files", () => {
+describe("updateTemplateFiles", () => {
+  it("updates template files", () => {
    /** Test updating template files */
    const templateContent = `
 name: Test Template
@@ -220,7 +220,7 @@ steps:
    assert.ok(updatedContent.includes("uses: actions/setup-node@v5 # Latest"));
  });

-  await it("preserves version comments", () => {
+  it("preserves version comments", () => {
    /** Test that updating template files preserves version comments */
    const templateContent = `
 name: Test Template
@@ -232,7 +232,8 @@ steps:
    fs.writeFileSync(templatePath, templateContent);

    const actionVersions = {
-      "ruby/setup-ruby": "55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
+      "ruby/setup-ruby":
+        "55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
    };

    const result = updateTemplateFiles(checksDir, actionVersions);
@@ -17,8 +17,9 @@ those changes are properly synced back to the source templates. Regular workflow
 files are updated directly by Dependabot and don't need sync-back.
 */

-import * as fs from "fs";
 import { parseArgs } from "node:util";
+
+import * as fs from "fs";
 import * as path from "path";

 const THIS_DIR = __dirname;
@@ -32,9 +33,7 @@ const SYNC_TS_PATH = path.join(THIS_DIR, "sync.ts");
 * @param workflowDir - Path to .github/workflows directory
 * @returns Map from action names to their latest versions (including comments)
 */
-export function scanGeneratedWorkflows(
-  workflowDir: string,
-): Record<string, string> {
+export function scanGeneratedWorkflows(workflowDir: string): Record<string, string> {
  const actionVersions: Record<string, string> = {};

  const generatedFiles = fs
@@ -97,7 +96,10 @@ export function updateSyncTs(
    // variable - that's a risk we're happy to take since in that case the
    // PR checks will just fail.
    const escaped = actionName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const pattern = new RegExp(`(uses:\\s*")${escaped}@(?:[^"]+)(")`, "g");
+    const pattern = new RegExp(
+      `(uses:\\s*")${escaped}@(?:[^"]+)(")`,
+      "g",
+    );
    content = content.replace(pattern, `$1${actionName}@${version}$2`);
  }

@@ -139,7 +141,10 @@ export function updateTemplateFiles(
    )) {
      // Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment'
      const escaped = actionName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const pattern = new RegExp(`(uses:\\s+${escaped})@(?:[^@\n]+)`, "g");
+      const pattern = new RegExp(
+        `(uses:\\s+${escaped})@(?:[^@\n]+)`,
+        "g",
+      );
      content = content.replace(pattern, `$1@${versionWithComment}`);
    }

@@ -3,7 +3,6 @@
  "compilerOptions": {
    /* Basic Options */
    "lib": ["esnext"],
-    "module": "preserve",
    "rootDir": "..",
    "sourceMap": false,
    "noEmit": true,
@@ -1,131 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
- * Updates src/languages/builtin.json by querying the CodeQL CLI for:
- * - Languages that have default queries (via codeql-extractor.yml)
- * - Language aliases (via `codeql resolve languages --format=betterjson --extractor-include-aliases`)
- *
- * Usage:
- *   npx tsx pr-checks/update-builtin-languages.ts [path-to-codeql]
- *
- * If no path is given, falls back to "codeql".
- */
-
-import { execFileSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import * as yaml from "yaml";
-
-import { EnvVar } from "../src/environment";
-
-import { BUILTIN_LANGUAGES_FILE } from "./config";
-
-/** Resolve all known language extractor directories. */
-function resolveLanguages(codeqlPath: string): Record<string, string[]> {
-  return JSON.parse(
-    execFileSync(codeqlPath, ["resolve", "languages", "--format=json"], {
-      encoding: "utf8",
-      env: {
-        ...process.env,
-        [EnvVar.EXPERIMENTAL_FEATURES]: "true", // include experimental languages
-      },
-    }),
-  ) as Record<string, string[]>;
-}
-
-/**
- * Return the sorted list of languages whose extractors ship default queries.
- *
- * @param extractorDirs - Map from language to list of extractor directories
- */
-function findLanguagesWithDefaultQueries(
-  extractorDirs: Record<string, string[]>,
-): string[] {
-  const languages: string[] = [];
-
-  for (const [language, dirs] of Object.entries(extractorDirs)) {
-    if (dirs.length !== 1) {
-      throw new Error(
-        `Expected exactly one extractor directory for language '${language}', but found ${dirs.length}: ${dirs.join(
-          ", ",
-        )}`,
-      );
-    }
-
-    const extractorYmlPath = path.join(dirs[0], "codeql-extractor.yml");
-
-    if (!fs.existsSync(extractorYmlPath)) {
-      throw new Error(
-        `Extractor YAML not found for language '${language}' at expected path: ${extractorYmlPath}`,
-      );
-    }
-
-    const extractorYml = yaml.parse(fs.readFileSync(extractorYmlPath, "utf8"));
-    const defaultQueries: unknown[] | undefined = extractorYml.default_queries;
-
-    if (Array.isArray(defaultQueries) && defaultQueries.length > 0) {
-      console.log(
-        `  ✅ ${language}: included (default queries: ${JSON.stringify(defaultQueries)})`,
-      );
-      languages.push(language);
-    } else {
-      console.log(`  ❌ ${language}: excluded (no default queries)`);
-    }
-  }
-
-  return languages.sort();
-}
-
-/**
- * Resolve language aliases from the CodeQL CLI, keeping only those whose
- * target is in the given set of included languages.
- */
-function resolveAliases(
-  codeqlPath: string,
-  includedLanguages: Set<string>,
-): Record<string, string> {
-  const betterjsonOutput = JSON.parse(
-    execFileSync(
-      codeqlPath,
-      [
-        "resolve",
-        "languages",
-        "--format=betterjson",
-        "--extractor-include-aliases",
-      ],
-      { encoding: "utf8" },
-    ),
-  );
-
-  return Object.fromEntries(
-    Object.entries((betterjsonOutput.aliases ?? {}) as Record<string, string>)
-      .filter(([, target]) => includedLanguages.has(target))
-      .sort(([a], [b]) => a.localeCompare(b)),
-  );
-}
-
-/** Write the built-in languages data to disk. */
-function writeBuiltinLanguages(
-  languages: string[],
-  aliases: Record<string, string>,
-): void {
-  const content = `${JSON.stringify({ languages, aliases }, null, 2)}\n`;
-  fs.mkdirSync(path.dirname(BUILTIN_LANGUAGES_FILE), { recursive: true });
-  fs.writeFileSync(BUILTIN_LANGUAGES_FILE, content);
-
-  console.log(`\nWrote ${BUILTIN_LANGUAGES_FILE}`);
-  console.log(`  Languages: ${languages.join(", ")}`);
-  console.log(`  Aliases: ${Object.keys(aliases).join(", ")}`);
-}
-
-function main(): void {
-  const codeqlPath = process.argv[2] || "codeql";
-
-  const extractorDirs = resolveLanguages(codeqlPath);
-  const languages = findLanguagesWithDefaultQueries(extractorDirs);
-  const aliases = resolveAliases(codeqlPath, new Set(languages));
-  writeBuiltinLanguages(languages, aliases);
-}
-
-main();
@@ -5,6 +5,7 @@ import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";
+import { JSONSchemaForNPMPackageJsonFiles } from "@schemastore/package";

 import type { Config } from "./config-utils";
 import { Logger } from "./logging";
@@ -15,11 +16,8 @@ import {
  ConfigurationError,
 } from "./util";

-/**
- * This constant is set to the value of the `"version"` property in `package.json` by `esbuild`.
- * It is also set in `ava.setup.mjs` for tests.
- */
-declare const __CODEQL_ACTION_VERSION__: string;
+// eslint-disable-next-line import/no-commonjs, @typescript-eslint/no-require-imports
+const pkg = require("../package.json") as JSONSchemaForNPMPackageJsonFiles;

 /**
 * Wrapper around core.getInput for inputs that always have a value.
@@ -53,14 +51,8 @@ export function getTemporaryDirectory(): string {
    : getRequiredEnvParam("RUNNER_TEMP");
 }

-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-export function getDiffRangesJsonFilePath(): string {
-  return path.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
-}
-
 export function getActionVersion(): string {
-  return __CODEQL_ACTION_VERSION__;
+  return pkg.version!;
 }

 /**
@@ -28,11 +28,12 @@ import {
  DependencyCacheUploadStatusReport,
  uploadDependencyCaches,
 } from "./dependency-caching";
+import { getDiffInformedAnalysisBranches } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
-import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay/caching";
+import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay";
 import { getRepositoryNwo } from "./repository";
 import * as statusReport from "./status-report";
 import {
@@ -135,13 +136,9 @@ function hasBadExpectErrorInput(): boolean {
 function doesGoExtractionOutputExist(config: Config): boolean {
  const golangDbDirectory = util.getCodeQLDatabasePath(
    config,
-    BuiltInLanguage.go,
-  );
-  const trapDirectory = path.join(
-    golangDbDirectory,
-    "trap",
-    BuiltInLanguage.go,
+    KnownLanguage.go,
  );
+  const trapDirectory = path.join(golangDbDirectory, "trap", KnownLanguage.go);
  return (
    fs.existsSync(trapDirectory) &&
    fs
@@ -173,7 +170,7 @@ function doesGoExtractionOutputExist(config: Config): boolean {
 * whether any extraction output already exists for Go.
 */
 async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
-  if (!config.languages.includes(BuiltInLanguage.go)) {
+  if (!config.languages.includes(KnownLanguage.go)) {
    return;
  }
  if (config.buildMode) {
@@ -186,7 +183,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
    logger.debug("Won't run Go autobuild since it has already been run.");
    return;
  }
-  if (dbIsFinalized(config, BuiltInLanguage.go, logger)) {
+  if (dbIsFinalized(config, KnownLanguage.go, logger)) {
    logger.debug(
      "Won't run Go autobuild since there is already a finalized database for Go.",
    );
@@ -209,7 +206,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  logger.debug(
    "Running Go autobuild because extraction output (TRAP files) for Go code has not been found.",
  );
-  await runAutobuild(config, BuiltInLanguage.go, logger);
+  await runAutobuild(config, KnownLanguage.go, logger);
 }

 async function run(startedAt: Date) {
@@ -308,8 +305,14 @@ async function run(startedAt: Date) {
      logger,
    );

-    // Setup diff informed analysis if needed (based on whether init created the file)
-    const diffRangePackDir = await setupDiffInformedQueryRun(logger);
+    const branches = await getDiffInformedAnalysisBranches(
+      codeql,
+      features,
+      logger,
+    );
+    const diffRangePackDir = branches
+      ? await setupDiffInformedQueryRun(branches, logger)
+      : undefined;

    await warnIfGoInstalledAfterInit(config, logger);
    await runAutobuildIfLegacyGoWorkflow(config, logger);
@@ -10,11 +10,10 @@ import {
  defaultSuites,
  resolveQuerySuiteAlias,
  addSarifExtension,
-  diffRangeExtensionPackContents,
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
 import { Feature } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
  setupTests,
@@ -41,7 +40,7 @@ test.serial("status report fields", async (t) => {
    const threadsFlag = "";
    sinon.stub(uploadLib, "validateSarifFileSchema");

-    for (const language of Object.values(BuiltInLanguage)) {
+    for (const language of Object.values(KnownLanguage)) {
      const codeql = createStubCodeQL({
        databaseRunQueries: async () => {},
        databaseInterpretResults: async (
@@ -130,13 +129,13 @@ test.serial("status report fields", async (t) => {
 test("resolveQuerySuiteAlias", (t) => {
  // default query suite names should resolve to something language-specific ending in `.qls`.
  for (const suite of defaultSuites) {
-    const resolved = resolveQuerySuiteAlias(BuiltInLanguage.go, suite);
+    const resolved = resolveQuerySuiteAlias(KnownLanguage.go, suite);
    t.assert(
      path.extname(resolved) === ".qls",
      "Resolved default suite doesn't end in .qls",
    );
    t.assert(
-      resolved.indexOf(BuiltInLanguage.go) >= 0,
+      resolved.indexOf(KnownLanguage.go) >= 0,
      "Resolved default suite doesn't contain language name",
    );
  }
@@ -145,12 +144,12 @@ test("resolveQuerySuiteAlias", (t) => {
  const names = ["foo", "bar", "codeql/go-queries@1.0"];

  for (const name of names) {
-    t.deepEqual(resolveQuerySuiteAlias(BuiltInLanguage.go, name), name);
+    t.deepEqual(resolveQuerySuiteAlias(KnownLanguage.go, name), name);
  }
 });

 test("addSarifExtension", (t) => {
-  for (const language of Object.values(BuiltInLanguage)) {
+  for (const language of Object.values(KnownLanguage)) {
    t.deepEqual(addSarifExtension(CodeScanning, language), `${language}.sarif`);
    t.deepEqual(
      addSarifExtension(CodeQuality, language),
@@ -159,22 +158,3 @@ test("addSarifExtension", (t) => {
    t.is(addSarifExtension(RiskAssessment, language), `${language}.csra.sarif`);
  }
 });
-
-test("diffRangeExtensionPackContents", (t) => {
-  const output = diffRangeExtensionPackContents(
-    [
-      {
-        path: "main.js",
-        startLine: 10,
-        endLine: 20,
-      },
-    ],
-    "/checkout/path",
-  );
-
-  const expected = fs.readFileSync(
-    `${__dirname}/../src/testdata/pr-diff-range.yml`,
-    "utf8",
-  );
-  t.deepEqual(output, expected);
-});
@@ -5,7 +5,7 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";

-import { getTemporaryDirectory, getRequiredInput } from "./actions-util";
+import { getTemporaryDirectory, PullRequestBranches } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
@@ -17,13 +17,14 @@ import {
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
  DiffThunkRange,
-  readDiffRangesJsonFile,
+  writeDiffRangesJsonFile,
+  getPullRequestEditedDiffRanges,
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import type * as sarif from "./sarif";
 import { DatabaseCreationTimings, EventReport } from "./status-report";
 import { endTracingForCluster } from "./tracer-config";
@@ -41,7 +42,7 @@ export class CodeQLAnalysisError extends Error {
  }
 }

-type BuiltInLanguageKey = keyof typeof BuiltInLanguage;
+type KnownLanguageKey = keyof typeof KnownLanguage;

 type RunQueriesDurationStatusReport = {
  /**
@@ -50,12 +51,12 @@ type RunQueriesDurationStatusReport = {
   * The "builtin" designation is now outdated with the move to CLI config parsing: this is the time
   * taken to run _all_ the queries.
   */
-  [L in BuiltInLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
 };

 type InterpretResultsDurationStatusReport = {
  /** Time taken in ms to interpret results for the language (or undefined if this language was not analyzed). */
-  [L in BuiltInLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
 };

 export interface QueriesStatusReport
@@ -115,12 +116,12 @@ export async function runExtraction(

    if (await shouldExtractLanguage(codeql, config, language)) {
      logger.startGroup(`Extracting ${language}`);
-      if (language === BuiltInLanguage.python) {
+      if (language === KnownLanguage.python) {
        await setupPythonExtractor(logger);
      }
      if (config.buildMode) {
        if (
-          language === BuiltInLanguage.cpp &&
+          language === KnownLanguage.cpp &&
          config.buildMode === BuildMode.Autobuild
        ) {
          await setupCppAutobuild(codeql, logger);
@@ -131,14 +132,14 @@ export async function runExtraction(
        // a stable path that caches can be restored into and that we can cache at the
        // end of the workflow (i.e. that does not get removed when the scratch directory is).
        if (
-          language === BuiltInLanguage.java &&
+          language === KnownLanguage.java &&
          config.buildMode === BuildMode.None
        ) {
          process.env["CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_DEPENDENCY_DIR"] =
            getJavaTempDependencyDir();
        }
        if (
-          language === BuiltInLanguage.csharp &&
+          language === KnownLanguage.csharp &&
          config.buildMode === BuildMode.None &&
          (await features.getValue(Feature.CsharpCacheBuildModeNone))
        ) {
@@ -232,73 +233,32 @@ async function finalizeDatabaseCreation(
 * the diff range information, or `undefined` if the feature is disabled.
 */
 export async function setupDiffInformedQueryRun(
+  branches: PullRequestBranches,
  logger: Logger,
 ): Promise<string | undefined> {
  return await withGroupAsync(
    "Generating diff range extension pack",
    async () => {
-      const diffRanges = readDiffRangesJsonFile(logger);
-      if (diffRanges === undefined) {
-        logger.info(
-          "No precomputed diff ranges found; skipping diff-informed analysis stage.",
-        );
-        return undefined;
-      }
-
-      const checkoutPath = getRequiredInput("checkout_path");
-      const packDir = writeDiffRangeDataExtensionPack(
-        logger,
-        diffRanges,
-        checkoutPath,
-      );
      logger.info(
-        `Successfully created diff range extension pack at ${packDir}.`,
+        `Calculating diff ranges for ${branches.base}...${branches.head}`,
      );
+      const diffRanges = await getPullRequestEditedDiffRanges(branches, logger);
+      const packDir = writeDiffRangeDataExtensionPack(logger, diffRanges);
+      if (packDir === undefined) {
+        logger.warning(
+          "Cannot create diff range extension pack for diff-informed queries; " +
+            "reverting to performing full analysis.",
+        );
+      } else {
+        logger.info(
+          `Successfully created diff range extension pack at ${packDir}.`,
+        );
+      }
      return packDir;
    },
  );
 }

