Add PR check for CSRA artifact upload

2026-05-24 16:14:33 +00:00 · 2026-03-12 12:24:25 +00:00
180 changed files with 1368369 additions and 82294 deletions
@@ -22,8 +22,7 @@ runs:
        MAJOR_VERSION: ${{ inputs.major_version }}
        LATEST_TAG: ${{ inputs.latest_tag }}
      run: |
-        npm ci
-        npx tsx ./pr-checks/release-branches.ts \
+        python ${{ github.action_path }}/release-branches.py \
            --major-version "$MAJOR_VERSION" \
            --latest-tag "$LATEST_TAG"
      shell: bash
@@ -0,0 +1,55 @@
+import argparse
+import json
+import os
+import configparser
+
+# Name of the remote
+ORIGIN = 'origin'
+
+script_dir = os.path.dirname(os.path.realpath(__file__))
+grandparent_dir = os.path.dirname(os.path.dirname(script_dir))
+
+config = configparser.ConfigParser()
+with open(os.path.join(grandparent_dir, 'releases.ini')) as stream:
+    config.read_string('[default]\n' + stream.read())
+
+OLDEST_SUPPORTED_MAJOR_VERSION = int(config['default']['OLDEST_SUPPORTED_MAJOR_VERSION'])
+
+def main():
+
+  parser = argparse.ArgumentParser()
+  parser.add_argument("--major-version", required=True, type=str, help="The major version of the release")
+  parser.add_argument("--latest-tag", required=True, type=str, help="The most recent tag published to the repository")
+  args = parser.parse_args()
+
+  major_version = args.major_version
+  latest_tag = args.latest_tag
+
+  print("major_version: " + major_version)
+  print("latest_tag: " + latest_tag)
+
+  # If this is a primary release, we backport to all supported branches,
+  # so we check whether the major_version taken from the package.json
+  # is greater than or equal to the latest tag pulled from the repo.
+  # For example...
+  #     'v1' >= 'v2' is False # we're operating from an older release branch and should not backport
+  #     'v2' >= 'v2' is True  # the normal case where we're updating the current version
+  #     'v3' >= 'v2' is True  # in this case we are making the first release of a new major version
+  consider_backports = ( major_version >= latest_tag.split(".")[0] )
+
+  with open(os.environ["GITHUB_OUTPUT"], "a") as f:
+
+    f.write(f"backport_source_branch=releases/{major_version}\n")
+
+    backport_target_branches = []
+
+    if consider_backports:
+      for i in range(int(major_version.strip("v"))-1, 0, -1):
+        branch_name = f"releases/v{i}"
+        if i >= OLDEST_SUPPORTED_MAJOR_VERSION:
+          backport_target_branches.append(branch_name)
+
+    f.write("backport_target_branches="+json.dumps(backport_target_branches)+"\n")
+
+if __name__ == "__main__":
+  main()
@@ -15,12 +15,6 @@ runs:
      run: echo "$GITHUB_CONTEXT"
      shell: bash

-    - name: Set up Node
-      uses: actions/setup-node@v6
-      with:
-        node-version: 20
-        cache: 'npm'
-
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
@@ -1,5 +1,5 @@
 name: "CodeQL config"
-queries:
+queries: 
  - name: Run custom queries
    uses: ./queries
  # Run all extra query suites, both because we want to
@@ -13,5 +13,3 @@ queries:
 paths-ignore:
  - lib
  - tests
-  - "**/*.test.ts"
-  - "**/testing-util.ts"
@@ -1,9 +1,7 @@
 version: 2
 updates:
  - package-ecosystem: npm
-    directories:
-      - "/"
-      - "/pr-checks"
+    directory: "/"
    schedule:
      interval: weekly
    cooldown:
@@ -0,0 +1 @@
+OLDEST_SUPPORTED_MAJOR_VERSION=3
@@ -60,12 +60,12 @@ jobs:
          setup-kotlin: 'true'
      - uses: ./../action/init
        with:
-          languages: C#,java-kotlin,typescript
+          languages: C#,java-kotlin,swift,typescript
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - name: 'Check languages'
        run: |
-          expected_languages="csharp,java,javascript"
+          expected_languages="csharp,java,swift,javascript"
          actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

          if [ "$expected_languages" != "$actual_languages" ]; then
@@ -0,0 +1,94 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Risk Assessment analysis failure uploads SARIF artifact
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: risk-assessment-failure-${{github.ref}}
+jobs:
+  risk-assessment-failure:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: Risk Assessment analysis failure uploads SARIF artifact
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: write
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Initialise CodeQL
+        uses: ./../action/init
+        id: init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: javascript
+          analysis-kinds: risk-assessment
+
+      - name: Fail
+        run: exit 1
+    env:
+      CODEQL_ACTION_TEST_MODE: true
+  artifact-present:
+    name: Check artifact
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - risk-assessment-failure
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          pattern: sarif-artifact-*
+          path: ${{ runner.temp }}/results
+          merge-multiple: true
+      - name: List contents
+        run: |
+          ls -lr
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -59,7 +59,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -71,17 +71,7 @@ jobs:
        id: proxy
        uses: ./../action/start-proxy
        with:
-          registry_secrets: |
-            [
-              {
-                "type": "maven_repository",
-                "url": "https://repo.maven.apache.org/maven2/"
-              },
-              {
-                "type": "maven_repository",
-                "url": "https://repo1.maven.org/maven2"
-              }
-            ]
+          registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

      - name: Print proxy outputs
        run: |
@@ -92,12 +82,5 @@ jobs:
      - name: Fail if proxy outputs are not set
        if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
        run: exit 1
-
-      - name: Fail if proxy_urls does not contain all registries
-        if: |
-          join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-        run: exit 1
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -6,6 +6,13 @@ env:
  # Diff informed queries add an additional query filter which is not yet
  # taken into account by these tests.
  CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
+  # Specify overlay enablement manually to ensure stability around the exclude-from-incremental
+  # query filter. Here we only enable for the default code scanning suite.
+  CODEQL_ACTION_OVERLAY_ANALYSIS: true
+  CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT: false
+  CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT: true
+  CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK: false
+  CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS: true

 on:
  push:
@@ -72,13 +79,33 @@ jobs:
      with:
        version: ${{ matrix.version }}

-    - name: Empty file
+    # On PRs, overlay analysis may change the config that is passed to the CLI.
+    # Therefore, we have two variants of the following test, one for PRs and one for other events.
+    - name: Empty file (non-PR)
+      if: github.event_name != 'pull_request'
      uses: ./../action/.github/actions/check-codescanning-config
      with:
        expected-config-file-contents: "{}"
        languages: javascript
        tools: ${{ steps.prepare-test.outputs.tools-url }}

+    - name: Empty file (PR)
+      if: github.event_name == 'pull_request'
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "query-filters": [
+              {
+                "exclude": {
+                  "tags": "exclude-from-incremental"
+                }
+              }
+            ]
+          }
+        languages: javascript
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
    - name: Packs from input
      if: success() || failure()
      uses: ./../action/.github/actions/check-codescanning-config
@@ -66,7 +66,6 @@ jobs:
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
        with:
-          languages: cpp,csharp,go,java,javascript,python
          tools: ${{ steps.prepare-test.outputs.tools-url }}
          debug: true
          debug-artifact-name: my-debug-artifacts
@@ -1,106 +0,0 @@
-# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
-# already passed CI before being merged. Therefore if they fail, we should make sure that there
-# wasn't a transient failure by rerunning the failed jobs once before investigating further.
-name: Deflake
-
-on:
-  workflow_run:
-    types: [completed]
-    # Exclude workflows that have significant side effects, like publishing releases. It's OK to
-    # retry CodeQL analysis.
-    workflows:
-      - Check Expected Release Files
-      - Code-Scanning config CLI tests
-      - CodeQL action
-      - Manual Check - go
-      - "PR Check - All-platform bundle"
-      - "PR Check - Analysis kinds"
-      - "PR Check - Analyze: 'ref' and 'sha' from inputs"
-      - "PR Check - autobuild-action"
-      - "PR Check - Autobuild direct tracing (custom working directory)"
-      - "PR Check - Autobuild working directory"
-      - "PR Check - Build mode autobuild"
-      - "PR Check - Build mode manual"
-      - "PR Check - Build mode none"
-      - "PR Check - Build mode rollback"
-      - "PR Check - Bundle: Caching checks"
-      - "PR Check - Bundle: From nightly"
-      - "PR Check - Bundle: From toolcache"
-      - "PR Check - Bundle: Zstandard checks"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
-      - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
-      - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
-      - "PR Check - Config export"
-      - "PR Check - Config input"
-      - "PR Check - Custom source root"
-      - "PR Check - Debug artifact upload"
-      - "PR Check - Debug artifacts after failure"
-      - "PR Check - Diagnostic export"
-      - "PR Check - Export file baseline information"
-      - "PR Check - Extractor ram and threads options test"
-      - "PR Check - Go: Custom queries"
-      - "PR Check - Go: diagnostic when Go is changed after init step"
-      - "PR Check - Go: diagnostic when `file` is not installed"
-      - "PR Check - Go: tracing with autobuilder step"
-      - "PR Check - Go: tracing with custom build steps"
-      - "PR Check - Go: tracing with legacy workflow"
-      - "PR Check - Go: workaround for indirect tracing"
-      - "PR Check - Job run UUID added to SARIF"
-      - "PR Check - Language aliases"
-      - "PR Check - Local CodeQL bundle"
-      - "PR Check - Multi-language repository"
-      - "PR Check - Overlay database init fallback"
-      - "PR Check - Packaging: Action input"
-      - "PR Check - Packaging: Config and input"
-      - "PR Check - Packaging: Config and input passed to the CLI"
-      - "PR Check - Packaging: Config file"
-      - "PR Check - Packaging: Download using registries"
-      - "PR Check - Proxy test"
-      - "PR Check - Remote config file"
-      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
-      - "PR Check - Ruby analysis"
-      - "PR Check - Rust analysis"
-      - "PR Check - Split workflow"
-      - "PR Check - Start proxy"
-      - "PR Check - Submit SARIF after failure"
-      - "PR Check - Swift analysis using a custom build command"
-      - "PR Check - Swift analysis using autobuild"
-      - "PR Check - Test different uses of `upload-sarif`"
-      - "PR Check - Test unsetting environment variables"
-      - "PR Check - Upload-sarif: ref and sha from inputs"
-      - "PR Check - Use a custom `checkout_path`"
-      - PR Checks
-      - Query filters tests
-      - Test that the workaround for python 3.12 on windows works
-
-jobs:
-  rerun-on-failure:
-    name: Rerun failed jobs
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      github.event.workflow_run.run_attempt == 1 &&
-      (
-        github.event.workflow_run.head_branch == 'main' ||
-        startsWith(github.event.workflow_run.head_branch, 'releases/') ||
-        github.event.workflow_run.event == 'merge_group'
-      )
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NAME: ${{ github.event.workflow_run.name }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          echo "Rerunning failed jobs for workflow run ${RUN_ID}"
-          gh run rerun "${RUN_ID}" --failed
-          echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"
@@ -24,7 +24,7 @@ defaults:

 jobs:
  merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    if: github.repository == 'github/codeql-action'
    env:
@@ -131,7 +131,7 @@ jobs:
          echo "::endgroup::"

      - name: Generate token
-        uses: actions/create-github-app-token@v3.2.0
+        uses: actions/create-github-app-token@v2.2.1
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -92,9 +92,6 @@ jobs:
          node-version: 24
          cache: 'npm'

-      - name: Install dependencies
-        run: npm ci
-
      - name: Verify PR checks up to date
        if: always()
        run: .github/workflows/script/verify-pr-checks.sh
@@ -102,7 +99,7 @@ jobs:
      - name: Run pr-checks tests
        if: always()
        working-directory: pr-checks
-        run: npx tsx --test
+        run: npm ci && npx tsx --test

  check-node-version:
    if: github.triggering_actor != 'dependabot[bot]'
@@ -29,7 +29,7 @@ defaults:
 jobs:
  prepare:
    name: "Prepare release"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.repository == 'github/codeql-action'

    permissions:
@@ -34,6 +34,9 @@ jobs:
        with:
          node-version: 24
          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            pr-checks/package-lock.json

      - name: Remove label
        if: github.event_name == 'pull_request'
@@ -94,7 +97,7 @@ jobs:
        working-directory: pr-checks
        run: |
          npm ci
-          npx tsx sync-back.ts --verbose
+          npx tsx sync_back.ts --verbose