-export function diffRangeExtensionPackContents(
-  ranges: DiffThunkRange[],
-  checkoutPath: string,
-): string {
-  const header = `
-extensions:
-  - addsTo:
-      pack: codeql/util
-      extensible: restrictAlertsTo
-      checkPresence: false
-    data:
-`;
-
-  let data = ranges
-    .map((range) => {
-      // Diff-informed queries expect the file path to be absolute. CodeQL always
-      // uses forward slashes as the path separator, so on Windows we need to
-      // replace any backslashes with forward slashes.
-      const filename = path
-        .join(checkoutPath, range.path)
-        .replaceAll(path.sep, "/");
-
-      // Using yaml.dump() with `forceQuotes: true` ensures that all special
-      // characters are escaped, and that the path is always rendered as a
-      // quoted string on a single line.
-      return (
-        `      - [${yaml.dump(filename, { forceQuotes: true }).trim()}, ` +
-        `${range.startLine}, ${range.endLine}]\n`
-      );
-    })
-    .join("");
-  if (!data) {
-    // Ensure that the data extension is not empty, so that a pull request with
-    // no edited lines would exclude (instead of accepting) all alerts.
-    data = '      - ["", 0, 0]\n';
-  }
-
-  return header + data;
-}
-
 /**
 * Create an extension pack in the temporary directory that contains the file
 * line ranges that were added or modified in the pull request.
@@ -306,14 +266,17 @@ extensions:
 * @param logger
 * @param ranges The file line ranges, as returned by
 * `getPullRequestEditedDiffRanges`.
- * @param checkoutPath The path at which the repository was checked out.
- * @returns The absolute path of the directory containing the extension pack.
+ * @returns The absolute path of the directory containing the extension pack, or
+ * `undefined` if no extension pack was created.
 */
 function writeDiffRangeDataExtensionPack(
  logger: Logger,
-  ranges: DiffThunkRange[],
-  checkoutPath: string,
-): string {
+  ranges: DiffThunkRange[] | undefined,
+): string | undefined {
+  if (ranges === undefined) {
+    return undefined;
+  }
+
  if (ranges.length === 0) {
    // An empty diff range means that there are no added or modified lines in
    // the pull request. But the `restrictAlertsTo` extensible predicate
@@ -344,16 +307,42 @@ dataExtensions:
 `,
  );

-  const extensionContents = diffRangeExtensionPackContents(
-    ranges,
-    checkoutPath,
-  );
+  const header = `
+extensions:
+  - addsTo:
+      pack: codeql/util
+      extensible: restrictAlertsTo
+      checkPresence: false
+    data:
+`;
+
+  let data = ranges
+    .map(
+      (range) =>
+        // Using yaml.dump() with `forceQuotes: true` ensures that all special
+        // characters are escaped, and that the path is always rendered as a
+        // quoted string on a single line.
+        `      - [${yaml.dump(range.path, { forceQuotes: true }).trim()}, ` +
+        `${range.startLine}, ${range.endLine}]\n`,
+    )
+    .join("");
+  if (!data) {
+    // Ensure that the data extension is not empty, so that a pull request with
+    // no edited lines would exclude (instead of accepting) all alerts.
+    data = '      - ["", 0, 0]\n';
+  }
+
+  const extensionContents = header + data;
  const extensionFilePath = path.join(diffRangeDir, "pr-diff-range.yml");
  fs.writeFileSync(extensionFilePath, extensionContents);
  logger.debug(
    `Wrote pr-diff-range extension pack to ${extensionFilePath}:\n${extensionContents}`,
  );

+  // Write the diff ranges to a JSON file, for action-side alert filtering by the
+  // upload-lib module.
+  writeDiffRangesJsonFile(logger, ranges);
+
  return diffRangeDir;
 }

@@ -686,7 +675,7 @@ export async function warnIfGoInstalledAfterInit(

      addDiagnostic(
        config,
-        BuiltInLanguage.go,
+        KnownLanguage.go,
        makeDiagnostic(
          "go/workflow/go-installed-after-codeql-init",
          "Go was installed after the `codeql-action/init` Action was run",
@@ -128,8 +128,6 @@ export async function getGitHubVersionFromApi(

  // Doesn't strictly have to be the meta endpoint as we're only
  // using the response headers which are available on every request.
-  //
-  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
  const response = await apiClient.rest.meta.get();

@@ -166,9 +164,6 @@ export async function getGitHubVersion(): Promise<GitHubVersion> {

 /**
 * Get the path of the currently executing workflow relative to the repository root.
- *
- * See https://docs.github.com/en/rest/actions/workflow-runs#get-a-workflow-run
- * and https://docs.github.com/en/rest/actions/workflows#get-a-workflow.
 */
 export async function getWorkflowRelativePath(): Promise<string> {
  const repo_nwo = getRepositoryNwo();
@@ -257,13 +252,9 @@ export interface ActionsCacheItem {
  size_in_bytes?: number;
 }

-/**
- * List all Actions cache entries starting with the provided key prefix and matching the provided ref.
- *
- * See https://docs.github.com/en/rest/actions/cache#list-github-actions-caches-for-a-repository.
- */
+/** List all Actions cache entries matching the provided key and ref. */
 export async function listActionsCaches(
-  keyPrefix: string,
+  key: string,
  ref?: string,
 ): Promise<ActionsCacheItem[]> {
  const repositoryNwo = getRepositoryNwo();
@@ -273,17 +264,13 @@ export async function listActionsCaches(
    {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
-      key: keyPrefix,
+      key,
      ref,
    },
  );
 }

-/**
- * Delete an Actions cache item by its ID.
- *
- * See https://docs.github.com/en/rest/actions/cache#delete-a-github-actions-cache-for-a-repository-using-a-cache-id.
- */
+/** Delete an Actions cache item by its ID. */
 export async function deleteActionsCache(id: number) {
  const repositoryNwo = getRepositoryNwo();

@@ -294,11 +281,7 @@ export async function deleteActionsCache(id: number) {
  });
 }

-/**
- * Retrieve all custom repository properties.
- *
- * See https://docs.github.com/en/rest/repos/custom-properties#get-all-custom-property-values-for-a-repository.
- */
+/** Retrieve all custom repository properties. */
 export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
  return getApiClient().request("GET /repos/:owner/:repo/properties/values", {
    owner: repositoryNwo.owner,
@@ -1 +1 @@
-{"maximumVersion": "3.21", "minimumVersion": "3.16"}
+{"maximumVersion": "3.21", "minimumVersion": "3.14"}
@@ -7,7 +7,7 @@ import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
 import { EnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
 import { asyncFilter, BuildMode } from "./util";
@@ -72,7 +72,7 @@ export async function determineAutobuildLanguages(
   * version of the CodeQL Action.
   */
  const autobuildLanguagesWithoutGo = autobuildLanguages.filter(
-    (l) => l !== BuiltInLanguage.go,
+    (l) => l !== KnownLanguage.go,
  );

  const languages: Language[] = [];
@@ -84,7 +84,7 @@ export async function determineAutobuildLanguages(
  // If Go is requested, run the Go autobuilder last to ensure it doesn't
  // interfere with the other autobuilder.
  if (autobuildLanguages.length !== autobuildLanguagesWithoutGo.length) {
-    languages.push(BuiltInLanguage.go);
+    languages.push(KnownLanguage.go);
  }

  logger.debug(`Will autobuild ${languages.join(" and ")}.`);
@@ -156,7 +156,7 @@ export async function runAutobuild(
 ) {
  logger.startGroup(`Attempting to automatically build ${language} code`);
  const codeQL = await getCodeQL(config.codeQLCmd);
-  if (language === BuiltInLanguage.cpp) {
+  if (language === KnownLanguage.cpp) {
    await setupCppAutobuild(codeQL, logger);
  }
  if (config.buildMode) {
@@ -164,7 +164,7 @@ export async function runAutobuild(
  } else {
    await codeQL.runAutobuild(config, language);
  }
-  if (language === BuiltInLanguage.go) {
+  if (language === KnownLanguage.go) {
    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
  }
  logger.endGroup();
@@ -299,20 +299,6 @@ test("wrapCliConfigurationError - swift build failed", (t) => {
  t.true(wrappedError instanceof ConfigurationError);
 });

-test("wrapCliConfigurationError - swift incompatible os", (t) => {
-  const commandError = new CommandInvocationError(
-    "codeql",
-    ["swift/tools/autobuild.sh"],
-    1,
-    "2026-04-01 18:35:00 EST ERRO [extractor/main] [incompatible-os] Currently, Swift analysis is only supported on macOS. (IncompatibleOs.cpp:26)",
-  );
-  const cliError = new CliError(commandError);
-
-  const wrappedError = wrapCliConfigurationError(cliError);
-
-  t.true(wrappedError instanceof ConfigurationError);
-});
-
 test("wrapCliConfigurationError - pack cannot be found", (t) => {
  const commandError = new CommandInvocationError(
    "codeql",
@@ -144,7 +144,6 @@ export enum CliConfigErrorCategory {
  OutOfMemoryOrDisk = "OutOfMemoryOrDisk",
  PackCannotBeFound = "PackCannotBeFound",
  PackMissingAuth = "PackMissingAuth",
-  SwiftIncompatibleOs = "SwiftIncompatibleOs",
  SwiftBuildFailed = "SwiftBuildFailed",
  UnsupportedBuildMode = "UnsupportedBuildMode",
 }
@@ -282,12 +281,6 @@ const cliErrorsConfig: Record<CliConfigErrorCategory, CliErrorConfiguration> = {
      ),
    ],
  },
-  [CliConfigErrorCategory.SwiftIncompatibleOs]: {
-    cliErrorMessageCandidates: [
-      new RegExp("\\[incompatible-os\\]"),
-      new RegExp("Swift analysis is only supported on macOS"),
-    ],
-  },
  [CliConfigErrorCategory.UnsupportedBuildMode]: {
    cliErrorMessageCandidates: [
      new RegExp(
@@ -21,7 +21,7 @@ import {
 import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -46,7 +46,7 @@ test.beforeEach(() => {
  initializeEnvironment("1.2.3");

  stubConfig = createTestConfig({
-    languages: [BuiltInLanguage.cpp],
+    languages: [KnownLanguage.cpp],
  });
 });

@@ -115,7 +115,7 @@ async function stubCodeql(): Promise<codeql.CodeQL> {
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
  sinon
    .stub(codeqlObject, "isTracedLanguage")
-    .withArgs(BuiltInLanguage.cpp)
+    .withArgs(KnownLanguage.cpp)
    .resolves(true);
  return codeqlObject;
 }
@@ -956,8 +956,7 @@ test.serial("runTool summarizes autobuilder errors", async (t) => {
  sinon.stub(io, "which").resolves("");

  await t.throwsAsync(
-    async () =>
-      await codeqlObject.runAutobuild(stubConfig, BuiltInLanguage.java),
+    async () => await codeqlObject.runAutobuild(stubConfig, KnownLanguage.java),
    {
      instanceOf: util.ConfigurationError,
      message:
@@ -983,8 +982,7 @@ test.serial("runTool truncates long autobuilder errors", async (t) => {
  sinon.stub(io, "which").resolves("");

  await t.throwsAsync(
-    async () =>
-      await codeqlObject.runAutobuild(stubConfig, BuiltInLanguage.java),
+    async () => await codeqlObject.runAutobuild(stubConfig, KnownLanguage.java),
    {
      instanceOf: util.ConfigurationError,
      message:
@@ -24,8 +24,11 @@ import {
 import { isAnalyzingDefaultBranch } from "./git-utils";
 import { Language } from "./languages";
 import { Logger } from "./logging";
-import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import {
+  OverlayDatabaseMode,
+  writeBaseDatabaseOidsFile,
+  writeOverlayChangesFile,
+} from "./overlay";
 import * as setupCodeql from "./setup-codeql";
 import { ZstdAvailability } from "./tar";
 import { ToolsDownloadStatusReport } from "./tools-download";
@@ -282,21 +285,34 @@ const CODEQL_MINIMUM_VERSION = "2.17.6";
 /**
 * This version will shortly become the oldest version of CodeQL that the Action will run with.
 */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";

 /**
 * This is the version of GHES that was most recently deprecated.
 */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";

 /**
 * This is the deprecation date for the version of GHES that was most recently deprecated.
 */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";

 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";

+/*
+ * Deprecated in favor of ToolsFeature.
+ *
+ * Versions of CodeQL that version-flag certain functionality in the Action.
+ * For convenience, please keep these in descending order. Once a version
+ * flag is older than the oldest supported version above, it may be removed.
+ */
+
+/**
+ * Versions 2.17.1+ of the CodeQL CLI support the `--cache-cleanup` option.
+ */
+const CODEQL_VERSION_CACHE_CLEANUP = "2.17.1";
+
 /**
 * Set up CodeQL CLI access.
 *
@@ -875,13 +891,19 @@ async function getCodeQLForCmd(
      config: Config,
      cleanupLevel: CleanupLevel,
    ): Promise<void> {
+      const cacheCleanupFlag = (await util.codeQlVersionAtLeast(
+        this,
+        CODEQL_VERSION_CACHE_CLEANUP,
+      ))
+        ? "--cache-cleanup"
+        : "--mode";
      for (const language of config.languages) {
        const databasePath = util.getCodeQLDatabasePath(config, language);
        const codeqlArgs = [
          "database",
          "cleanup",
          databasePath,
-          `--cache-cleanup=${cleanupLevel}`,
+          `${cacheCleanupFlag}=${cleanupLevel}`,
          ...getExtraOptionsFromEnv(["database", "cleanup"]),
        ];
        await runCli(cmd, codeqlArgs);
@@ -18,17 +18,14 @@ import { Feature } from "./feature-flags";
 import { RepositoryProperties } from "./feature-flags/properties";
 import * as gitUtils from "./git-utils";
 import { GitVersionInfo } from "./git-utils";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { getRunnerLogger } from "./logging";
-import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
-import * as overlayDiagnostics from "./overlay/diagnostics";
+import { CODEQL_OVERLAY_MINIMUM_VERSION, OverlayDatabaseMode } from "./overlay";
 import { OverlayDisabledReason } from "./overlay/diagnostics";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import * as overlayStatus from "./overlay/status";
 import { parseRepositoryNwo } from "./repository";
 import {
  setupTests,
-  setupActionsVars,
  mockLanguagesInRepo as mockLanguagesInRepo,
  createFeatures,
  getRecordingLogger,
@@ -67,6 +64,7 @@ function createTestInitConfigInputs(
      configInput: undefined,
      buildModeInput: undefined,
      ramInput: undefined,
+      trapCachingEnabled: false,
      dependencyCachingEnabled: CachingKind.None,
      debugMode: false,
      debugArtifactName: "",
@@ -146,8 +144,6 @@ test.serial("load empty config", async (t) => {
    const logger = getRunnerLogger(true);
    const languages = "javascript,python";

-    setupActionsVars(tempDir, tempDir);
-
    const codeql = createStubCodeQL({
      async betterResolveLanguages() {
        return {
@@ -189,8 +185,6 @@ test.serial("load code quality config", async (t) => {
    const logger = getRunnerLogger(true);
    const languages = "actions";

-    setupActionsVars(tempDir, tempDir);
-
    const codeql = createStubCodeQL({
      async betterResolveLanguages() {
        return {
@@ -216,7 +210,7 @@ test.serial("load code quality config", async (t) => {
    // And the config we expect it to result in
    const expectedConfig = createTestConfig({
      analysisKinds: [AnalysisKind.CodeQuality],
-      languages: [BuiltInLanguage.actions],
+      languages: [KnownLanguage.actions],
      // This gets set because we only have `AnalysisKind.CodeQuality`
      computedConfig: {
        "disable-default-queries": true,
@@ -243,8 +237,6 @@ test.serial(
      const logger = getRunnerLogger(true);
      const languages = "javascript";

-      setupActionsVars(tempDir, tempDir);
-
      const codeql = createStubCodeQL({
        async betterResolveLanguages() {
          return {
@@ -269,7 +261,7 @@ test.serial(

      const expectedConfig = createTestConfig({
        analysisKinds: [AnalysisKind.CodeQuality],
-        languages: [BuiltInLanguage.javascript],
+        languages: [KnownLanguage.javascript],
        codeQLCmd: codeql.getPath(),
        computedConfig,
        dbLocation: path.resolve(tempDir, "codeql_databases"),
@@ -483,8 +475,6 @@ test.serial("load non-existent input", async (t) => {

 test.serial("load non-empty input", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    setupActionsVars(tempDir, tempDir);
-
    const codeql = createStubCodeQL({
      async betterResolveLanguages() {
        return {
@@ -519,7 +509,7 @@ test.serial("load non-empty input", async (t) => {

    // And the config we expect it to parse to
    const expectedConfig = createTestConfig({
-      languages: [BuiltInLanguage.javascript],
+      languages: [KnownLanguage.javascript],
      buildMode: BuildMode.None,
      originalUserInput: userConfig,
      computedConfig: userConfig,
@@ -893,10 +883,10 @@ const mockRepositoryNwo = parseRepositoryNwo("owner/repo");
      betterResolveLanguages: (options) =>
        Promise.resolve({
          aliases: {
-            "c#": BuiltInLanguage.csharp,
-            c: BuiltInLanguage.cpp,
-            kotlin: BuiltInLanguage.java,
-            typescript: BuiltInLanguage.javascript,
+            "c#": KnownLanguage.csharp,
+            c: KnownLanguage.cpp,
+            kotlin: KnownLanguage.java,
+            typescript: KnownLanguage.javascript,
          },
          extractors: {
            cpp: [stubExtractorEntry],
@@ -945,12 +935,12 @@ const mockRepositoryNwo = parseRepositoryNwo("owner/repo");
 for (const { displayName, language, feature } of [
  {
    displayName: "Java",
-    language: BuiltInLanguage.java,
+    language: KnownLanguage.java,
    feature: Feature.DisableJavaBuildlessEnabled,
  },
  {
    displayName: "C#",
-    language: BuiltInLanguage.csharp,
+    language: KnownLanguage.csharp,
    feature: Feature.DisableCsharpBuildless,
  },
 ]) {
@@ -970,7 +960,7 @@ for (const { displayName, language, feature } of [
    const messages: LoggedMessage[] = [];
    const buildMode = await configUtils.parseBuildModeInput(
      "none",
-      [BuiltInLanguage.python],
+      [KnownLanguage.python],
      createFeatures([feature]),
      getRecordingLogger(messages),
    );
@@ -1006,7 +996,6 @@ interface OverlayDatabaseModeTestSetup {
  codeqlVersion: string;
  gitRoot: string | undefined;
  gitVersion: GitVersionInfo | undefined;
-  hasSubmodules: boolean;
  codeScanningConfig: UserConfig;
  diskUsage: DiskUsage | undefined;
  memoryFlagValue: number;
@@ -1020,11 +1009,13 @@ const defaultOverlayDatabaseModeTestSetup: OverlayDatabaseModeTestSetup = {
  isPullRequest: false,
  isDefaultBranch: false,
  buildMode: BuildMode.None,
-  languages: [BuiltInLanguage.javascript],
+  languages: [KnownLanguage.javascript],
  codeqlVersion: CODEQL_OVERLAY_MINIMUM_VERSION,
  gitRoot: "/some/git/root",
-  gitVersion: new GitVersionInfo("2.39.0", "2.39.0"),
-  hasSubmodules: false,
+  gitVersion: new GitVersionInfo(
+    gitUtils.GIT_MINIMUM_VERSION_FOR_OVERLAY,
+    gitUtils.GIT_MINIMUM_VERSION_FOR_OVERLAY,
+  ),
  codeScanningConfig: {},
  diskUsage: {
    numAvailableBytes: 50_000_000_000,
@@ -1092,7 +1083,7 @@ const checkOverlayEnablementMacro = test.macro({
        sinon
          .stub(codeql, "isTracedLanguage")
          .callsFake(async (lang: Language) => {
-            return lang === BuiltInLanguage.java;
+            return [KnownLanguage.java].includes(lang as KnownLanguage);
          });

        // Mock git root detection
@@ -1100,9 +1091,6 @@ const checkOverlayEnablementMacro = test.macro({
          sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
        }

-        // Mock submodule detection
-        sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules);
-
        // Mock default branch detection
        sinon
          .stub(gitUtils, "isAnalyzingDefaultBranch")
@@ -1185,7 +1173,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Ignore feature flag when analyzing non-default branch",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
  },
  {
@@ -1197,7 +1185,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch when feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isDefaultBranch: true,
  },
@@ -1211,7 +1199,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch when feature enabled with custom analysis",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    codeScanningConfig: {
      packs: ["some-custom-pack@1.0.0"],
@@ -1228,7 +1216,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch when code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1245,7 +1233,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if runner disk space is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1265,7 +1253,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if we can't determine runner disk space",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1282,7 +1270,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if runner disk space is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1304,7 +1292,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1325,7 +1313,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1347,7 +1335,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1367,7 +1355,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch if memory flag is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1384,7 +1372,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if memory flag is too low but CodeQL >= 2.24.3",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1403,7 +1391,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay-base database on default branch if memory flag is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1422,7 +1410,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when cached status indicates previous failure",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisJavascript,
@@ -1440,7 +1428,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when cached status indicates previous failure",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisJavascript,
@@ -1458,7 +1446,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with disable-default-queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1477,7 +1465,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with packs",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1496,7 +1484,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1515,7 +1503,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when code-scanning feature enabled with query-filters",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1534,7 +1522,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when only language-specific feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisJavascript],
    isDefaultBranch: true,
  },
@@ -1547,7 +1535,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when only code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisCodeScanningJavascript],
    isDefaultBranch: true,
  },
@@ -1560,7 +1548,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay-base database on default branch when language-specific feature disabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis],
    isDefaultBranch: true,
  },
@@ -1573,7 +1561,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay analysis on PR when feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
  },
@@ -1587,7 +1575,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay analysis on PR when feature enabled with custom analysis",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    codeScanningConfig: {
      packs: ["some-custom-pack@1.0.0"],
@@ -1604,7 +1592,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay analysis on PR when code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1621,7 +1609,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR if runner disk space is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1641,7 +1629,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay analysis on PR if runner disk space is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1663,7 +1651,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR if we can't determine runner disk space",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1680,7 +1668,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR if memory flag is too low",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1697,7 +1685,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay analysis on PR if memory flag is too low but CodeQL >= 2.24.3",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1716,7 +1704,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay analysis on PR if memory flag is too low and skip resource checks flag is enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1735,7 +1723,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with disable-default-queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1754,7 +1742,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with packs",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1773,7 +1761,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with queries",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1792,7 +1780,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when code-scanning feature enabled with query-filters",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [
      Feature.OverlayAnalysis,
      Feature.OverlayAnalysisCodeScanningJavascript,
@@ -1811,7 +1799,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when only language-specific feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
  },
@@ -1824,7 +1812,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when only code-scanning feature enabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysisCodeScanningJavascript],
    isPullRequest: true,
  },
@@ -1837,7 +1825,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis on PR when language-specific feature disabled",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis],
    isPullRequest: true,
  },
@@ -1875,7 +1863,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay PR analysis by feature flag",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
  },
@@ -1891,7 +1879,7 @@ test.serial(
  {
    overlayDatabaseEnvVar: "overlay",
    buildMode: BuildMode.Autobuild,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleBuildMode,
@@ -1904,7 +1892,7 @@ test.serial(
  {
    overlayDatabaseEnvVar: "overlay",
    buildMode: undefined,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleBuildMode,
@@ -1937,11 +1925,10 @@ test.serial(

 test.serial(
  checkOverlayEnablementMacro,
-  "Fallback due to old git version with submodules",
+  "Fallback due to old git version",
  {
    overlayDatabaseEnvVar: "overlay",
-    gitVersion: new GitVersionInfo("2.34.1", "2.34.1"), // Above 2.11.0 but below 2.36.0
-    hasSubmodules: true,
+    gitVersion: new GitVersionInfo("2.30.0", "2.30.0"), // Version below required 2.38.0
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleGit,
@@ -1950,36 +1937,21 @@ test.serial(

 test.serial(
  checkOverlayEnablementMacro,
-  "Fallback when git version cannot be determined and repo has submodules",
+  "Fallback when git version cannot be determined",
  {
    overlayDatabaseEnvVar: "overlay",
    gitVersion: undefined,
-    hasSubmodules: true,
  },
  {
    disabledReason: OverlayDisabledReason.IncompatibleGit,
  },
 );

-test.serial(
-  checkOverlayEnablementMacro,
-  "Overlay enabled when git version cannot be determined and repo has no submodules",
-  {
-    overlayDatabaseEnvVar: "overlay",
-    gitVersion: undefined,
-    hasSubmodules: false,
-  },
-  {
-    overlayDatabaseMode: OverlayDatabaseMode.Overlay,
-    useOverlayDatabaseCaching: false,
-  },
-);
-
 test.serial(
  checkOverlayEnablementMacro,
  "No overlay when disabled via repository property",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
    repositoryProperties: {
@@ -1995,7 +1967,7 @@ test.serial(
  checkOverlayEnablementMacro,
  "Overlay not disabled when repository property is false",
  {
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
    isPullRequest: true,
    repositoryProperties: {
@@ -2024,7 +1996,7 @@ test.serial(
 );

 // Exercise language-specific overlay analysis features code paths
-for (const language in BuiltInLanguage) {
+for (const language in KnownLanguage) {
  test.serial(
    checkOverlayEnablementMacro,
    `Check default overlay analysis feature for ${language}`,
@@ -2041,13 +2013,13 @@ for (const language in BuiltInLanguage) {

 // Verify that a language without a per-language overlay feature flag cannot have
 // overlay analysis enabled, even when the base overlay feature flag is on.
-// Using swift here as it doesn't currently have overlay support — update this if
-// swift gains overlay support.
+// Using cpp here as it doesn't currently have overlay support — update this if
+// cpp gains overlay support.
 test.serial(
  checkOverlayEnablementMacro,
  "No overlay analysis for language without per-language overlay feature flag",
  {
-    languages: [BuiltInLanguage.swift],
+    languages: [KnownLanguage.cpp],
    features: [Feature.OverlayAnalysis],
    isPullRequest: true,
  },
@@ -2083,205 +2055,3 @@ test.serial("getPrimaryAnalysisConfig - Code Scanning + Code Quality", (t) => {
    AnalysisKind.CodeScanning,
  );
 });
-
-test.serial(
-  "isTrapCachingEnabled: explicit input true is respected",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns("true");
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: disabled on self-hosted runner by default",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.false(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner by default",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner when overlay enabled but feature flag off",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.Overlay,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: disabled on hosted runner when overlay enabled and feature flag on",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.false(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([Feature.OverlayAnalysisDisableTrapCaching]),
-          OverlayDatabaseMode.Overlay,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner when overlay is None even with feature flag on",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([Feature.OverlayAnalysisDisableTrapCaching]),
-          OverlayDatabaseMode.None,
-        ),
-      );
-    });
-  },
-);
-
-test("applyIncrementalAnalysisSettings: no-op when mode is not Overlay and diff ranges are unavailable", async (t) => {
-  const config = createTestConfig({});
-  config.overlayDatabaseMode = OverlayDatabaseMode.None;
-  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
-
-  await configUtils.applyIncrementalAnalysisSettings(
-    config,
-    false,
-    codeql,
-    logger,
-  );
-
-  t.is(config.overlayDatabaseMode, OverlayDatabaseMode.None);
-  t.deepEqual(config.extraQueryExclusions, []);
-});
-
-test("applyIncrementalAnalysisSettings: keeps overlay mode and adds exclusions when diff ranges are available", async (t) => {
-  const config = createTestConfig({
-    overlayDatabaseMode: OverlayDatabaseMode.Overlay,
-  });
-  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
-
-  await configUtils.applyIncrementalAnalysisSettings(
-    config,
-    true,
-    codeql,
-    logger,
-  );
-
-  t.is(config.overlayDatabaseMode, OverlayDatabaseMode.Overlay);
-  t.deepEqual(config.extraQueryExclusions, [
-    { exclude: { tags: "exclude-from-incremental" } },
-  ]);
-});
-
-test("applyIncrementalAnalysisSettings: disables overlay analysis when diff ranges are unavailable", async (t) => {
-  const config = createTestConfig({
-    overlayDatabaseMode: OverlayDatabaseMode.Overlay,
-  });
-  config.useOverlayDatabaseCaching = true;
-  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
-  const addDiagnosticsStub = sinon
-    .stub(overlayDiagnostics, "addOverlayDisablementDiagnostics")
-    .resolves();
-
-  await configUtils.applyIncrementalAnalysisSettings(
-    config,
-    false,
-    codeql,
-    logger,
-  );
-
-  t.is(config.overlayDatabaseMode, OverlayDatabaseMode.None);
-  t.is(config.useOverlayDatabaseCaching, false);
-  t.deepEqual(config.extraQueryExclusions, []);
-  t.true(addDiagnosticsStub.calledOnce);
-  t.is(
-    addDiagnosticsStub.firstCall.args[2],
-    OverlayDisabledReason.DiffInformedAnalysisNotEnabled,
-  );
-});
-
-test("applyIncrementalAnalysisSettings: adds exclusions for diff-informed-only runs", async (t) => {
-  const config = createTestConfig({});
-  config.overlayDatabaseMode = OverlayDatabaseMode.None;
-  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
-
-  await configUtils.applyIncrementalAnalysisSettings(
-    config,
-    true,
-    codeql,
-    logger,
-  );
-
-  t.is(config.overlayDatabaseMode, OverlayDatabaseMode.None);
-  t.deepEqual(config.extraQueryExclusions, [
-    { exclude: { tags: "exclude-from-incremental" } },
-  ]);
-});
@@ -2,12 +2,10 @@ import * as fs from "fs";
 import * as path from "path";
 import { performance } from "perf_hooks";