      - name: Generate workflows
        working-directory: pr-checks
@@ -136,7 +136,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v3.2.0
+        uses: actions/create-github-app-token@v2.2.1
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Update the required checks based on the current branch.
+
+set -euo pipefail
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+REPO_DIR="$(dirname "$SCRIPT_DIR")"
+GRANDPARENT_DIR="$(dirname "$REPO_DIR")"
+source "$GRANDPARENT_DIR/releases.ini"
+
+if ! gh auth status 2>/dev/null; then
+  gh auth status
+  echo "Failed: Not authorized. This script requires admin access to github/codeql-action through the gh CLI."
+  exit 1
+fi
+
+if [ "$#" -eq 1 ]; then
+  # If we were passed an argument, use that as the SHA
+  GITHUB_SHA="$1"
+elif [ "$#" -gt 1 ]; then
+  echo "Usage: $0 [SHA]"
+  echo "Update the required checks based on the SHA, or main."
+  exit 1
+elif [ -z "$GITHUB_SHA" ]; then
+  # If we don't have a SHA, use main
+  GITHUB_SHA="$(git rev-parse main)"
+fi
+
+echo "Getting checks for $GITHUB_SHA"
+
+# Ignore any checks with "https://", CodeQL, LGTM, Update, and ESLint checks.
+CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") or . == "Agent" or . == "Cleanup artifacts" or . == "Prepare" or . == "Upload results" or . == "Label PR with size" | not)] | unique | sort')"
+
+echo "$CHECKS" | jq
+
+# Fail if there are no checks
+if [ -z "$CHECKS" ] || [ "$(echo "$CHECKS" | jq '. | length')" -eq 0 ]; then
+  echo "No checks found for $GITHUB_SHA"
+  exit 1
+fi
+
+echo "{\"contexts\": ${CHECKS}}" > checks.json
+
+echo "Updating main"
+gh api --silent -X "PATCH" "repos/github/codeql-action/branches/main/protection/required_status_checks" --input checks.json
+
+# list all branchs on origin remote matching releases/v*
+BRANCHES="$(git ls-remote --heads origin 'releases/v*' | sed 's?.*refs/heads/??' | sort -V)"
+
+for BRANCH in $BRANCHES; do
+
+  # strip exact 'releases/v' prefix from $BRANCH using count of characters
+  VERSION="${BRANCH:10}"
+
+  if [ "$VERSION" -lt "$OLDEST_SUPPORTED_MAJOR_VERSION" ]; then
+    echo "Skipping $BRANCH"
+    continue
+  fi
+
+  echo "Updating $BRANCH"
+  gh api --silent -X "PATCH" "repos/github/codeql-action/branches/$BRANCH/protection/required_status_checks" --input checks.json
+done
+
+rm checks.json
@@ -20,7 +20,7 @@ defaults:
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
@@ -57,17 +57,6 @@ jobs:
      - name: Update bundle
        uses: ./.github/actions/update-bundle

-      - name: Set up CodeQL CLI from new bundle
-        id: setup-codeql
-        uses: ./setup-codeql
-        with:
-          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
-
-      - name: Update built-in languages
-        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
-        env:
-          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
-
      - name: Bump Action minor version if new CodeQL minor version series
        id: bump-action-version
        run: |
@@ -26,7 +26,7 @@ jobs:

  update:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
@@ -77,7 +77,7 @@ jobs:

  backport:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -93,7 +93,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@v3.2.0
+      uses: actions/create-github-app-token@v2.2.1
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -11,5 +11,3 @@ build/
 eslint.sarif
 # for local incremental compilation
 tsconfig.tsbuildinfo
-# esbuild metadata file
-meta.json
@@ -1,30 +0,0 @@
-{
-  // Place your codeql-action workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and
-  // description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope
-  // is left empty or omitted, the snippet gets applied to all languages. The prefix is what is
-  // used to trigger the snippet and the body will be expanded and inserted. Possible variables are:
-  // $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders.
-  // Placeholders with the same ids are connected.
-  // Example:
-  // "Print to console": {
-  // 	"scope": "javascript,typescript",
-  // 	"prefix": "log",
-  // 	"body": [
-  // 		"console.log('$1');",
-  // 		"$2"
-  // 	],
-  // 	"description": "Log output to console"
-  // }
-  "Test Macro": {
-    "scope": "javascript, typescript",
-    "prefix": "testMacro",
-    "body": [
-      "const ${1:nameMacro} = makeMacro({",
-      "  exec: async (t: ExecutionContext<unknown>) => {},",
-      "",
-      "  title: (providedTitle = \"\") => `${2:common title} - \\${providedTitle}`,",
-      "});",
-    ],
-    "description": "An Ava test macro",
-  },
-}
@@ -2,53 +2,7 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## 4.35.5 - 15 May 2026
-
- We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
- For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
- If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
- Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)
-
-## 4.35.4 - 07 May 2026
-
- Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)
-
-## 4.35.3 - 01 May 2026
-
- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
- Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
- Best-effort connection tests for private registries now use `GET` requests instead of `HEAD` for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. [#3853](https://github.com/github/codeql-action/pull/3853)
- Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
- Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)
-
-## 4.35.2 - 15 Apr 2026
-
- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
- The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
- Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://github.com/github/codeql-action/pull/3794)
- Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
- Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
-
-## 4.35.1 - 27 Mar 2026
-
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
-
-## 4.35.0 - 27 Mar 2026
-
- Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
- Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)
-
-## 4.34.1 - 20 Mar 2026
-
- Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)
-
-## 4.34.0 - 20 Mar 2026
-
- Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
- We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
- Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)
-
-## 4.33.0 - 16 Mar 2026
+## [UNRELEASED]

 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)

@@ -58,9 +12,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
  - **User-owned repositories using advanced setup:** Set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
 - Fixed [a bug](https://github.com/github/codeql-action/issues/3555) which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. [#3557](https://github.com/github/codeql-action/pull/3557)
 - The CodeQL Action now loads [custom repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) on GitHub Enterprise Server, enabling the customization of features such as `github-codeql-disable-overlay` that was previously only available on GitHub.com. [#3559](https://github.com/github/codeql-action/pull/3559)
- Once [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. [#3563](https://github.com/github/codeql-action/pull/3563)
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
- A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

 ## 4.32.6 - 05 Mar 2026

@@ -69,14 +69,12 @@ Once the mergeback and backport pull request have been merged, the release is co

 ## Keeping the PR checks up to date (admin access required)

-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [sync-checks.ts](pr-checks/sync-checks.ts) script:
+Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:

- At a minimum, you must provide an argument for the `--token` input. For example, `--token "$(gh auth token)"` to use the same token that `gh` uses. If no token is provided or the token has insufficient permissions, the script will fail.
- By default, the script performs a dry run and outputs information about the changes it would make to the branch protection rules. To actually apply the changes, specify the `--apply` flag.
- If you run the script without any other arguments, it will retrieve the set of workflows that ran for the latest commit on `main`.
- You can specify a different git ref with the `--ref` input. You will likely want to use this if you have a PR that removes or adds PR checks. For example, `--ref "some/branch/name"` to use the HEAD of the `some/branch/name` branch.
+- If you run the script without an argument, it will retrieve the set of workflows that ran for the latest commit on `main`. Make sure that your local `main` branch is up to date before running the script.
+- You can specify a commit SHA as argument to retrieve the set of workflows for that commit instead. You will likely want to use this if you have a PR that removes or adds PR checks.

-After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v4`, and any other currently supported major versions have been updated.
+After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.

 Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.

@@ -124,7 +122,7 @@ To deprecate an older version of the Action:
   - Implement an Actions warning for customers using the deprecated version.
 1. Wait for the deprecation period to pass.
 1. Upgrade the Actions warning for customers using the deprecated version to a non-fatal error, and mention that this version of the Action is no longer supported.
-1. Make a PR to bump the `OLDEST_SUPPORTED_MAJOR_VERSION` in [config.ts](pr-checks/config.ts).  Once this PR is merged, the release process will no longer backport changes to the deprecated release version.
+1. Make a PR to bump the `OLDEST_SUPPORTED_MAJOR_VERSION` in [releases.ini](.github/releases.ini).  Once this PR is merged, the release process will no longer backport changes to the deprecated release version.