-import * as core from "@actions/core";
 import * as yaml from "js-yaml";

 import {
  getActionVersion,
-  getOptionalInput,
  isAnalyzingPullRequest,
  isDynamicWorkflow,
 } from "./actions-util";
@@ -31,7 +29,7 @@ import {
  addNoLanguageDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
+import { shouldPerformDiffInformedAnalysis } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement } from "./feature-flags";
@@ -43,19 +41,17 @@ import {
  getGeneratedFiles,
  getGitRoot,
  getGitVersionOrThrow,
-  GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES,
+  GIT_MINIMUM_VERSION_FOR_OVERLAY,
  GitVersionInfo,
-  hasSubmodules,
  isAnalyzingDefaultBranch,
 } from "./git-utils";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
-import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
+import { CODEQL_OVERLAY_MINIMUM_VERSION, OverlayDatabaseMode } from "./overlay";
 import {
  addOverlayDisablementDiagnostics,
  OverlayDisabledReason,
 } from "./overlay/diagnostics";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { shouldSkipOverlayAnalysis } from "./overlay/status";
 import { RepositoryNwo } from "./repository";
 import { ToolsFeature } from "./tools-features";
@@ -76,7 +72,6 @@ import {
  Result,
  Success,
  Failure,
-  isHostedRunner,
 } from "./util";

 /**
@@ -274,10 +269,10 @@ async function getSupportedLanguageMap(
  for (const extractor of Object.keys(resolveResult.extractors)) {
    // If the CLI supports resolving languages with default queries, use these
    // as the set of supported languages. Otherwise, require the language to be
-    // a built-in language.
+    // a known language.
    if (
      resolveSupportedLanguagesUsingCli ||
-      BuiltInLanguage[extractor] !== undefined
+      KnownLanguage[extractor] !== undefined
    ) {
      supportedLanguages[extractor] = extractor;
    }
@@ -457,6 +452,7 @@ export interface InitConfigInputs {
  configInput: string | undefined;
  buildModeInput: string | undefined;
  ramInput: string | undefined;
+  trapCachingEnabled: boolean;
  dependencyCachingEnabled: string | undefined;
  debugMode: boolean;
  debugArtifactName: string;
@@ -486,6 +482,7 @@ export async function initActionState(
    packsInput,
    buildModeInput,
    dbLocation,
+    trapCachingEnabled,
    dependencyCachingEnabled,
    debugMode,
    debugArtifactName,
@@ -543,6 +540,13 @@ export async function initActionState(
    };
  }

+  const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(
+    trapCachingEnabled,
+    codeql,
+    languages,
+    logger,
+  );
+
  // Compute the full Code Scanning configuration that combines the configuration from the
  // configuration file / `config` input with other inputs, such as `queries`.
  const computedConfig = generateCodeScanningConfig(
@@ -565,8 +569,8 @@ export async function initActionState(
    debugMode,
    debugArtifactName,
    debugDatabaseName,
-    trapCaches: {},
-    trapCacheDownloadTime: 0,
+    trapCaches,
+    trapCacheDownloadTime,
    dependencyCachingEnabled: getCachingKind(dependencyCachingEnabled),
    dependencyCachingRestoredKeys: [],
    extraQueryExclusions: [],
@@ -578,6 +582,7 @@ export async function initActionState(
 }

 async function downloadCacheWithTime(
+  trapCachingEnabled: boolean,
  codeQL: CodeQL,
  languages: Language[],
  logger: Logger,
@@ -585,9 +590,13 @@ async function downloadCacheWithTime(
  trapCaches: { [language: string]: string };
  trapCacheDownloadTime: number;
 }> {
-  const start = performance.now();
-  const trapCaches = await downloadTrapCaches(codeQL, languages, logger);
-  const trapCacheDownloadTime = performance.now() - start;
+  let trapCaches: { [language: string]: string } = {};
+  let trapCacheDownloadTime = 0;
+  if (trapCachingEnabled) {
+    const start = performance.now();
+    trapCaches = await downloadTrapCaches(codeQL, languages, logger);
+    trapCacheDownloadTime = performance.now() - start;
+  }
  return { trapCaches, trapCacheDownloadTime };
 }

@@ -627,7 +636,6 @@ async function loadUserConfig(
 * without an entry will have overlay analysis disabled.
 */
 const OVERLAY_ANALYSIS_FEATURES: Partial<Record<Language, Feature>> = {
-  cpp: Feature.OverlayAnalysisCpp,
  csharp: Feature.OverlayAnalysisCsharp,
  go: Feature.OverlayAnalysisGo,
  java: Feature.OverlayAnalysisJava,
@@ -639,7 +647,6 @@ const OVERLAY_ANALYSIS_FEATURES: Partial<Record<Language, Feature>> = {
 const OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES: Partial<
  Record<Language, Feature>
 > = {
-  cpp: Feature.OverlayAnalysisCodeScanningCpp,
  csharp: Feature.OverlayAnalysisCodeScanningCsharp,
  go: Feature.OverlayAnalysisCodeScanningGo,
  java: Feature.OverlayAnalysisCodeScanningJava,
@@ -947,7 +954,7 @@ async function validateOverlayDatabaseMode(
      await Promise.all(
        languages.map(
          async (l) =>
-            l !== BuiltInLanguage.go && // Workaround to allow overlay analysis for Go with any build
+            l !== KnownLanguage.go && // Workaround to allow overlay analysis for Go with any build
            // mode, since it does not yet support BMN. The Go autobuilder and/or extractor will
            // ensure that overlay-base databases are only created for supported Go build setups,
            // and that we'll fall back to full databases in other cases.
@@ -971,8 +978,7 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
  }
-  const gitRoot = await getGitRoot(sourceRoot);
-  if (gitRoot === undefined) {
+  if ((await getGitRoot(sourceRoot)) === undefined) {
    logger.warning(
      `Cannot build an ${overlayDatabaseMode} database because ` +
        `the source root "${sourceRoot}" is not inside a git repository. ` +
@@ -980,26 +986,21 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.NoGitRoot);
  }
-  if (hasSubmodules(gitRoot)) {
-    if (gitVersion === undefined) {
-      logger.warning(
-        `Cannot build an ${overlayDatabaseMode} database because ` +
-          "the repository has submodules and the Git version could not be determined. " +
-          "Falling back to creating a normal full database instead.",
-      );
-      return new Failure(OverlayDisabledReason.IncompatibleGit);
-    }
-    if (
-      !gitVersion.isAtLeast(GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES)
-    ) {
-      logger.warning(
-        `Cannot build an ${overlayDatabaseMode} database because ` +
-          "the repository has submodules and the installed Git version is older " +
-          `than ${GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES}. ` +
-          "Falling back to creating a normal full database instead.",
-      );
-      return new Failure(OverlayDisabledReason.IncompatibleGit);
-    }
+  if (gitVersion === undefined) {
+    logger.warning(
+      `Cannot build an ${overlayDatabaseMode} database because ` +
+        "the Git version could not be determined. " +
+        "Falling back to creating a normal full database instead.",
+    );
+    return new Failure(OverlayDisabledReason.IncompatibleGit);
+  }
+  if (!gitVersion.isAtLeast(GIT_MINIMUM_VERSION_FOR_OVERLAY)) {
+    logger.warning(
+      `Cannot build an ${overlayDatabaseMode} database because ` +
+        `the installed Git version is older than ${GIT_MINIMUM_VERSION_FOR_OVERLAY}. ` +
+        "Falling back to creating a normal full database instead.",
+    );
+    return new Failure(OverlayDisabledReason.IncompatibleGit);
  }

  return new Success({
@@ -1008,50 +1009,6 @@ async function validateOverlayDatabaseMode(
  });
 }

-export async function isTrapCachingEnabled(
-  features: FeatureEnablement,
-  overlayDatabaseMode: OverlayDatabaseMode,
-): Promise<boolean> {
-  // If the workflow specified something, always respect that.
-  const trapCaching = getOptionalInput("trap-caching");
-  if (trapCaching !== undefined) return trapCaching === "true";
-
-  // On self-hosted runners which may have slow network access, disable TRAP caching by default.
-  if (!isHostedRunner()) return false;
-
-  // If overlay analysis is enabled, then disable TRAP caching since overlay analysis supersedes it.
-  // This change is gated behind a feature flag.
-  if (
-    overlayDatabaseMode !== OverlayDatabaseMode.None &&
-    (await features.getValue(Feature.OverlayAnalysisDisableTrapCaching))
-  ) {
-    return false;
-  }
-
-  // Otherwise, enable TRAP caching.
-  return true;
-}
-
-async function setCppTrapCachingEnvironmentVariables(
-  config: Config,
-  logger: Logger,
-): Promise<void> {
-  if (config.languages.includes(BuiltInLanguage.cpp)) {
-    const envVar = "CODEQL_EXTRACTOR_CPP_TRAP_CACHING";
-    if (process.env[envVar]) {
-      logger.info(
-        `Environment variable ${envVar} already set, leaving it unchanged.`,
-      );
-    } else if (config.trapCaches[BuiltInLanguage.cpp]) {
-      logger.info("Enabling TRAP caching for C/C++.");
-      core.exportVariable(envVar, "true");
-    } else {
-      logger.debug(`Disabling TRAP caching for C/C++.`);
-      core.exportVariable(envVar, "false");
-    }
-  }
-}
-
 function dbLocationOrDefault(
  dbLocation: string | undefined,
  tempDir: string,
@@ -1076,48 +1033,6 @@ function hasQueryCustomisation(userConfig: UserConfig): boolean {
  );
 }

-/**
- * Finalize the incremental-analysis configuration for this run.
- *
- * Overlay analysis has only been validated in combination with diff-informed
- * analysis, so if `Overlay` mode was selected for a pull request but the diff
- * ranges could not be computed, fall back to a full non-overlay analysis.
- *
- * Query exclusions for incremental-only queries are then applied whenever the
- * diff ranges are available — which, after the fallback above, is exactly the
- * set of runs where any kind of incremental analysis (overlay or
- * diff-informed) is in effect.
- */
-export async function applyIncrementalAnalysisSettings(
-  config: Config,
-  hasDiffRanges: boolean,
-  codeql: CodeQL,
-  logger: Logger,
-): Promise<void> {
-  if (
-    config.overlayDatabaseMode === OverlayDatabaseMode.Overlay &&
-    !hasDiffRanges
-  ) {
-    logger.info(
-      `Reverting overlay database mode to ${OverlayDatabaseMode.None} ` +
-        "because the PR diff ranges could not be computed.",
-    );
-    config.overlayDatabaseMode = OverlayDatabaseMode.None;
-    config.useOverlayDatabaseCaching = false;
-    await addOverlayDisablementDiagnostics(
-      config,
-      codeql,
-      OverlayDisabledReason.DiffInformedAnalysisNotEnabled,
-    );
-  }
-
-  if (hasDiffRanges) {
-    config.extraQueryExclusions.push({
-      exclude: { tags: "exclude-from-incremental" },
-    });
-  }
-}
-
 /**
 * Load and return the config.
 *
@@ -1272,31 +1187,18 @@ export async function initConfig(
    );
  }

-  const hasDiffRanges = await prepareDiffInformedAnalysis(
-    inputs.codeql,
-    inputs.features,
-    logger,
-  );
-
-  await applyIncrementalAnalysisSettings(
-    config,
-    hasDiffRanges,
-    inputs.codeql,
-    logger,
-  );
-
-  if (await isTrapCachingEnabled(features, config.overlayDatabaseMode)) {
-    const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(
+  if (
+    config.overlayDatabaseMode === OverlayDatabaseMode.Overlay ||
+    (await shouldPerformDiffInformedAnalysis(
      inputs.codeql,
-      config.languages,
+      inputs.features,
      logger,
-    );
-    config.trapCaches = trapCaches;
-    config.trapCacheDownloadTime = trapCacheDownloadTime;
+    ))
+  ) {
+    config.extraQueryExclusions.push({
+      exclude: { tags: "exclude-from-incremental" },
+    });
  }
-
-  await setCppTrapCachingEnvironmentVariables(config, logger);
-
  return config;
 }

@@ -1581,7 +1483,7 @@ export async function parseBuildModeInput(
  }

  if (
-    languages.includes(BuiltInLanguage.csharp) &&
+    languages.includes(KnownLanguage.csharp) &&
    (await features.getValue(Feature.DisableCsharpBuildless))
  ) {
    logger.warning(
@@ -1591,7 +1493,7 @@ export async function parseBuildModeInput(
  }

  if (
-    languages.includes(BuiltInLanguage.java) &&
+    languages.includes(KnownLanguage.java) &&
    (await features.getValue(Feature.DisableJavaBuildlessEnabled))
  ) {
    logger.warning(
@@ -1,7 +1,7 @@
 import test, { ExecutionContext } from "ava";

 import { RepositoryProperties } from "../feature-flags/properties";
-import { BuiltInLanguage, Language } from "../languages";
+import { KnownLanguage, Language } from "../languages";
 import { getRunnerLogger } from "../logging";
 import {
  checkExpectedLogMessages,
@@ -54,7 +54,7 @@ const invalidPackNameMacro = test.macro({
    parsePacksErrorMacro.exec(
      t,
      name,
-      [BuiltInLanguage.cpp],
+      [KnownLanguage.cpp],
      new RegExp(`^"${name}" is not a valid pack$`),
    ),
  title: (_providedTitle: string | undefined, arg: string | undefined) =>
@@ -62,23 +62,23 @@ const invalidPackNameMacro = test.macro({
 });

 test("no packs", parsePacksMacro, "", [], undefined);
-test("two packs", parsePacksMacro, "a/b,c/d@1.2.3", [BuiltInLanguage.cpp], {
-  [BuiltInLanguage.cpp]: ["a/b", "c/d@1.2.3"],
+test("two packs", parsePacksMacro, "a/b,c/d@1.2.3", [KnownLanguage.cpp], {
+  [KnownLanguage.cpp]: ["a/b", "c/d@1.2.3"],
 });
 test(
  "two packs with spaces",
  parsePacksMacro,
  " a/b , c/d@1.2.3 ",
-  [BuiltInLanguage.cpp],
+  [KnownLanguage.cpp],
  {
-    [BuiltInLanguage.cpp]: ["a/b", "c/d@1.2.3"],
+    [KnownLanguage.cpp]: ["a/b", "c/d@1.2.3"],
  },
 );
 test(
  "two packs with language",
  parsePacksErrorMacro,
  "a/b,c/d@1.2.3",
-  [BuiltInLanguage.cpp, BuiltInLanguage.java],
+  [KnownLanguage.cpp, KnownLanguage.java],
  new RegExp(
    "Cannot specify a 'packs' input in a multi-language analysis. " +
      "Use a codeql-config.yml file instead and specify packs by language.",
@@ -106,9 +106,9 @@ test(
    // (globbing is not done)
    "c/d@1.2.3:+*)_(",
  ].join(","),
-  [BuiltInLanguage.cpp],
+  [KnownLanguage.cpp],
  {
-    [BuiltInLanguage.cpp]: [
+    [KnownLanguage.cpp]: [
      "c/d@1.0",
      "c/d@~1.0.0",
      "c/d@~1.0.0:a/b",
@@ -215,7 +215,7 @@ test(
  "All empty",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -227,7 +227,7 @@ test(
  "With queries",
  undefined,
  " a, b , c, d",
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -240,7 +240,7 @@ test(
  "With queries combining",
  undefined,
  "   +   a, b , c, d ",
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -254,7 +254,7 @@ test(
  "With packs",
  "   codeql/a , codeql/b   , codeql/c  , codeql/d  ",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -267,7 +267,7 @@ test(
  "With packs combining",
  "   +   codeql/a, codeql/b, codeql/c, codeql/d",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  {
    ...dbConfig.defaultAugmentationProperties,
@@ -281,7 +281,7 @@ test(
  "With repo property queries",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {
    "github-codeql-extra-queries": "a, b, c, d",
  },
@@ -299,7 +299,7 @@ test(
  "With repo property queries combining",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {
    "github-codeql-extra-queries": "+ a, b, c, d",
  },
@@ -341,7 +341,7 @@ test(
  "Plus (+) with nothing else (queries)",
  undefined,
  "   +   ",
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  /The workflow property "queries" is invalid/,
 );
@@ -351,7 +351,7 @@ test(
  "Plus (+) with nothing else (packs)",
  "   +   ",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  /The workflow property "packs" is invalid/,
 );
@@ -361,7 +361,7 @@ test(
  "Plus (+) with nothing else (repo property queries)",
  undefined,
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {
    "github-codeql-extra-queries": "    + ",
  },
@@ -373,7 +373,7 @@ test(
  "Packs input with multiple languages",
  "   +  a/b, c/d ",
  undefined,
-  [BuiltInLanguage.javascript, BuiltInLanguage.java],
+  [KnownLanguage.javascript, KnownLanguage.java],
  {},
  /Cannot specify a 'packs' input in a multi-language analysis/,
 );
@@ -393,7 +393,7 @@ test(
  "Invalid packs",
  " a-pack-without-a-scope ",
  undefined,
-  [BuiltInLanguage.javascript],
+  [KnownLanguage.javascript],
  {},
  /"a-pack-without-a-scope" is not a valid pack/,
 );
@@ -12,7 +12,7 @@ import { createStubCodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { cleanupAndUploadDatabases } from "./database-upload";
 import * as gitUtils from "./git-utils";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { RepositoryNwo } from "./repository";
 import {
  checkExpectedLogMessages,
@@ -45,7 +45,7 @@ const testApiDetails: GitHubApiDetails = {

 function getTestConfig(tmpDir: string): Config {
  return createTestConfig({
-    languages: [BuiltInLanguage.javascript],
+    languages: [KnownLanguage.javascript],
    dbLocation: tmpDir,
  });
 }
@@ -12,7 +12,7 @@ import { Config } from "./config-utils";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { Logger, withGroupAsync } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import { RepositoryNwo } from "./repository";
 import * as util from "./util";
 import { asHTTPError, bundleDb, CleanupLevel, parseGitHubUrl } from "./util";
@@ -12,7 +12,6 @@ import { scanArtifactsForTokens } from "./artifact-scanner";
 import { type CodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { EnvVar } from "./environment";
-import * as json from "./json";
 import { Language } from "./languages";
 import { Logger, withGroup } from "./logging";
 import {
@@ -262,7 +261,7 @@ export function getArtifactSuffix(matrix: string | undefined): string {
  if (matrix) {
    try {
      const matrixObject = JSON.parse(matrix);
-      if (json.isObject(matrixObject)) {
+      if (matrixObject !== null && typeof matrixObject === "object") {
        for (const matrixKey of Object.keys(matrixObject as object).sort())
          suffix += `-${matrixObject[matrixKey]}`;
      } else {
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.3",
-  "cliVersion": "2.25.3",
-  "priorBundleVersion": "codeql-bundle-v2.25.2",
-  "priorCliVersion": "2.25.2"
+  "bundleVersion": "codeql-bundle-v2.24.3",
+  "cliVersion": "2.24.3",
+  "priorBundleVersion": "codeql-bundle-v2.24.2",
+  "priorCliVersion": "2.24.2"
 }
@@ -27,7 +27,7 @@ import {
  CacheStoreResult,
 } from "./dependency-caching";
 import { Feature } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import {
  setupTests,
  createFeatures,
@@ -179,7 +179,7 @@ test("checkHashPatterns - logs when no patterns match", async (t) => {
  const result = await checkHashPatterns(
    codeql,
    features,
-    BuiltInLanguage.csharp,
+    KnownLanguage.csharp,
    config,
    "download",
    getRecordingLogger(messages),
@@ -208,7 +208,7 @@ test("checkHashPatterns - returns patterns when patterns match", async (t) => {
    const result = await checkHashPatterns(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      config,
      "upload",
      getRecordingLogger(messages),
@@ -270,7 +270,7 @@ test.serial(
    const keyWithFeature = await cacheKey(
      codeql,
      createFeatures([Feature.CsharpNewCacheKey]),
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      // Patterns don't matter here because we have stubbed `hashFiles` to always return a specific hash above.
      [],
    );
@@ -288,12 +288,12 @@ test.serial(
    const result = await downloadDependencyCaches(
      codeql,
      createFeatures([]),
-      [BuiltInLanguage.csharp],
+      [KnownLanguage.csharp],
      logger,
    );
    const statusReport = result.statusReport;
    t.is(statusReport.length, 1);
-    t.is(statusReport[0].language, BuiltInLanguage.csharp);
+    t.is(statusReport[0].language, KnownLanguage.csharp);
    t.is(statusReport[0].hit_kind, CacheHitKind.Miss);
    t.deepEqual(result.restoredKeys, []);
    t.assert(restoreCacheStub.calledOnce);
@@ -316,7 +316,7 @@ test.serial(
    const keyWithFeature = await cacheKey(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      // Patterns don't matter here because we have stubbed `hashFiles` to always return a specific hash above.
      [],
    );
@@ -334,14 +334,14 @@ test.serial(
    const result = await downloadDependencyCaches(
      codeql,
      features,
-      [BuiltInLanguage.csharp],
+      [KnownLanguage.csharp],
      logger,
    );

    // Check that the status report for telemetry indicates that one cache was restored with an exact match.
    const statusReport = result.statusReport;
    t.is(statusReport.length, 1);
-    t.is(statusReport[0].language, BuiltInLanguage.csharp);
+    t.is(statusReport[0].language, KnownLanguage.csharp);
    t.is(statusReport[0].hit_kind, CacheHitKind.Exact);

    // Check that the restored key has been returned.
@@ -380,7 +380,7 @@ test.serial(
    const keyWithFeature = await cacheKey(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      // Patterns don't matter here because we have stubbed `hashFiles` to always return a specific hash above.
      [],
    );
@@ -398,14 +398,14 @@ test.serial(
    const result = await downloadDependencyCaches(
      codeql,
      features,
-      [BuiltInLanguage.csharp],
+      [KnownLanguage.csharp],
      logger,
    );

    // Check that the status report for telemetry indicates that one cache was restored with a partial match.
    const statusReport = result.statusReport;
    t.is(statusReport.length, 1);
-    t.is(statusReport[0].language, BuiltInLanguage.csharp);
+    t.is(statusReport[0].language, KnownLanguage.csharp);
    t.is(statusReport[0].hit_kind, CacheHitKind.Partial);

    // Check that the restored key has been returned.
@@ -426,7 +426,7 @@ test("uploadDependencyCaches - skips upload for a language with no cache config"
  const logger = getRecordingLogger(messages);
  const features = createFeatures([]);
  const config = createTestConfig({
-    languages: [BuiltInLanguage.actions],
+    languages: [KnownLanguage.actions],
  });

  const result = await uploadDependencyCaches(codeql, features, config, logger);
@@ -444,7 +444,7 @@ test.serial(
    const logger = getRecordingLogger(messages);
    const features = createFeatures([]);
    const config = createTestConfig({
-      languages: [BuiltInLanguage.go],
+      languages: [KnownLanguage.go],
    });

    const makePatternCheckStub = sinon.stub(internal, "makePatternCheck");
@@ -457,7 +457,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.go);
+    t.is(result[0].language, KnownLanguage.go);
    t.is(result[0].result, CacheStoreResult.NoHash);
  },
 );
@@ -483,12 +483,12 @@ test.serial(
    const primaryCacheKey = await cacheKey(
      codeql,
      features,
-      BuiltInLanguage.csharp,
+      KnownLanguage.csharp,
      CSHARP_BASE_PATTERNS,
    );

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
      dependencyCachingRestoredKeys: [primaryCacheKey],
    });

@@ -499,7 +499,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.csharp);
+    t.is(result[0].language, KnownLanguage.csharp);
    t.is(result[0].result, CacheStoreResult.Duplicate);
  },
 );
@@ -525,7 +525,7 @@ test.serial(
    sinon.stub(cachingUtils, "getTotalCacheSize").resolves(0);

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
    });

    const result = await uploadDependencyCaches(
@@ -535,7 +535,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.csharp);
+    t.is(result[0].language, KnownLanguage.csharp);
    t.is(result[0].result, CacheStoreResult.Empty);

    checkExpectedLogMessages(t, messages, [
@@ -566,7 +566,7 @@ test.serial(
    sinon.stub(actionsCache, "saveCache").resolves();

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
    });

    const result = await uploadDependencyCaches(
@@ -576,7 +576,7 @@ test.serial(
      logger,
    );
    t.is(result.length, 1);
-    t.is(result[0].language, BuiltInLanguage.csharp);
+    t.is(result[0].language, KnownLanguage.csharp);
    t.is(result[0].result, CacheStoreResult.Stored);
    t.is(result[0].upload_size_bytes, 1024);

@@ -608,7 +608,7 @@ test.serial(
      .throws(new actionsCache.ReserveCacheError("Already in use"));

    const config = createTestConfig({
-      languages: [BuiltInLanguage.csharp],
+      languages: [KnownLanguage.csharp],
    });

    await t.notThrowsAsync(async () => {
@@ -619,7 +619,7 @@ test.serial(
        logger,
      );
      t.is(result.length, 1);
-      t.is(result[0].language, BuiltInLanguage.csharp);
+      t.is(result[0].language, KnownLanguage.csharp);
      t.is(result[0].result, CacheStoreResult.Duplicate);

      checkExpectedLogMessages(t, messages, ["Not uploading cache for"]);
@@ -647,7 +647,7 @@ test.serial("uploadDependencyCaches - throws other exceptions", async (t) => {
  sinon.stub(actionsCache, "saveCache").throws();

  const config = createTestConfig({
-    languages: [BuiltInLanguage.csharp],
+    languages: [KnownLanguage.csharp],
  });

  await t.throwsAsync(async () => {
@@ -659,7 +659,7 @@ test("getFeaturePrefix - returns empty string if no features are enabled", async
  const codeql = createStubCodeQL({});
  const features = createFeatures([]);

-  for (const knownLanguage of Object.values(BuiltInLanguage)) {
+  for (const knownLanguage of Object.values(KnownLanguage)) {
    const result = await getFeaturePrefix(codeql, features, knownLanguage);
    t.deepEqual(result, "", `Expected no feature prefix for ${knownLanguage}`);
  }
@@ -669,11 +669,7 @@ test("getFeaturePrefix - C# - returns prefix if CsharpNewCacheKey is enabled", a
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpNewCacheKey]);

-  const result = await getFeaturePrefix(
-    codeql,
-    features,
-    BuiltInLanguage.csharp,
-  );
+  const result = await getFeaturePrefix(codeql, features, KnownLanguage.csharp);
  t.notDeepEqual(result, "");
  t.assert(result.endsWith("-"));
  // Check the length of the prefix, which should correspond to `cacheKeyHashLength` + 1 for the trailing `-`.
@@ -684,9 +680,9 @@ test("getFeaturePrefix - non-C# - returns '' if CsharpNewCacheKey is enabled", a
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpNewCacheKey]);

-  for (const knownLanguage of Object.values(BuiltInLanguage)) {
+  for (const knownLanguage of Object.values(KnownLanguage)) {
    // Skip C# since we expect a result for it, which is tested in the previous test.
-    if (knownLanguage === BuiltInLanguage.csharp) {
+    if (knownLanguage === KnownLanguage.csharp) {
      continue;
    }
    const result = await getFeaturePrefix(codeql, features, knownLanguage);
@@ -698,11 +694,7 @@ test("getFeaturePrefix - C# - returns prefix if CsharpCacheBuildModeNone is enab
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpCacheBuildModeNone]);

-  const result = await getFeaturePrefix(
-    codeql,
-    features,
-    BuiltInLanguage.csharp,
-  );
+  const result = await getFeaturePrefix(codeql, features, KnownLanguage.csharp);
  t.notDeepEqual(result, "");
  t.assert(result.endsWith("-"));
  // Check the length of the prefix, which should correspond to `cacheKeyHashLength` + 1 for the trailing `-`.
@@ -713,9 +705,9 @@ test("getFeaturePrefix - non-C# - returns '' if CsharpCacheBuildModeNone is enab
  const codeql = createStubCodeQL({});
  const features = createFeatures([Feature.CsharpCacheBuildModeNone]);

-  for (const knownLanguage of Object.values(BuiltInLanguage)) {
+  for (const knownLanguage of Object.values(KnownLanguage)) {
    // Skip C# since we expect a result for it, which is tested in the previous test.
-    if (knownLanguage === BuiltInLanguage.csharp) {
+    if (knownLanguage === KnownLanguage.csharp) {
      continue;
    }
    const result = await getFeaturePrefix(codeql, features, knownLanguage);
@@ -11,7 +11,7 @@ import { CodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import { getErrorMessage, getRequiredEnvParam } from "./util";

@@ -541,7 +541,7 @@ export async function getFeaturePrefix(
    }
  };

-  if (language === BuiltInLanguage.csharp) {
+  if (language === KnownLanguage.csharp) {
    await addFeatureIfEnabled(Feature.CsharpNewCacheKey);
    await addFeatureIfEnabled(Feature.CsharpCacheBuildModeNone);
  }
@@ -72,13 +72,6 @@ let unwrittenDiagnostics: UnwrittenDiagnostic[] = [];
 */
 let unwrittenDefaultLanguageDiagnostics: DiagnosticMessage[] = [];

-/**
- * Counter used to generate a unique suffix for each diagnostic filename, so that
- * two diagnostics produced within the same millisecond do not overwrite each
- * other on disk.
- */
-let diagnosticCounter = 0;
-
 /**
 * Constructs a new diagnostic message with the specified id and name, as well as optional additional data.
 *
@@ -174,18 +167,10 @@ function writeDiagnostic(
    // Create the directory if it doesn't exist yet.
    mkdirSync(diagnosticsPath, { recursive: true });

-    // Include a monotonically increasing suffix to avoid filename collisions
-    // between diagnostics produced within the same millisecond.
-    const uniqueSuffix = (diagnosticCounter++).toString();
-    // We should only need to remove colons, but to be defensive, only allow a restricted set of
-    // characters.
-    const sanitizedTimestamp = diagnostic.timestamp.replace(
-      /[^a-zA-Z0-9.-]/g,
-      "",
-    );
    const jsonPath = path.resolve(
      diagnosticsPath,
-      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
+      // Remove colons from the timestamp as these are not allowed in Windows filenames.
+      `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}.json`,
    );

    writeFileSync(jsonPath, JSON.stringify(diagnostic));
@@ -5,16 +5,14 @@ import * as actionsUtil from "./actions-util";
 import type { PullRequestBranches } from "./actions-util";
 import * as apiClient from "./api-client";
 import {
-  getDiffInformedAnalysisBranches,
-  prepareDiffInformedAnalysis,
+  shouldPerformDiffInformedAnalysis,
  exportedForTesting,
 } from "./diff-informed-analysis-utils";
-import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
+import { Feature, initFeatures } from "./feature-flags";
 import { getRunnerLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
 import {
  setupTests,
-  createFeatures,
  mockCodeQLVersion,
  mockFeatureFlagApiEndpoint,
  setupActionsVars,
@@ -82,13 +80,13 @@ const testShouldPerformDiffInformedAnalysis = test.macro({
        .stub(actionsUtil, "getPullRequestBranches")
        .returns(testCase.pullRequestBranches);

-      const branches = await getDiffInformedAnalysisBranches(
+      const result = await shouldPerformDiffInformedAnalysis(
        codeql,
        features,
        logger,
      );

-      t.is(branches !== undefined, expectedResult);
+      t.is(result, expectedResult);

      delete process.env.CODEQL_ACTION_DIFF_INFORMED_QUERIES;