 ## Resources

@@ -72,7 +72,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n

 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
@@ -95,5 +95,5 @@ outputs:
    description: The ID of the uploaded SARIF file.
 runs:
  using: node24
-  main: "../lib/analyze-entry.js"
-  post: "../lib/analyze-post-entry.js"
+  main: "../lib/analyze-action.js"
+  post: "../lib/analyze-action-post.js"
@@ -16,4 +16,4 @@ inputs:
    required: false
 runs:
  using: node24
-  main: '../lib/autobuild-entry.js'
+  main: '../lib/autobuild-action.js'
@@ -1,9 +0,0 @@
-export default {
-  typescript: {
-    rewritePaths: {
-      "src/": "build/",
-    },
-    compile: false,
-  },
-  require: ["./ava.setup.mjs"],
-};
@@ -1,3 +0,0 @@
-import pkg from "./package.json" with { type: "json" };
-
-globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;
@@ -1,12 +1,10 @@
-import { copyFile, readFile, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { copyFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

 import * as esbuild from "esbuild";
 import { globSync } from "glob";

-import pkg from "./package.json" with { type: "json" };
-
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

@@ -15,7 +13,7 @@ const OUT_DIR = join(__dirname, "lib");

 /**
 * Clean the output directory before building.
- *
+ * 
 * @type {esbuild.Plugin}
 */
 const cleanPlugin = {
@@ -29,7 +27,7 @@ const cleanPlugin = {

 /**
 * Copy defaults.json to the output directory since other projects depend on it.
- *
+ * 
 * @type {esbuild.Plugin}
 */
 const copyDefaultsPlugin = {
@@ -62,131 +60,16 @@ const onEndPlugin = {
  },
 };

-/** The name of the virtual `entry-points` module. */
-const SHARED_ENTRYPOINT = "entry-points";
-
-/**
- * This plugin finds all source files that contain action entry points.
- * It then generates the virtual `entry-points` module which imports all identifies files,
- * and re-exports their `runWrapper` functions with suitable aliases.
- * A tiny stub file is emitted for each Action entrypoint. Each stub imports the shared bundle
- * and calls the respective entry point.
- *
- * @type {esbuild.Plugin}
- */
-const entryPointsPlugin = {
-  name: "entry-points",
-  setup(build) {
-    const namespace = "actions";
-    const actions = [];
-
-    const toPascal = (s) =>
-      s.replace(/(^|-)([a-z0-9])/gi, (_, __, c) => c.toUpperCase());
-
-    // Find the source files containing action entry points.
-    build.onStart(() => {
-      const actionFiles = globSync("src/*-action{,-post}.ts");
-      for (const actionFile of actionFiles) {
-        const match = basename(actionFile).match(/(.*)-action(-post)?/);
-
-        if (match.length < 2) {
-          throw new Error(`'${actionFile}' didn't match expected pattern.`);
-        }
-
-        const actionName = match[1];
-        const isPost = match[2] !== undefined;
-
-        actions.push({
-          path: actionFile,
-          name: actionName,
-          isPost,
-          pascalCaseName: `${toPascal(actionName)}${isPost ? "Post" : ""}Action`,
-        });
-      }
-    });
-
-    // Resolve the virtual `entry-points` file and set the corresponding namespace.
-    // Ideally, we'd `RegExp.escape` the entrypoint here, but that API isn't supported in Node 20.
-    // Since we're dealing with a hardcoded string, this isn't too much of a problem.
-    build.onResolve({ filter: new RegExp(`^${SHARED_ENTRYPOINT}$`) }, () => {
-      return { path: SHARED_ENTRYPOINT, namespace };
-    });
-
-    // Generate the virtual `entry-points` file based on the actions we discovered.
-    // Restrict using the namespace. The path filter does not need to discriminate any further.
-    build.onLoad({ filter: /.*/, namespace }, async () => {
-      const wrapperTemplatePath = "entry-wrapper.js.tpl";
-      const wrapperTemplate = await readFile(
-        join(SRC_DIR, wrapperTemplatePath),
-        "utf-8",
-      );
-
-      const actionsSorted = actions.sort((a, b) =>
-        a.name.localeCompare(b.name),
-      );
-      const imports = actionsSorted
-        .map(
-          (action) =>
-            `import * as ${action.pascalCaseName} from "./src/${basename(action.path)}"`,
-        )
-        .join("\n");
-      const wrappers = actionsSorted
-        .map((action) =>
-          wrapperTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        )
-        .join("\n\n");
-
-      return {
-        contents: `"use strict";\n${imports}\n\n${wrappers}\n`,
-        resolveDir: ".",
-        loader: "ts",
-      };
-    });
-
-    // Emit entry point stubs for each action using the entry template.
-    build.onEnd(async (result) => {
-      // Read the entry point template.
-      const templatePath = "action-entry.js.tpl";
-      const template = await readFile(join(SRC_DIR, templatePath), "utf-8");
-
-      const makeHeader = (sourceFile) =>
-        `// Automatically generated from '${templatePath}' for 'src/${basename(sourceFile)}'.\n\n`;
-
-      // Write entry point stubs for each action.
-      for (const action of actions) {
-        await writeFile(
-          join(
-            OUT_DIR,
-            `${action.name}${action.isPost ? "-post" : ""}-entry.js`,
-          ),
-          makeHeader(action.path) +
-            template.replaceAll("__ACTION__", action.pascalCaseName),
-        );
-      }
-    });
-  },
-};
-
 const context = await esbuild.context({
  // Include upload-lib.ts as an entry point for use in testing environments.
-  entryPoints: [
-    { in: SHARED_ENTRYPOINT, out: SHARED_ENTRYPOINT },
-    join(SRC_DIR, "upload-lib.ts"),
-  ],
+  entryPoints: globSync([`${SRC_DIR}/*-action.ts`, `${SRC_DIR}/*-action-post.ts`, "src/upload-lib.ts"]),
  bundle: true,
  format: "cjs",
  outdir: OUT_DIR,
  platform: "node",
-  external: ["./entry-points"],
-  plugins: [cleanPlugin, copyDefaultsPlugin, entryPointsPlugin, onEndPlugin],
+  plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
  target: ["node20"],
-  define: {
-    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
-  },
-  metafile: true,
 });

-const result = await context.rebuild();
-await writeFile(join(__dirname, "meta.json"), JSON.stringify(result.metafile));
-
+await context.rebuild();
 await context.dispose();
@@ -7,11 +7,7 @@ import noAsyncForeach from "eslint-plugin-no-async-foreach";
 import jsdoc from "eslint-plugin-jsdoc";
 import tseslint from "typescript-eslint";
 import globals from "globals";
-import path from "path";
-import { fileURLToPath } from "url";