@@ -96,7 +94,7 @@ const testShouldPerformDiffInformedAnalysis = test.macro({
      getPullRequestBranchesStub.restore();
    });
  },
-  title: (_, title) => `getDiffInformedAnalysisBranches: ${title}`,
+  title: (_, title) => `shouldPerformDiffInformedAnalysis: ${title}`,
 });

 test.serial(
@@ -189,136 +187,11 @@ test.serial(
  false,
 );

-test.serial(
-  "prepareDiffInformedAnalysis: returns false when not a pull request",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
-      const codeql = mockCodeQLVersion("2.21.0");
-      const features = createFeatures([Feature.DiffInformedQueries]);
-
-      sinon.stub(actionsUtil, "getPullRequestBranches").returns(undefined);
-      sinon
-        .stub(apiClient, "getGitHubVersion")
-        .resolves({ type: GitHubVariant.DOTCOM });
-
-      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
-        logger,
-      );
-
-      t.false(result);
-    });
-  },
-);
-
-test.serial(
-  "prepareDiffInformedAnalysis: returns false when applicability check throws",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
-      const codeql = mockCodeQLVersion("2.21.0");
-      // A features implementation whose getValue rejects, simulating an
-      // unexpected failure when determining whether diff-informed analysis
-      // should run.
-      const features: FeatureEnablement = {
-        getDefaultCliVersion: async () => {
-          throw new Error("not implemented");
-        },
-        getValue: async () => {
-          throw new Error("feature flag lookup failed");
-        },
-      };
-
-      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
-        logger,
-      );
-
-      t.false(result);
-    });
-  },
-);
-
-test.serial(
-  "prepareDiffInformedAnalysis: returns true when the diff is fetched successfully",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
-      const codeql = mockCodeQLVersion("2.21.0");
-      const features = createFeatures([Feature.DiffInformedQueries]);
-
-      sinon
-        .stub(actionsUtil, "getPullRequestBranches")
-        .returns({ base: "main", head: "feature" });
-      sinon
-        .stub(apiClient, "getGitHubVersion")
-        .resolves({ type: GitHubVariant.DOTCOM });
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-      sinon.stub(apiClient, "getApiClient").returns({
-        rest: {
-          repos: {
-            compareCommitsWithBasehead: sinon
-              .stub()
-              .resolves({ data: { files: [] } }),
-          },
-        },
-      } as any);
-
-      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
-        logger,
-      );
-
-      t.true(result);
-    });
-  },
-);
-
-test.serial(
-  "prepareDiffInformedAnalysis: returns false when the diff API call fails",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
-      const codeql = mockCodeQLVersion("2.21.0");
-      const features = createFeatures([Feature.DiffInformedQueries]);
-
-      sinon
-        .stub(actionsUtil, "getPullRequestBranches")
-        .returns({ base: "main", head: "feature" });
-      sinon
-        .stub(apiClient, "getGitHubVersion")
-        .resolves({ type: GitHubVariant.DOTCOM });
-      const notFoundError: any = new Error("Not Found");
-      notFoundError.status = 404;
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-      sinon.stub(apiClient, "getApiClient").returns({
-        rest: {
-          repos: {
-            compareCommitsWithBasehead: sinon.stub().rejects(notFoundError),
-          },
-        },
-      } as any);
-
-      const result = await prepareDiffInformedAnalysis(
-        codeql,
-        features,
-        logger,
-      );
-
-      t.false(result);
-    });
-  },
-);
-
 function runGetDiffRanges(changes: number, patch: string[] | undefined): any {
+  sinon
+    .stub(actionsUtil, "getRequiredInput")
+    .withArgs("checkout_path")
+    .returns("/checkout/path");
  return exportedForTesting.getDiffRanges(
    {
      filename: "test.txt",
@@ -338,7 +211,7 @@ test.serial("getDiffRanges: file diff too large", async (t) => {
  const diffRanges = runGetDiffRanges(1000000, undefined);
  t.deepEqual(diffRanges, [
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 0,
      endLine: 0,
    },
@@ -361,7 +234,7 @@ test.serial(
    ]);
    t.deepEqual(diffRanges, [
      {
-        path: "test.txt",
+        path: "/checkout/path/test.txt",
        startLine: 53,
        endLine: 54,
      },
@@ -401,7 +274,7 @@ test.serial("getDiffRanges: diff thunk with single update range", async (t) => {
  ]);
  t.deepEqual(diffRanges, [
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 53,
      endLine: 53,
    },
@@ -423,12 +296,12 @@ test.serial("getDiffRanges: diff thunk with addition ranges", async (t) => {
  ]);
  t.deepEqual(diffRanges, [
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 53,
      endLine: 53,
    },
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 55,
      endLine: 55,
    },
@@ -455,12 +328,12 @@ test.serial("getDiffRanges: diff thunk with mixed ranges", async (t) => {
  ]);
  t.deepEqual(diffRanges, [
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 54,
      endLine: 54,
    },
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 57,
      endLine: 58,
    },
@@ -490,12 +363,12 @@ test.serial("getDiffRanges: multiple diff thunks", async (t) => {
  ]);
  t.deepEqual(diffRanges, [
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 53,
      endLine: 54,
    },
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 153,
      endLine: 154,
    },
@@ -506,7 +379,7 @@ test.serial("getDiffRanges: no diff context lines", async (t) => {
  const diffRanges = runGetDiffRanges(2, ["@@ -30 +50,2 @@", "+1", "+2"]);
  t.deepEqual(diffRanges, [
    {
-      path: "test.txt",
+      path: "/checkout/path/test.txt",
      startLine: 50,
      endLine: 51,
    },
@@ -1,13 +1,14 @@
 import * as fs from "fs";
+import * as path from "path";

 import * as actionsUtil from "./actions-util";
 import type { PullRequestBranches } from "./actions-util";
 import { getApiClient, getGitHubVersion } from "./api-client";
 import type { CodeQL } from "./codeql";
 import { Feature, FeatureEnablement } from "./feature-flags";
-import { Logger, withGroupAsync } from "./logging";
+import { Logger } from "./logging";
 import { getRepositoryNwoFromEnv } from "./repository";
-import { getErrorMessage, GitHubVariant, satisfiesGHESVersion } from "./util";
+import { GitHubVariant, satisfiesGHESVersion } from "./util";

 /**
 * This interface is an abbreviated version of the file diff object returned by
@@ -21,6 +22,20 @@ interface FileDiff {
  patch?: string | undefined;
 }

+/**
+ * Check if the action should perform diff-informed analysis.
+ */
+export async function shouldPerformDiffInformedAnalysis(
+  codeql: CodeQL,
+  features: FeatureEnablement,
+  logger: Logger,
+): Promise<boolean> {
+  return (
+    (await getDiffInformedAnalysisBranches(codeql, features, logger)) !==
+    undefined
+  );
+}
+
 /**
 * Get the branches to use for diff-informed analysis.
 *
@@ -55,59 +70,22 @@ export async function getDiffInformedAnalysisBranches(
  return branches;
 }

-/**
- * Prepares the diff ranges needed for diff-informed analysis for the current
- * run.
- *
- * @returns `true` if the diff ranges were successfully computed and persisted
- *   and are therefore available for use, `false` otherwise.
- */
-export async function prepareDiffInformedAnalysis(
-  codeql: CodeQL,
-  features: FeatureEnablement,
-  logger: Logger,
-): Promise<boolean> {
-  let branches: PullRequestBranches | undefined;
-  try {
-    branches = await getDiffInformedAnalysisBranches(codeql, features, logger);
-  } catch (e) {
-    // If we cannot determine whether diff-informed analysis applies (for
-    // example, because a feature-flag lookup failed), treat it as not
-    // applicable rather than triggering the overlay fallback.
-    logger.warning(
-      `Failed to determine branch information for diff-informed analysis: ${getErrorMessage(e)}`,
-    );
-    return false;
-  }
-  if (!branches) {
-    return false;
-  }
-
-  return await withGroupAsync("Computing PR diff ranges", async () => {
-    try {
-      return await computeAndPersistDiffRanges(branches, logger);
-    } catch (e) {
-      logger.warning(
-        `Failed to compute diff-informed analysis ranges: ${getErrorMessage(e)}`,
-      );
-      return false;
-    }
-  });
-}
-
 export interface DiffThunkRange {
-  /** Relative path from the repository root, using forward slashes as separators. */
  path: string;
  startLine: number;
  endLine: number;
 }

+function getDiffRangesJsonFilePath(): string {
+  return path.join(actionsUtil.getTemporaryDirectory(), "pr-diff-range.json");
+}
+
 export function writeDiffRangesJsonFile(
  logger: Logger,
  ranges: DiffThunkRange[],
 ): void {
  const jsonContents = JSON.stringify(ranges, null, 2);
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
+  const jsonFilePath = getDiffRangesJsonFilePath();
  fs.writeFileSync(jsonFilePath, jsonContents);
  logger.debug(
    `Wrote pr-diff-range JSON file to ${jsonFilePath}:\n${jsonContents}`,
@@ -117,7 +95,7 @@ export function writeDiffRangesJsonFile(
 export function readDiffRangesJsonFile(
  logger: Logger,
 ): DiffThunkRange[] | undefined {
-  const jsonFilePath = actionsUtil.getDiffRangesJsonFilePath();
+  const jsonFilePath = getDiffRangesJsonFilePath();
  if (!fs.existsSync(jsonFilePath)) {
    logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`);
    return undefined;
@@ -126,14 +104,7 @@ export function readDiffRangesJsonFile(
  logger.debug(
    `Read pr-diff-range JSON file from ${jsonFilePath}:\n${jsonContents}`,
  );
-  try {
-    return JSON.parse(jsonContents) as DiffThunkRange[];
-  } catch (e) {
-    logger.warning(
-      `Failed to parse diff ranges JSON file at ${jsonFilePath}: ${e}`,
-    );
-    return undefined;
-  }
+  return JSON.parse(jsonContents) as DiffThunkRange[];
 }

 /**
@@ -141,9 +112,8 @@ export function readDiffRangesJsonFile(
 *
 * @param branches The base and head branches of the pull request.
 * @param logger
- * @returns An array of tuples, where each tuple contains the relative path of a
- * file (relative to the repository root, as returned by the GitHub compare API),
- * the start line and the end line (both 1-based and inclusive) of an
+ * @returns An array of tuples, where each tuple contains the absolute path of a
+ * file, the start line and the end line (both 1-based and inclusive) of an
 * added or modified range in that file. Returns `undefined` if the action was
 * not triggered by a pull request or if there was an error.
 */
@@ -177,33 +147,6 @@ export async function getPullRequestEditedDiffRanges(
  return results;
 }

-/**
- * Compute and persist the diff ranges for a pull request. This fetches the
- * diff from the GitHub API and writes it to the diff ranges JSON file so that
- * CodeQL can use it for diff-informed analysis.
- *
- * @param branches The base and head branches of the pull request, as returned
- *   by `getDiffInformedAnalysisBranches`.
- * @param logger
- * @returns `true` if the diff ranges were successfully computed and persisted,
- *   otherwise `false`.
- */
-export async function computeAndPersistDiffRanges(
-  branches: PullRequestBranches,
-  logger: Logger,
-): Promise<boolean> {
-  const ranges = await getPullRequestEditedDiffRanges(branches, logger);
-  if (ranges === undefined) {
-    return false;
-  }
-  writeDiffRangesJsonFile(logger, ranges);
-  const distinctFiles = new Set(ranges.map((r) => r.path)).size;
-  logger.info(
-    `Persisted ${ranges.length} diff range(s) across ${distinctFiles} file(s).`,
-  );
-  return true;
-}
-
 async function getFileDiffsWithBasehead(
  branches: PullRequestBranches,
  logger: Logger,
@@ -248,6 +191,13 @@ function getDiffRanges(
  fileDiff: FileDiff,
  logger: Logger,
 ): DiffThunkRange[] | undefined {
+  // Diff-informed queries expect the file path to be absolute. CodeQL always
+  // uses forward slashes as the path separator, so on Windows we need to
+  // replace any backslashes with forward slashes.
+  const filename = path
+    .join(actionsUtil.getRequiredInput("checkout_path"), fileDiff.filename)
+    .replaceAll(path.sep, "/");
+
  if (fileDiff.patch === undefined) {
    if (fileDiff.changes === 0) {
      // There are situations where a changed file legitimately has no diff.
@@ -262,7 +212,7 @@ function getDiffRanges(
    // to a special diff range that covers the entire file.
    return [
      {
-        path: fileDiff.filename,
+        path: filename,
        startLine: 0,
        endLine: 0,
      },
@@ -297,7 +247,7 @@ function getDiffRanges(
      // Any line that does not start with a "+" or "-" terminates the current
      // range of added lines.
      diffRanges.push({
-        path: fileDiff.filename,
+        path: filename,
        startLine: additionRangeStartLine,
        endLine: currentLine - 1,
      });
@@ -8,7 +8,6 @@ export enum DocUrl {
  CODEQL_BUILD_MODES = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes",
  DEFINE_ENV_VARIABLES = "https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow",
  DELETE_ACTIONS_CACHE_ENTRIES = "https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manage-caches#deleting-cache-entries",
-  PRIVATE_REGISTRY_LOGS = "https://docs.github.com/en/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries",
  SCANNING_ON_PUSH = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scanning-on-push",
  SPECIFY_BUILD_STEPS_MANUALLY = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually",
  SYSTEM_REQUIREMENTS = "https://codeql.github.com/docs/codeql-overview/system-requirements/",
@@ -9,7 +9,6 @@ import * as defaults from "./defaults.json";
 import { Logger } from "./logging";
 import {
  CODEQL_OVERLAY_MINIMUM_VERSION,
-  CODEQL_OVERLAY_MINIMUM_VERSION_CPP,
  CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP,
  CODEQL_OVERLAY_MINIMUM_VERSION_GO,
  CODEQL_OVERLAY_MINIMUM_VERSION_JAVA,
@@ -58,18 +57,18 @@ export enum Feature {
  IgnoreGeneratedFiles = "ignore_generated_files",
  JavaNetworkDebugging = "java_network_debugging",
  OverlayAnalysis = "overlay_analysis",
-  OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
  OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
  OverlayAnalysisCodeScanningGo = "overlay_analysis_code_scanning_go",
  OverlayAnalysisCodeScanningJava = "overlay_analysis_code_scanning_java",
  OverlayAnalysisCodeScanningJavascript = "overlay_analysis_code_scanning_javascript",
  OverlayAnalysisCodeScanningPython = "overlay_analysis_code_scanning_python",
  OverlayAnalysisCodeScanningRuby = "overlay_analysis_code_scanning_ruby",
-  OverlayAnalysisCpp = "overlay_analysis_cpp",
  OverlayAnalysisCsharp = "overlay_analysis_csharp",
-  /** Disable TRAP caching when overlay analysis is enabled. */
-  OverlayAnalysisDisableTrapCaching = "overlay_analysis_disable_trap_caching",
  OverlayAnalysisGo = "overlay_analysis_go",
+  /** Controls whether the Actions cache is checked for overlay build outcomes. */
+  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
+  /** Controls whether overlay build failures on are stored in the Actions cache. */
+  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
  OverlayAnalysisJava = "overlay_analysis_java",
  OverlayAnalysisJavascript = "overlay_analysis_javascript",
  OverlayAnalysisPython = "overlay_analysis_python",
@@ -81,10 +80,7 @@ export enum Feature {
  OverlayAnalysisRuby = "overlay_analysis_ruby",
  /** Controls whether hardware checks are skipped for overlay analysis. */
  OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks",
-  /** Controls whether the Actions cache is checked for overlay build outcomes. */
-  OverlayAnalysisStatusCheck = "overlay_analysis_status_check",
-  /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
-  OverlayAnalysisStatusSave = "overlay_analysis_status_save",
+  PythonDefaultIsToNotExtractStdlib = "python_default_is_to_not_extract_stdlib",
  QaTelemetryEnabled = "qa_telemetry_enabled",
  /** Note that this currently only disables baseline file coverage information. */
  SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
@@ -201,11 +197,6 @@ export const featureConfig = {
  // Per-language overlay feature flags. Each has minimumVersion set to the
  // minimum CLI version that supports overlay analysis for that language.
  // Only languages that are GA or in staff-ship should have feature flags here.
-  [Feature.OverlayAnalysisCodeScanningCpp]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
-    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CPP,
-  },
  [Feature.OverlayAnalysisCodeScanningCsharp]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
@@ -236,11 +227,6 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY,
  },
-  [Feature.OverlayAnalysisCpp]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
-    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_CPP,
-  },
  [Feature.OverlayAnalysisCsharp]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
@@ -251,6 +237,16 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_GO,
  },
+  [Feature.OverlayAnalysisStatusCheck]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK",
+    minimumVersion: undefined,
+  },
+  [Feature.OverlayAnalysisStatusSave]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
+    minimumVersion: undefined,
+  },
  [Feature.OverlayAnalysisJava]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
@@ -266,37 +262,27 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_PYTHON,
  },
-  [Feature.OverlayAnalysisRuby]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
-    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY,
-  },
-  // Other overlay-related feature flags
-  [Feature.OverlayAnalysisDisableTrapCaching]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
-    minimumVersion: undefined,
-  },
  [Feature.OverlayAnalysisResourceChecksV2]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2",
    minimumVersion: undefined,
  },
-  [Feature.OverlayAnalysisStatusCheck]: {
+  [Feature.OverlayAnalysisRuby]: {
    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK",
-    minimumVersion: undefined,
-  },
-  [Feature.OverlayAnalysisStatusSave]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_SAVE",
-    minimumVersion: undefined,
+    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
+    minimumVersion: CODEQL_OVERLAY_MINIMUM_VERSION_RUBY,
  },
  [Feature.OverlayAnalysisSkipResourceChecks]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS",
    minimumVersion: undefined,
  },
+  [Feature.PythonDefaultIsToNotExtractStdlib]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
+    minimumVersion: undefined,
+    toolsFeature: ToolsFeature.PythonDefaultIsToNotExtractStdlib,
+  },
  [Feature.QaTelemetryEnabled]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -4,7 +4,7 @@ import * as sinon from "sinon";
 import * as api from "../api-client";
 import { getRunnerLogger } from "../logging";
 import { parseRepositoryNwo } from "../repository";
-import { RecordingLogger, setupTests } from "../testing-utils";
+import { setupTests } from "../testing-utils";

 import * as properties from "./properties";

@@ -197,38 +197,3 @@ test.serial(
    );
  },
 );
-
-test.serial(
-  "loadPropertiesFromApi warns if a repository property name starts with the common prefix, but is not recognised by us",
-  async (t) => {
-    process.env["GITHUB_EVENT_NAME"] = "push";
-    const propertyName: string = `${properties.GITHUB_CODEQL_PROPERTY_PREFIX}unknown`;
-    sinon.stub(api, "getRepositoryProperties").resolves({
-      headers: {},
-      status: 200,
-      url: "",
-      data: [
-        {
-          property_name: propertyName,
-          value: "true",
-        },
-      ] satisfies properties.GitHubPropertiesResponse,
-    });
-    const logger = new RecordingLogger();
-    const warningSpy = sinon.spy(logger, "warning");
-    const mockRepositoryNwo = parseRepositoryNwo("owner/repo");
-    const response = await properties.loadPropertiesFromApi(
-      logger,
-      mockRepositoryNwo,
-    );
-    t.deepEqual(response, {});
-    t.true(warningSpy.calledOnce);
-    t.assert(
-      warningSpy.firstCall.args[0]
-        .toString()
-        .startsWith(
-          `Found repository properties ('${propertyName}'), which look like CodeQL Action repository properties`,
-        ),
-    );
-  },
-);
@@ -1,11 +1,7 @@
-import { isDynamicWorkflow } from "../actions-util";
 import { getRepositoryProperties } from "../api-client";
 import { Logger } from "../logging";
 import { RepositoryNwo } from "../repository";

-/** The common prefix that we expect all of our repository properties to have. */
-export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-";
-
 /**
 * Enumerates repository property names that have some meaning to us.
 */
@@ -118,8 +114,6 @@ export async function loadPropertiesFromApi(
    );

    const properties: RepositoryProperties = {};
-    const unrecognisedProperties: string[] = [];
-
    for (const property of remoteProperties) {
      if (property.property_name === undefined) {
        throw new Error(
@@ -129,11 +123,6 @@ export async function loadPropertiesFromApi(

      if (isKnownPropertyName(property.property_name)) {
        setProperty(properties, property.property_name, property.value, logger);
-      } else if (
-        property.property_name.startsWith(GITHUB_CODEQL_PROPERTY_PREFIX) &&
-        !isDynamicWorkflow()
-      ) {
-        unrecognisedProperties.push(property.property_name);
      }
    }

@@ -150,20 +139,6 @@ export async function loadPropertiesFromApi(
      }
    }

-    // Emit a warning if we encountered unrecognised properties that have our prefix.
-    if (unrecognisedProperties.length > 0) {
-      const unrecognisedPropertyList = unrecognisedProperties
-        .map((name) => `'${name}'`)
-        .join(", ");
-
-      logger.warning(
-        `Found repository properties (${unrecognisedPropertyList}), ` +
-          "which look like CodeQL Action repository properties, " +
-          "but which are not understood by this version of the CodeQL Action. " +
-          "Do you need to update to a newer version?",
-      );
-    }
-
    return properties;
  } catch (e) {
    throw new Error(
@@ -4,7 +4,6 @@ import path from "path";
 import Long from "long";

 import { DocUrl } from "./doc-url";
-import * as json from "./json";
 import { Logger } from "./logging";
 import type * as sarif from "./sarif";

@@ -190,7 +189,7 @@ export function resolveUriToFile(
      typeof location.index !== "number" ||
      location.index < 0 ||
      location.index >= artifacts.length ||
-      !json.isObject(artifacts[location.index].location)
+      typeof artifacts[location.index].location !== "object"
    ) {
      logger.debug(`Ignoring location as index "${location.index}" is invalid`);
      return undefined;
@@ -343,142 +343,75 @@ test.serial("decodeGitFilePath quoted strings", async (t) => {
  );
 });

-test.serial(
-  "getFileOidsUnderPath uses --recurse-submodules when submodules exist",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      fs.writeFileSync(path.join(tmpDir, ".gitmodules"), "");
-      const runGitCommandStub = sinon
-        .stub(gitUtils as any, "runGitCommand")
-        .callsFake(async (_cwd: any, args: any) => {
-          if (args[0] === "rev-parse") {
-            return `${tmpDir}\n`;
-          }
-          return (
-            "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
-            "100644 d89514599a9a99f22b4085766d40af7b99974827 0\tlib/git-utils.js.map\n" +
-            "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts"
-          );
-        });
+test.serial("getFileOidsUnderPath returns correct file mapping", async (t) => {
+  const runGitCommandStub = sinon
+    .stub(gitUtils as any, "runGitCommand")
+    .resolves(
+      "30d998ded095371488be3a729eb61d86ed721a18_lib/git-utils.js\n" +
+        "d89514599a9a99f22b4085766d40af7b99974827_lib/git-utils.js.map\n" +
+        "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96_src/git-utils.ts",
+    );

-      const result = await gitUtils.getFileOidsUnderPath("/fake/path");
+  const result = await gitUtils.getFileOidsUnderPath("/fake/path");

-      t.deepEqual(result, {
-        "lib/git-utils.js": "30d998ded095371488be3a729eb61d86ed721a18",
-        "lib/git-utils.js.map": "d89514599a9a99f22b4085766d40af7b99974827",
-        "src/git-utils.ts": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
-      });
+  t.deepEqual(result, {
+    "lib/git-utils.js": "30d998ded095371488be3a729eb61d86ed721a18",
+    "lib/git-utils.js.map": "d89514599a9a99f22b4085766d40af7b99974827",
+    "src/git-utils.ts": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
+  });

-      // Second call (after getGitRoot) should include --recurse-submodules
-      t.deepEqual(runGitCommandStub.secondCall.args[1], [
-        "ls-files",
-        "--recurse-submodules",
-        "--stage",
-      ]);
-    });
-  },
-);
-
-test.serial(
-  "getFileOidsUnderPath omits --recurse-submodules when no submodules exist",
-  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      const runGitCommandStub = sinon
-        .stub(gitUtils as any, "runGitCommand")
-        .callsFake(async (_cwd: any, args: any) => {
-          if (args[0] === "rev-parse") {
-            return `${tmpDir}\n`;
-          }
-          return (
-            "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
-            "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts"
-          );
-        });
-
-      const result = await gitUtils.getFileOidsUnderPath("/fake/path");
-
-      t.deepEqual(result, {
-        "lib/git-utils.js": "30d998ded095371488be3a729eb61d86ed721a18",
-        "src/git-utils.ts": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
-      });
-
-      // Second call (after getGitRoot) should NOT include --recurse-submodules
-      t.deepEqual(runGitCommandStub.secondCall.args[1], [
-        "ls-files",
-        "--stage",
-      ]);
-    });
-  },
-);
+  t.deepEqual(runGitCommandStub.firstCall.args, [
+    "/fake/path",
+    ["ls-files", "--recurse-submodules", "--format=%(objectname)_%(path)"],
+    "Cannot list Git OIDs of tracked files.",
+  ]);
+});

 test.serial("getFileOidsUnderPath handles quoted paths", async (t) => {
-  await withTmpDir(async (tmpDir) => {
-    sinon
-      .stub(gitUtils as any, "runGitCommand")
-      .callsFake(async (_cwd: any, args: any) => {
-        if (args[0] === "rev-parse") {
-          return `${tmpDir}\n`;
-        }
-        return (
-          "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/normal-file.js\n" +
-          '100644 d89514599a9a99f22b4085766d40af7b99974827 0\t"lib/file with spaces.js"\n' +
-          '100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\t"lib/file\\twith\\ttabs.js"'
-        );
-      });
+  sinon
+    .stub(gitUtils as any, "runGitCommand")
+    .resolves(
+      "30d998ded095371488be3a729eb61d86ed721a18_lib/normal-file.js\n" +
+        'd89514599a9a99f22b4085766d40af7b99974827_"lib/file with spaces.js"\n' +
+        'a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96_"lib/file\\twith\\ttabs.js"',
+    );

-    const result = await gitUtils.getFileOidsUnderPath("/fake/path");
+  const result = await gitUtils.getFileOidsUnderPath("/fake/path");

-    t.deepEqual(result, {
-      "lib/normal-file.js": "30d998ded095371488be3a729eb61d86ed721a18",
-      "lib/file with spaces.js": "d89514599a9a99f22b4085766d40af7b99974827",
-      "lib/file\twith\ttabs.js": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
-    });
+  t.deepEqual(result, {
+    "lib/normal-file.js": "30d998ded095371488be3a729eb61d86ed721a18",
+    "lib/file with spaces.js": "d89514599a9a99f22b4085766d40af7b99974827",
+    "lib/file\twith\ttabs.js": "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96",
  });
 });

 test.serial("getFileOidsUnderPath handles empty output", async (t) => {
-  await withTmpDir(async (tmpDir) => {
-    sinon
-      .stub(gitUtils as any, "runGitCommand")
-      .callsFake(async (_cwd: any, args: any) => {
-        if (args[0] === "rev-parse") {
-          return `${tmpDir}\n`;
-        }
-        return "";
-      });
+  sinon.stub(gitUtils as any, "runGitCommand").resolves("");

-    const result = await gitUtils.getFileOidsUnderPath("/fake/path");
-    t.deepEqual(result, {});
-  });
+  const result = await gitUtils.getFileOidsUnderPath("/fake/path");
+  t.deepEqual(result, {});
 });

 test.serial(
  "getFileOidsUnderPath throws on unexpected output format",
  async (t) => {
-    await withTmpDir(async (tmpDir) => {
-      sinon
-        .stub(gitUtils as any, "runGitCommand")
-        .callsFake(async (_cwd: any, args: any) => {
-          if (args[0] === "rev-parse") {
-            return `${tmpDir}\n`;
-          }
-          return (
-            "100644 30d998ded095371488be3a729eb61d86ed721a18 0\tlib/git-utils.js\n" +
-            "invalid-line-format\n" +
-            "100644 a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96 0\tsrc/git-utils.ts"
-          );
-        });
-
-      await t.throwsAsync(
-        async () => {
-          await gitUtils.getFileOidsUnderPath("/fake/path");
-        },
-        {
-          instanceOf: Error,
-          message: 'Unexpected "git ls-files" output: invalid-line-format',
-        },
+    sinon
+      .stub(gitUtils as any, "runGitCommand")
+      .resolves(
+        "30d998ded095371488be3a729eb61d86ed721a18_lib/git-utils.js\n" +
+          "invalid-line-format\n" +
+          "a47c11f5bfdca7661942d2c8f1b7209fb0dfdf96_src/git-utils.ts",
      );
-    });
+
+    await t.throwsAsync(
+      async () => {
+        await gitUtils.getFileOidsUnderPath("/fake/path");
+      },
+      {
+        instanceOf: Error,
+        message: 'Unexpected "git ls-files" output: invalid-line-format',
+      },
+    );
  },
 );

@@ -1,6 +1,4 @@
-import * as fs from "fs";
 import * as os from "os";
-import * as path from "path";

 import * as core from "@actions/core";
 import { ExecOptions } from "@actions/exec";
@@ -16,11 +14,10 @@ import {
 import { ConfigurationError, getRequiredEnvParam } from "./util";

 /**
- * Minimum Git version required for overlay analysis in repositories that
- * contain submodules. Support for using the `git ls-files
- * --recurse-submodules` option with `--stage` was added in Git 2.36.0.
+ * Minimum Git version required for overlay analysis. The `git ls-files --format`
+ * option, which is used by `getFileOidsUnderPath`, was introduced in Git 2.38.0.
 */
-export const GIT_MINIMUM_VERSION_FOR_OVERLAY_WITH_SUBMODULES = "2.36.0";
+export const GIT_MINIMUM_VERSION_FOR_OVERLAY = "2.38.0";

 /**
 * Git version information
@@ -247,16 +244,6 @@ export const getGitRoot = async function (
  }
 };