-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
 const githubFlatConfigs = github.getFlatConfigs();

 export default [
@@ -23,10 +19,9 @@ export default [
      "src/testdata/**/*",
      "tests/**/*",
      "build.mjs",
-      "ava.config.mjs",
-      "ava.setup.mjs",
      "eslint.config.mjs",
      ".github/**/*",
+      "pr-checks/**/*",
    ],
  },
  // eslint recommended config
@@ -47,7 +42,7 @@ export default [
    plugins: {
      "import-x": importX,
      "no-async-foreach": fixupPluginRules(noAsyncForeach),
-      jsdoc: jsdoc,
+      "jsdoc": jsdoc,
    },

    languageOptions: {
@@ -71,13 +66,7 @@ export default [

        typescript: {},
      },
-      "import/ignore": [
-        "sinon",
-        "uuid",
-        "@octokit/plugin-retry",
-        "del",
-        "get-folder-size",
-      ],
+      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size"],
      "import-x/resolver-next": [
        createTypeScriptImportResolver(),
        createNodeResolver({
@@ -153,7 +142,7 @@ export default [
          // We don't currently require full JSDoc coverage, so this rule
          // should not error on missing @param annotations.
          disableMissingParamChecks: true,
-        },
+        }
      ],
    },
  },
@@ -172,41 +161,11 @@ export default [
      "@typescript-eslint/no-unused-vars": [
        "error",
        {
-          args: "all",
-          argsIgnorePattern: "^_",
-        },
+          "args": "all",
+          "argsIgnorePattern": "^_",
+        }
      ],
      "func-style": "off",
    },
  },
-  {
-    files: ["pr-checks/**/*.ts"],
-
-    languageOptions: {
-      parserOptions: {
-        // Use the correct `tsconfig.json` for `pr-checks`.
-        project: "./pr-checks/tsconfig.json",
-      },
-    },
-
-    rules: {
-      // The scripts in `pr-checks` are expected to output to the console.
-      "no-console": "off",
-
-      "import/no-extraneous-dependencies": [
-        "error",
-        { packageDir: [__dirname, path.resolve(__dirname, "pr-checks")] },
-      ],
-
-      "@typescript-eslint/no-floating-promises": [
-        "error",
-        {
-          allowForKnownSafeCalls: [
-            // Avoid needing explicit `void` in front of `describe` calls in test files.
-            { from: "package", name: ["describe"], package: "node:test" },
-          ],
-        },
-      ],
-    },
-  },
 ];
@@ -171,5 +171,5 @@ outputs:
    description: The version of the CodeQL binary used for analysis
 runs:
  using: node24
-  main: '../lib/init-entry.js'
-  post: '../lib/init-post-entry.js'
+  main: '../lib/init-action.js'
+  post: '../lib/init-action-post.js'
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzeAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzePostAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/autobuild-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAutobuildAction)();
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.4",
-  "cliVersion": "2.25.4",
-  "priorBundleVersion": "codeql-bundle-v2.25.3",
-  "priorCliVersion": "2.25.3"
+  "bundleVersion": "codeql-bundle-v2.24.3",
+  "cliVersion": "2.24.3",
+  "priorBundleVersion": "codeql-bundle-v2.24.2",
+  "priorCliVersion": "2.24.2"
 }
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/init-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runInitAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/init-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runInitPostAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/resolve-environment-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runResolveEnvironmentAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/setup-codeql-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runSetupCodeqlAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runStartProxyAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runStartProxyPostAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runUploadSarifAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runUploadSarifPostAction)();
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.35.5",
+  "version": "4.32.7",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -12,12 +12,17 @@
    "ava": "npm run transpile && ava --verbose",
    "test": "npm run ava -- src/",
    "test-debug": "npm run test -- --timeout=20m",
-    "transpile": "tsc --build --verbose tsconfig.json"
+    "transpile": "tsc --build --verbose"
+  },
+  "ava": {
+    "typescript": {
+      "rewritePaths": {
+        "src/": "build/"
+      },
+      "compile": false
+    }
  },
  "license": "MIT",
-  "workspaces": [
-    "pr-checks"
-  ],
  "dependencies": {
    "@actions/artifact": "^5.0.3",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
@@ -29,46 +34,47 @@
    "@actions/http-client": "^3.0.0",
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
-    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-retry": "^8.0.0",
+    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
    "fast-deep-equal": "^3.1.3",
-    "follow-redirects": "^1.16.0",
+    "follow-redirects": "^1.15.11",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
    "js-yaml": "^4.1.1",
-    "jsonschema": "1.5.0",
+    "jsonschema": "1.4.1",
    "long": "^5.3.2",
-    "node-forge": "^1.4.0",
+    "node-forge": "^1.3.3",
    "semver": "^7.7.4",
-    "uuid": "^14.0.0"
+    "uuid": "^13.0.0"
  },
  "devDependencies": {
-    "@ava/typescript": "7.0.0",
-    "@eslint/compat": "^2.0.5",
+    "@ava/typescript": "6.0.0",
+    "@eslint/compat": "^2.0.2",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
    "@octokit/types": "^16.0.0",
    "@types/archiver": "^7.0.0",
    "@types/follow-redirects": "^1.14.4",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.19.39",
+    "@types/node": "^20.19.9",
    "@types/node-forge": "^1.3.14",
    "@types/sarif": "^2.1.7",
    "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.1",
+    "@types/sinon": "^21.0.0",
    "ava": "^7.0.0",
-    "esbuild": "^0.28.0",
-    "eslint": "^9.39.4",
-    "eslint-import-resolver-typescript": "^4.4.4",
+    "esbuild": "^0.27.3",
+    "eslint": "^9.39.2",
+    "eslint-import-resolver-typescript": "^3.8.7",
    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jsdoc": "^62.9.0",
+    "eslint-plugin-import-x": "^4.16.1",
+    "eslint-plugin-jsdoc": "^62.7.1",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^11.1.0",
-    "globals": "^17.6.0",
-    "nock": "^14.0.12",
-    "sinon": "^21.1.2",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.2"
+    "globals": "^17.4.0",
+    "nock": "^14.0.11",
+    "sinon": "^21.0.2",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.1"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -89,7 +95,7 @@
    "eslint-plugin-jsx-a11y": {
      "semver": ">=6.3.1"
    },
-    "glob": "^11.1.0",
-    "undici": "^6.24.0"
+    "brace-expansion@2.0.1": "2.0.2",
+    "glob": "^11.1.0"
  }
 }
@@ -1,13 +0,0 @@
-import * as githubUtils from "@actions/github/lib/utils";
-import { type Octokit } from "@octokit/core";
-import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
-import { type Api } from "@octokit/plugin-rest-endpoint-methods";
-
-/** The type of the Octokit client. */
-export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
-
-/** Constructs an `ApiClient` using `token` for authentication. */
-export function getApiClient(token: string): ApiClient {
-  const opts = githubUtils.getOctokitOptions(token);
-  return new githubUtils.GitHub(opts);
-}
@@ -1,48 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs/promises";
-
-import { BUNDLE_METADATA_FILE } from "./config";
-
-interface InputInfo {
-  bytesInOutput: number;
-}
-
-type Inputs = Record<string, InputInfo>;
-
-interface Output {
-  bytes: number;
-  inputs: Inputs;
-}
-
-interface Metadata {
-  outputs: Record<string, Output>;
-}
-
-function toMB(bytes: number): string {
-  return `${(bytes / (1024 * 1024)).toFixed(2)}MB`;
-}
-
-async function main() {
-  const fileContents = await fs.readFile(BUNDLE_METADATA_FILE);
-  const metadata = JSON.parse(String(fileContents)) as Metadata;
-
-  for (const [outputFile, outputData] of Object.entries(
-    metadata.outputs,
-  ).reverse()) {
-    console.info(`${outputFile}: ${toMB(outputData.bytes)}`);
-
-    for (const [inputName, inputData] of Object.entries(outputData.inputs)) {
-      // Ignore any inputs that make up less than 5% of the output.
-      const percentage = (inputData.bytesInOutput / outputData.bytes) * 100.0;
-      if (percentage < 5.0) continue;
-
-      console.info(`  ${inputName}: ${toMB(inputData.bytesInOutput)}`);
-    }
-  }
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -5,12 +5,12 @@ versions:
 steps:
  - uses: ./../action/init
    with:
-      languages: C#,java-kotlin,typescript
+      languages: C#,java-kotlin,swift,typescript
      tools: ${{ steps.prepare-test.outputs.tools-url }}

  - name: "Check languages"
    run: |
-      expected_languages="csharp,java,javascript"
+      expected_languages="csharp,java,swift,javascript"
      actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

      if [ "$expected_languages" != "$actual_languages" ]; then
@@ -0,0 +1,33 @@
+name: Risk Assessment analysis failure uploads SARIF artifact
+description: Check that a SARIF file is uploaded as artifact if Risk Assessment fails
+versions: ["default"]
+
+permissions:
+  contents: read
+  security-events: write # needed to upload the SARIF file
+
+steps:
+  - name: Initialise CodeQL
+    uses: ./../action/init
+    id: init
+    with:
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      languages: javascript
+      analysis-kinds: risk-assessment
+
+  - name: Fail
+    run: exit 1
+
+validationJobs:
+  artifact-present:
+    name: Check artifact
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v7
+        with:
+          pattern: sarif-artifact-*
+          path: ${{ runner.temp }}/results
+          merge-multiple: true
+      - name: List contents
+        run: |
+          ls -lr
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+    uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -16,17 +16,7 @@ steps:
    id: proxy
    uses: ./../action/start-proxy
    with:
-      registry_secrets: |
-        [
-          {
-            "type": "maven_repository",
-            "url": "https://repo.maven.apache.org/maven2/"
-          },
-          {
-            "type": "maven_repository",
-            "url": "https://repo1.maven.org/maven2"
-          }
-        ]
+      registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