-/**
- * Returns true if the Git repository has submodules registered (i.e. a
- * `.gitmodules` file exists at the repository root).
- *
- * @param gitRoot The root of the Git repository.
- */
-export function hasSubmodules(gitRoot: string): boolean {
-  return fs.existsSync(path.join(gitRoot, ".gitmodules"));
-}
-
 /**
 * Returns the Git OIDs of all tracked files (in the index and in the working
 * tree) that are under the given base path, including files in active
@@ -265,45 +252,31 @@ export function hasSubmodules(gitRoot: string): boolean {
 *
 * @param basePath A path into the Git repository.
 * @returns a map from file paths (relative to `basePath`) to Git OIDs.
- * @throws {Error} if "git ls-files" produces unexpected output.
+ * @throws {Error} if "git ls-tree" produces unexpected output.
 */
 export const getFileOidsUnderPath = async function (
  basePath: string,
 ): Promise<{ [key: string]: string }> {
  // Without the --full-name flag, the path is relative to the current working
  // directory of the git command, which is basePath.
-  //
-  // We use --stage rather than --format here because --format was only
-  // introduced in Git 2.38.0, which would limit overlay rollout.
-  //
-  // We only pass --recurse-submodules when the repository actually has
-  // submodules, because the combination of --recurse-submodules and --stage is
-  // only supported since Git 2.36.0.
-  const gitRoot = await getGitRoot(basePath);
-  const mayHaveSubmodules =
-    gitRoot === undefined ? true : hasSubmodules(gitRoot);
-  const args = mayHaveSubmodules
-    ? ["ls-files", "--recurse-submodules", "--stage"]
-    : ["ls-files", "--stage"];
  const stdout = await runGitCommand(
    basePath,
-    args,
+    ["ls-files", "--recurse-submodules", "--format=%(objectname)_%(path)"],
    "Cannot list Git OIDs of tracked files.",
  );

  const fileOidMap: { [key: string]: string } = {};
-  // With --stage, the output is a list of lines like:
-  // 100644 4c51bc1d9e86cd86e01b0f340cb8ce095c33b283 0\tsrc/git-utils.test.ts
-  // 100644 6b792ea543ce75d7a8a03df591e3c85311ecb64f 0\tsrc/git-utils.ts
-  // The fields are: <mode> <oid> <stage>\t<path>
-  const regex = /^[0-9]+ ([0-9a-f]{40}) [0-9]+\t(.+)$/;
+  // With --format=%(objectname)_%(path), the output is a list of lines like:
+  // 30d998ded095371488be3a729eb61d86ed721a18_lib/git-utils.js
+  // d89514599a9a99f22b4085766d40af7b99974827_lib/git-utils.js.map
+  const regex = /^([0-9a-f]{40})_(.+)$/;
  for (const line of stdout.split("\n")) {
    if (line) {
      const match = line.match(regex);
      if (match) {
        const oid = match[1];
-        const filePath = decodeGitFilePath(match[2]);
-        fileOidMap[filePath] = oid;
+        const path = decodeGitFilePath(match[2]);
+        fileOidMap[path] = oid;
      } else {
        throw new Error(`Unexpected "git ls-files" output: ${line}`);
      }
@@ -12,7 +12,7 @@ import { EnvVar } from "./environment";
 import { Feature } from "./feature-flags";
 import * as initActionPostHelper from "./init-action-post-helper";
 import { getRunnerLogger } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import * as overlayStatus from "./overlay/status";
 import { parseRepositoryNwo } from "./repository";
 import {
@@ -21,7 +21,7 @@ import * as dependencyCaching from "./dependency-caching";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import {
  createOverlayStatus,
  OverlayStatus,
@@ -53,13 +53,13 @@ import {
  initConfig,
  runDatabaseInitCluster,
 } from "./init";
-import { JavaEnvVars, BuiltInLanguage } from "./languages";
-import { getActionsLogger, Logger, withGroupAsync } from "./logging";
+import { JavaEnvVars, KnownLanguage } from "./languages";
+import { getActionsLogger, Logger } from "./logging";
 import {
  downloadOverlayBaseDatabaseFromCache,
  OverlayBaseDatabaseDownloadStats,
-} from "./overlay/caching";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+  OverlayDatabaseMode,
+} from "./overlay";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -88,6 +88,7 @@ import {
  getRequiredEnvParam,
  getThreadsFlagValue,
  initializeEnvironment,
+  isHostedRunner,
  ConfigurationError,
  wrapError,
  checkActionVersion,
@@ -325,7 +326,7 @@ async function run(startedAt: Date) {
      // requested rust - don't enable it via language autodetection.
      configUtils
        .getRawLanguagesNoAutodetect(getOptionalInput("languages"))
-        .includes(BuiltInLanguage.rust)
+        .includes(KnownLanguage.rust)
    ) {
      const experimental = "2.19.3";
      const publicPreview = "2.22.1";
@@ -361,6 +362,7 @@ async function run(startedAt: Date) {
      configFile,
      dbLocation: getOptionalInput("db-location"),
      configInput: getOptionalInput("config"),
+      trapCachingEnabled: getTrapCachingEnabled(),
      dependencyCachingEnabled: getDependencyCachingEnabled(),
      // Debug mode is enabled if:
      // - The `init` Action is passed `debug: true`.
@@ -384,15 +386,6 @@ async function run(startedAt: Date) {
      logger,
    });

-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
-
    if (repositoryPropertiesResult.isFailure()) {
      addNoLanguageDiagnostic(
        config,
@@ -459,23 +452,18 @@ async function run(startedAt: Date) {
      // necessary preparations. So, in that mode, we would assume that
      // everything is in order and let the analysis fail if that turns out not
      // to be the case.
-      await withGroupAsync(
-        "Checking cache for overlay-base database",
-        async () => {
-          overlayBaseDatabaseStats = await downloadOverlayBaseDatabaseFromCache(
-            codeql,
-            config,
-            logger,
-          );
-          if (!overlayBaseDatabaseStats) {
-            config.overlayDatabaseMode = OverlayDatabaseMode.None;
-            logger.info(
-              "No overlay-base database found in cache, " +
-                `reverting overlay database mode to ${OverlayDatabaseMode.None}.`,
-            );
-          }
-        },
+      overlayBaseDatabaseStats = await downloadOverlayBaseDatabaseFromCache(
+        codeql,
+        config,
+        logger,
      );
+      if (!overlayBaseDatabaseStats) {
+        config.overlayDatabaseMode = OverlayDatabaseMode.None;
+        logger.info(
+          "No overlay-base database found in cache, " +
+            `reverting overlay database mode to ${OverlayDatabaseMode.None}.`,
+        );
+      }
    }

    if (config.overlayDatabaseMode !== OverlayDatabaseMode.Overlay) {
@@ -508,7 +496,16 @@ async function run(startedAt: Date) {
    }

    if (
-      config.languages.includes(BuiltInLanguage.go) &&
+      config.languages.includes(KnownLanguage.swift) &&
+      process.platform === "linux"
+    ) {
+      logger.warning(
+        `Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you.`,
+      );
+    }
+
+    if (
+      config.languages.includes(KnownLanguage.go) &&
      process.platform === "linux"
    ) {
      try {
@@ -566,7 +563,7 @@ async function run(startedAt: Date) {
        if (e instanceof FileCmdNotFoundError) {
          addDiagnostic(
            config,
-            BuiltInLanguage.go,
+            KnownLanguage.go,
            makeDiagnostic(
              "go/workflow/file-program-unavailable",
              "The `file` program is required on Linux, but does not appear to be installed",
@@ -616,6 +613,24 @@ async function run(startedAt: Date) {
      core.exportVariable(kotlinLimitVar, "2.1.20");
    }

+    if (config.languages.includes(KnownLanguage.cpp)) {
+      const envVar = "CODEQL_EXTRACTOR_CPP_TRAP_CACHING";
+      if (process.env[envVar]) {
+        logger.info(
+          `Environment variable ${envVar} already set. Not en/disabling CodeQL C++ TRAP caching support`,
+        );
+      } else if (
+        getTrapCachingEnabled() &&
+        (await codeQlVersionAtLeast(codeql, "2.17.5"))
+      ) {
+        logger.info("Enabling CodeQL C++ TRAP caching support");
+        core.exportVariable(envVar, "true");
+      } else {
+        logger.info("Disabling CodeQL C++ TRAP caching support");
+        core.exportVariable(envVar, "false");
+      }
+    }
+
    // Restore dependency cache(s), if they exist.
    if (shouldRestoreCache(config.dependencyCachingEnabled)) {
      const dependencyCachingResult = await downloadDependencyCaches(
@@ -629,6 +644,17 @@ async function run(startedAt: Date) {
        dependencyCachingResult.restoredKeys;
    }

+    // Suppress warnings about disabled Python library extraction.
+    if (await codeQlVersionAtLeast(codeql, "2.17.1")) {
+      // disabled by default, no warning
+    } else {
+      // disabled by default, prints warning if environment variable is not set
+      core.exportVariable(
+        "CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION",
+        "true",
+      );
+    }
+
    if (getOptionalInput("setup-python-dependencies") !== undefined) {
      logger.warning(
        "The setup-python-dependencies input is deprecated and no longer has any effect. We recommend removing any references from your workflows. See https://github.blog/changelog/2024-01-23-codeql-2-16-python-dependency-installation-disabled-new-queries-and-bug-fixes/ for more information.",
@@ -644,6 +670,27 @@ async function run(startedAt: Date) {
      );
    }

+    if (
+      await codeql.supportsFeature(
+        ToolsFeature.PythonDefaultIsToNotExtractStdlib,
+      )
+    ) {
+      if (process.env["CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB"]) {
+        logger.debug(
+          "CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB is already set, so the Action will not override it.",
+        );
+      } else if (
+        !(await features.getValue(
+          Feature.PythonDefaultIsToNotExtractStdlib,
+          codeql,
+        ))
+      ) {
+        // We are in a situation where the feature flag is not rolled out,
+        // so we need to suppress the new default CLI behavior.
+        core.exportVariable("CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB", "true");
+      }
+    }
+
    // If we are doing a Java `build-mode: none` analysis, then set the environment variable that
    // enables the option in the Java extractor to minimize dependency jars. We also only do this if
    // dependency caching is enabled, since the option is intended to reduce the size of dependency
@@ -660,7 +707,7 @@ async function run(startedAt: Date) {
      (await codeQlVersionAtLeast(codeql, CODEQL_VERSION_JAR_MINIMIZATION)) &&
      config.dependencyCachingEnabled &&
      config.buildMode === BuildMode.None &&
-      config.languages.includes(BuiltInLanguage.java)
+      config.languages.includes(KnownLanguage.java)
    ) {
      core.exportVariable(
        EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS,
@@ -817,6 +864,18 @@ async function loadRepositoryProperties(
  }
 }

+function getTrapCachingEnabled(): boolean {
+  // If the workflow specified something always respect that
+  const trapCaching = getOptionalInput("trap-caching");
+  if (trapCaching !== undefined) return trapCaching === "true";
+
+  // On self-hosted runners which may have slow network access, disable TRAP caching by default
+  if (!isHostedRunner()) return false;
+
+  // On hosted runners, enable TRAP caching by default
+  return true;
+}
+
 async function recordZstdAvailability(
  config: configUtils.Config,
  zstdAvailability: ZstdAvailability,
@@ -15,7 +15,7 @@ import {
  getFileCoverageInformationEnabled,
  logFileCoverageOnPrsDeprecationWarning,
 } from "./init";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import {
  createFeatures,
  LoggedMessage,
@@ -152,7 +152,7 @@ test("cleanupDatabaseClusterDirectory can disable warning with options", async (
 });

 type PackInfo = {
-  language: BuiltInLanguage;
+  language: KnownLanguage;
  packinfoContents: string | undefined;
  sourceOnlyPack?: boolean;
  qlpackFileName?: string;
@@ -169,13 +169,13 @@ const testCheckPacksForOverlayCompatibility = test.macro({
      expectedResult,
    }: {
      cliOverlayVersion: number | undefined;
-      languages: BuiltInLanguage[];
+      languages: KnownLanguage[];
      packs: Record<string, PackInfo>;
      expectedResult: boolean;
    },
  ) => {
    await withTmpDir(async (tmpDir) => {
-      const packDirsByLanguage = new Map<BuiltInLanguage, string[]>();
+      const packDirsByLanguage = new Map<KnownLanguage, string[]>();

      for (const [packName, packInfo] of Object.entries(packs)) {
        const packPath = path.join(tmpDir, packName);
@@ -242,10 +242,10 @@ test(
  "returns false when CLI does not support overlay",
  {
    cliOverlayVersion: undefined,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -258,7 +258,7 @@ test(
  "returns true when there are no query packs",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {},
    expectedResult: true,
  },
@@ -269,10 +269,10 @@ test(
  "returns true when query pack has not been compiled",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: undefined,
        sourceOnlyPack: true,
      },
@@ -286,10 +286,10 @@ test(
  "returns true when query pack has expected overlay version",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -302,14 +302,14 @@ test(
  "returns true when query packs for all languages to analyze are compatible",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.cpp, BuiltInLanguage.java],
+    languages: [KnownLanguage.cpp, KnownLanguage.java],
    packs: {
      "codeql/cpp-queries": {
-        language: BuiltInLanguage.cpp,
+        language: KnownLanguage.cpp,
        packinfoContents: '{"overlayVersion":2}',
      },
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -322,14 +322,14 @@ test(
  "returns true when query pack for a language not analyzed is incompatible",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/cpp-queries": {
-        language: BuiltInLanguage.cpp,
+        language: KnownLanguage.cpp,
        packinfoContents: undefined,
      },
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -342,14 +342,14 @@ test(
  "returns false when query pack for a language to analyze is incompatible",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.cpp, BuiltInLanguage.java],
+    languages: [KnownLanguage.cpp, KnownLanguage.java],
    packs: {
      "codeql/cpp-queries": {
-        language: BuiltInLanguage.cpp,
+        language: KnownLanguage.cpp,
        packinfoContents: '{"overlayVersion":1}',
      },
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
    },
@@ -362,14 +362,14 @@ test(
  "returns false when query pack is missing .packinfo",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: undefined,
      },
    },
@@ -382,14 +382,14 @@ test(
  "returns false when query pack has different overlay version",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":1}',
      },
    },
@@ -402,14 +402,14 @@ test(
  "returns false when query pack is missing overlayVersion in .packinfo",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: "{}",
      },
    },
@@ -422,14 +422,14 @@ test(
  "returns false when .packinfo is not valid JSON",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
      },
      "custom/queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: "this_is_not_valid_json",
      },
    },
@@ -442,10 +442,10 @@ test(
  "returns true when query pack uses codeql-pack.yml filename",
  {
    cliOverlayVersion: 2,
-    languages: [BuiltInLanguage.java],
+    languages: [KnownLanguage.java],
    packs: {
      "codeql/java-queries": {
-        language: BuiltInLanguage.java,
+        language: KnownLanguage.java,
        packinfoContents: '{"overlayVersion":2}',
        qlpackFileName: "codeql-pack.yml",
      },
@@ -26,7 +26,7 @@ import {
  RepositoryProperties,
  RepositoryPropertyName,
 } from "./feature-flags/properties";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import { ZstdAvailability } from "./tar";
@@ -235,7 +235,7 @@ export async function checkInstallPython311(
  codeql: CodeQL,
 ) {
  if (
-    languages.includes(BuiltInLanguage.python) &&
+    languages.includes(KnownLanguage.python) &&
    process.platform === "win32" &&
    !(await codeql.getVersion()).features?.supportsPython312
  ) {
@@ -1,46 +0,0 @@
-import test from "ava";
-
-import { setupTests } from "../testing-utils";
-
-import * as json from ".";
-
-setupTests(test);
-
-const testSchema = {
-  requiredKey: json.string,
-};
-
-const optionalSchema = {
-  optionalKey: json.optional(json.string),
-};
-
-test("validateSchema - required properties are required", async (t) => {
-  t.false(json.validateSchema(testSchema, {}));
-  t.false(json.validateSchema(testSchema, { requiredKey: undefined }));
-  t.false(json.validateSchema(testSchema, { requiredKey: null }));
-  t.false(json.validateSchema(testSchema, { requiredKey: 0 }));
-  t.false(json.validateSchema(testSchema, { requiredKey: 123 }));
-  t.false(json.validateSchema(testSchema, { requiredKey: false }));
-  t.false(json.validateSchema(testSchema, { requiredKey: true }));
-  t.false(json.validateSchema(testSchema, { requiredKey: [] }));
-  t.false(json.validateSchema(testSchema, { requiredKey: {} }));
-  t.true(json.validateSchema(testSchema, { requiredKey: "" }));
-  t.true(json.validateSchema(testSchema, { requiredKey: "foo" }));
-});
-
-test("validateSchema - optional properties are optional", async (t) => {
-  // Optional fields may be absent
-  t.true(json.validateSchema(optionalSchema, {}));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: undefined }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: null }));
-
-  // But, if present, should have the expected type
-  t.false(json.validateSchema(optionalSchema, { optionalKey: 0 }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: 123 }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: false }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: true }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: [] }));
-  t.false(json.validateSchema(optionalSchema, { optionalKey: {} }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: "" }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: "foo" }));
-});
--- a/Show More
+++ b/Show More