  - name: Print proxy outputs
    run: |
@@ -37,10 +27,3 @@ steps:
  - name: Fail if proxy outputs are not set
    if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
    run: exit 1
-
-  - name: Fail if proxy_urls does not contain all registries
-    if: |
-      join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-    run: exit 1
@@ -1,23 +0,0 @@
-import path from "path";
-
-/** The oldest supported major version of the CodeQL Action. */
-export const OLDEST_SUPPORTED_MAJOR_VERSION = 3;
-
-/** The `pr-checks` directory. */
-export const PR_CHECKS_DIR = __dirname;
-
-/** The path of the file configuring which checks shouldn't be required. */
-export const PR_CHECK_EXCLUDED_FILE = path.join(PR_CHECKS_DIR, "excluded.yml");
-
-/** The path to the esbuild metadata file. */
-export const BUNDLE_METADATA_FILE = path.join(PR_CHECKS_DIR, "..", "meta.json");
-
-/** The `src` directory. */
-const SOURCE_ROOT = path.join(PR_CHECKS_DIR, "..", "src");
-
-/** The path to the built-in languages file. */
-export const BUILTIN_LANGUAGES_FILE = path.join(
-  SOURCE_ROOT,
-  "languages",
-  "builtin.json",
-);
@@ -1,16 +0,0 @@
-# PR checks to exclude from required checks
-contains:
-  - "https://"
-  - "Update"
-  - "ESLint"
-  - "update"
-  - "test-setup-python-scripts"
-is:
-  - "CodeQL"
-  - "Dependabot"
-  - "check-expected-release-files"
-  - "Agent"
-  - "Cleanup artifacts"
-  - "Prepare"
-  - "Upload results"
-  - "Label PR with size"
@@ -0,0 +1,605 @@
+{
+  "name": "pr-checks",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "yaml": "^2.8.2"
+      },
+      "devDependencies": {
+        "@types/node": "^20.19.9",
+        "tsx": "^4.21.0",
+        "typescript": "^5.9.3"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
+      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
+      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
+      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
+      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
+      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
+      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
+      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
+      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
+      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
+      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
+      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
+      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
+      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
+      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
+      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
+      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
+      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
+      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
+      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
+      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
+      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.19.35",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.35.tgz",
+      "integrity": "sha512-Uarfe6J91b9HAUXxjvSOdiO2UPOKLm07Q1oh0JHxoZ1y8HoqxDAu3gVrsrOHeiio0kSsoVBt4wFrKOm0dKxVPQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
+      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.3",
+        "@esbuild/android-arm": "0.27.3",
+        "@esbuild/android-arm64": "0.27.3",
+        "@esbuild/android-x64": "0.27.3",
+        "@esbuild/darwin-arm64": "0.27.3",
+        "@esbuild/darwin-x64": "0.27.3",
+        "@esbuild/freebsd-arm64": "0.27.3",
+        "@esbuild/freebsd-x64": "0.27.3",
+        "@esbuild/linux-arm": "0.27.3",
+        "@esbuild/linux-arm64": "0.27.3",
+        "@esbuild/linux-ia32": "0.27.3",
+        "@esbuild/linux-loong64": "0.27.3",
+        "@esbuild/linux-mips64el": "0.27.3",
+        "@esbuild/linux-ppc64": "0.27.3",
+        "@esbuild/linux-riscv64": "0.27.3",
+        "@esbuild/linux-s390x": "0.27.3",
+        "@esbuild/linux-x64": "0.27.3",
+        "@esbuild/netbsd-arm64": "0.27.3",
+        "@esbuild/netbsd-x64": "0.27.3",
+        "@esbuild/openbsd-arm64": "0.27.3",
+        "@esbuild/openbsd-x64": "0.27.3",
+        "@esbuild/openharmony-arm64": "0.27.3",
+        "@esbuild/sunos-x64": "0.27.3",
+        "@esbuild/win32-arm64": "0.27.3",
+        "@esbuild/win32-ia32": "0.27.3",
+        "@esbuild/win32-x64": "0.27.3"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/get-tsconfig": {
+      "version": "4.13.6",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.13.6.tgz",
+      "integrity": "sha512-shZT/QMiSHc/YBLxxOkMtgSid5HFoauqCE3/exfsEcwg1WkeqjG+V40yBbBrsD+jW2HDXcs28xOfcbm2jI8Ddw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
+    "node_modules/resolve-pkg-maps": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
+      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
+      }
+    },
+    "node_modules/tsx": {
+      "version": "4.21.0",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.21.0.tgz",
+      "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.27.0",
+        "get-tsconfig": "^4.7.5"
+      },
+      "bin": {
+        "tsx": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/yaml": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
+      "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    }
+  }
+}
@@ -2,15 +2,11 @@
  "private": true,
  "description": "Dependencies for the sync.ts",
  "dependencies": {
-    "@actions/core": "^2.0.3",
-    "@actions/github": "^8.0.1",
-    "@octokit/core": "^7.0.6",
-    "@octokit/plugin-paginate-rest": ">=9.2.2",
-    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
-    "yaml": "^2.8.4"
+    "yaml": "^2.8.2"
  },
  "devDependencies": {
-    "@types/node": "^20.19.39",
-    "tsx": "^4.21.0"
+    "@types/node": "^20.19.9",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3"
  }
 }
@@ -1,61 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Tests for the release-branches.ts script
-*/
-
-import * as assert from "node:assert/strict";
-import { describe, it } from "node:test";
-
-import { computeBackportBranches } from "./release-branches";
-
-describe("computeBackportBranches", async () => {
-  await it("rejects invalid major versions", () => {
-    // The majorVersion is expected to be in vN format.
-    assert.throws(() => computeBackportBranches("3", "v4.28.0", 3));
-    assert.throws(() => computeBackportBranches("v3.1", "v4.28.0", 3));
-  });
-
-  await it("rejects invalid latest tags", () => {
-    // The latestTag is expected to be in vN.M.P format.
-    assert.throws(() => computeBackportBranches("v3", "v4", 3));
-    assert.throws(() => computeBackportBranches("v3", "4", 3));
-    assert.throws(() => computeBackportBranches("v3", "v4.28", 3));
-    assert.throws(() => computeBackportBranches("v3", "4.28", 3));
-    assert.throws(() => computeBackportBranches("v3", "4.28.0", 3));
-  });
-
-  await it("sets backport source branch based on major version", () => {
-    // Test that the backport source branch is releases/v{majorVersion}
-    const result = computeBackportBranches("v3", "v4.28.0", 3);
-    assert.equal(result.backportSourceBranch, "releases/v3");
-  });
-
-  await it("no backport targets when major version is the oldest supported", () => {
-    // When majorVersion equals the major version of latestTag and we do not support older major versions,
-    // then there are no older supported branches to backport to.
-    const result = computeBackportBranches("v3", "v3.28.0", 3);
-    assert.deepEqual(result.backportTargetBranches, []);
-  });
-
-  await it("backports to older supported major versions", () => {
-    const result = computeBackportBranches("v4", "v4.1.0", 3);
-    assert.equal(result.backportSourceBranch, "releases/v4");
-    assert.deepEqual(result.backportTargetBranches, ["releases/v3"]);
-  });
-
-  await it("backports to multiple older supported branches", () => {
-    const result = computeBackportBranches("v5", "v5.0.0", 3);
-    assert.equal(result.backportSourceBranch, "releases/v5");
-    assert.deepEqual(result.backportTargetBranches, [
-      "releases/v4",
-      "releases/v3",
-    ]);
-  });
-
-  await it("does not backport when major version is older than latest tag", () => {
-    const result = computeBackportBranches("v2", "v3.28.0", 2);
-    assert.equal(result.backportSourceBranch, "releases/v2");
-    assert.deepEqual(result.backportTargetBranches, []);
-  });
-});
@@ -1,121 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import { parseArgs } from "node:util";
-
-import * as core from "@actions/core";
-
-import { OLDEST_SUPPORTED_MAJOR_VERSION } from "./config";
-
-/** The results of checking which release branches to backport to.  */
-export interface BackportInfo {
-  /** The source release branch. */
-  backportSourceBranch: string;
-  /**
-   * The computed release branches we should backport to.
-   * Will be empty if there are no branches we need to backport to.
-   */
-  backportTargetBranches: string[];
-}
-
-/**
- * Compute the backport source and target branches for a release.
- *
- * @param majorVersion - The major version string (e.g. "v4").
- * @param latestTag - The most recent tag published to the repository (e.g. "v4.32.6").
- * @param oldestSupportedMajorVersion - The oldest supported major version number.
- * @returns The names of the source branch and target branches.
- */
-export function computeBackportBranches(
-  majorVersion: string,
-  latestTag: string,
-  oldestSupportedMajorVersion: number,
-): BackportInfo {
-  // Perform some sanity checks on the inputs.
-  // For `majorVersion`, we expect exactly `vN` for some `N`.
-  const majorVersionMatch = majorVersion.match(/^v(\d+)$/);
-  if (!majorVersionMatch) {
-    throw new Error("--major-version value must be in `vN` format.");
-  }
-
-  // For latestTag, we expect something starting with `vN.M.P`
-  const latestTagMatch = latestTag.match(/^v(\d+)\.\d+\.\d+/);
-  if (!latestTagMatch) {
-    throw new Error(
-      `--latest-tag value must be in 'vN.M.P' format, but '${latestTag}' is not.`,
-    );
-  }
-
-  const majorVersionNumber = Number.parseInt(majorVersionMatch[1]);
-  const latestTagMajor = Number.parseInt(latestTagMatch[1]);
-
-  // If this is a primary release, we backport to all supported branches,
-  // so we check whether the majorVersion taken from the package.json
-  // is greater than or equal to the latest tag pulled from the repo.
-  // For example...
-  //     'v1' >= 'v2' is False # we're operating from an older release branch and should not backport
-  //     'v2' >= 'v2' is True  # the normal case where we're updating the current version
-  //     'v3' >= 'v2' is True  # in this case we are making the first release of a new major version
-  const considerBackports = majorVersionNumber >= latestTagMajor;
-
-  const backportSourceBranch = `releases/v${majorVersionNumber}`;
-  const backportTargetBranches: string[] = [];
-
-  if (considerBackports) {
-    for (let i = majorVersionNumber - 1; i > 0; i--) {
-      const branchName = `releases/v${i}`;
-      if (i >= oldestSupportedMajorVersion) {
-        backportTargetBranches.push(branchName);
-      }
-    }
-  }
-
-  return { backportSourceBranch, backportTargetBranches };
-}
-
-async function main() {
-  const { values: options } = parseArgs({
-    options: {
-      // The major version of the release in `vN` format (e.g. `v4`).
-      "major-version": {
-        type: "string",
-      },
-      // The most recent tag published to the repository (e.g. `v4.28.0`).
-      "latest-tag": {
-        type: "string",
-      },
-    },
-    strict: true,
-  });
-
-  if (options["major-version"] === undefined) {
-    throw Error("--major-version is required");
-  }
-  if (options["latest-tag"] === undefined) {
-    throw Error("--latest-tag is required");
-  }
-
-  const majorVersion = options["major-version"];
-  const latestTag = options["latest-tag"];
-
-  console.log(`Major version: ${majorVersion}`);
-  console.log(`Latest tag: ${latestTag}`);
-
-  const result = computeBackportBranches(
-    majorVersion,
-    latestTag,
-    OLDEST_SUPPORTED_MAJOR_VERSION,
-  );
-
-  core.setOutput("backport_source_branch", result.backportSourceBranch);
-  core.setOutput(
-    "backport_target_branches",
-    JSON.stringify(result.backportTargetBranches),
-  );
-
-  process.exit(0);
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -1,60 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Tests for the sync-checks.ts script
-*/
-
-import * as assert from "node:assert/strict";
-import { describe, it } from "node:test";
-
-import { CheckInfo, Exclusions, Options, removeExcluded } from "./sync-checks";
-
-const defaultOptions: Options = {
-  apply: false,
-  verbose: false,
-};
-
-const toCheckInfo = (name: string) =>
-  ({ context: name, app_id: -1 }) satisfies CheckInfo;
-
-const expectedPartialMatches = ["PR Check - Foo", "https://example.com"].map(
-  toCheckInfo,
-);
-
-const expectedExactMatches = ["CodeQL", "Update"].map(toCheckInfo);
-
-const testChecks = expectedExactMatches.concat(expectedPartialMatches);
-
-const emptyExclusions: Exclusions = {
-  is: [],
-  contains: [],
-};
-
-describe("removeExcluded", async () => {
-  await it("retains all checks if no exclusions are configured", () => {
-    const retained = removeExcluded(
-      defaultOptions,
-      emptyExclusions,
-      testChecks,
-    );
-    assert.deepEqual(retained, testChecks);
-  });
-
-  await it("removes exact matches", () => {
-    const retained = removeExcluded(
-      defaultOptions,
-      { ...emptyExclusions, is: ["CodeQL", "Update"] },
-      testChecks,
-    );
-    assert.deepEqual(retained, expectedPartialMatches);
-  });
-
-  await it("removes partial matches", () => {
-    const retained = removeExcluded(
-      defaultOptions,
-      { ...emptyExclusions, contains: ["https://", "PR Check"] },
-      testChecks,
-    );
-    assert.deepEqual(retained, expectedExactMatches);
-  });
-});
@@ -1,287 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/** Update the required checks based on the current branch. */
-
-import * as fs from "fs";
-import { parseArgs } from "node:util";
-
-import * as yaml from "yaml";
-
-import { type ApiClient, getApiClient } from "./api-client";
-import {
-  OLDEST_SUPPORTED_MAJOR_VERSION,
-  PR_CHECK_EXCLUDED_FILE,
-} from "./config";
-
-/** Represents the command-line options. */
-export interface Options {
-  /** The token to use to authenticate to the GitHub API. */
-  token?: string;
-  /** The git ref to use the checks for. */
-  ref?: string;
-  /** Whether to actually apply the changes or not. */
-  apply: boolean;
-  /** Whether to output additional information. */
-  verbose: boolean;
-}
-
-/** Identifies the CodeQL Action repository. */
-const codeqlActionRepo = {
-  owner: "github",
-  repo: "codeql-action",
-};
-
-/** Represents a configuration of which checks should not be set up as required checks. */
-export interface Exclusions {
-  /** A list of strings that, if contained in a check name, are excluded. */
-  contains: string[];
-  /** A list of check names that are excluded if their name is an exact match. */
-  is: string[];
-}
-
-/** Loads the configuration for which checks to exclude. */
-function loadExclusions(): Exclusions {
-  return yaml.parse(
-    fs.readFileSync(PR_CHECK_EXCLUDED_FILE, "utf-8"),
-  ) as Exclusions;
-}
-
-/**
- * Represents information about a check run. We track the `app_id` that generated the check,
- * because the API will require it in addition to the name in the future.
- */
-export interface CheckInfo {
-  /** The display name of the check. */
-  context: string;
-  /** The ID of the app that generated the check. */
-  app_id: number;
-}
-
-/** Removes entries from `checkInfos` based on the configuration. */
-export function removeExcluded(
-  options: Options,
-  exclusions: Exclusions,
-  checkInfos: CheckInfo[],
-): CheckInfo[] {
-  if (options.verbose) {
-    console.log(exclusions);
-  }
-
-  return checkInfos.filter((checkInfo) => {
-    if (exclusions.is.includes(checkInfo.context)) {
-      console.info(
-        `Excluding '${checkInfo.context}' because it is an exact exclusion.`,
-      );
-      return false;
-    }
-
-    for (const containsStr of exclusions.contains) {
-      if (checkInfo.context.includes(containsStr)) {
-        console.info(
-          `Excluding '${checkInfo.context}' because it contains '${containsStr}'.`,
-        );
-        return false;
-      }
-    }
-
-    // Keep.
-    return true;
-  });
-}
-
-/** Gets a list of check run names for `ref`. */
-async function getChecksFor(
-  options: Options,
-  client: ApiClient,
-  ref: string,
-): Promise<CheckInfo[]> {
-  console.info(`Getting checks for '${ref}'`);
-
-  const response = await client.paginate(
-    "GET /repos/{owner}/{repo}/commits/{ref}/check-runs",
-    {
-      ...codeqlActionRepo,
-      ref,
-    },
-  );
-
-  if (response.length === 0) {
-    throw new Error(`No checks found for '${ref}'.`);
-  }
-
-  console.info(`Retrieved ${response.length} check runs.`);
-
-  const notSkipped = response.filter(
-    (checkRun) => checkRun.conclusion !== "skipped",
-  );
-  console.info(`Of those: ${notSkipped.length} were not skipped.`);
-
-  // We use the ID of the app that generated the check run when returned by the API,
-  // but default to -1 to tell the API that any check with the given name should be
-  // required.
-  const checkInfos = notSkipped.map((check) => ({
-    context: check.name,
-    app_id: check.app?.id || -1,
-  }));
-
-  // Load the configuration for which checks to exclude and apply it before
-  // returning the checks.
-  const exclusions = loadExclusions();
-  return removeExcluded(options, exclusions, checkInfos);
-}
-
-/** Gets the current list of release branches. */
-async function getReleaseBranches(client: ApiClient): Promise<string[]> {
-  const refs = await client.rest.git.listMatchingRefs({
-    ...codeqlActionRepo,
-    ref: "heads/releases/v",
-  });
-  return refs.data.map((ref) => ref.ref).sort();
-}
-
-/** Updates the required status checks for `branch` to `checks`. */
-async function patchBranchProtectionRule(
-  client: ApiClient,
-  branch: string,
-  checks: Set<string>,
-) {
-  await client.rest.repos.setStatusCheckContexts({
-    ...codeqlActionRepo,
-    branch,
-    contexts: Array.from(checks),
-  });
-}
-
-/** Sets `checkNames` as required checks for `branch`. */
-async function updateBranch(
-  options: Options,
-  client: ApiClient,
-  branch: string,
-  checkNames: Set<string>,
-) {
-  console.info(`Updating '${branch}'...`);
-
-  // Query the current set of required checks for this branch.
-  const currentContexts = await client.rest.repos.getAllStatusCheckContexts({
-    ...codeqlActionRepo,
-    branch,
-  });
-
-  // Identify which required checks we will remove and which ones we will add.
-  const currentCheckNames = new Set(currentContexts.data);
-  let additions = 0;
-  let removals = 0;
-  let unchanged = 0;
-
-  for (const currentCheck of currentCheckNames) {
-    if (!checkNames.has(currentCheck)) {
-      console.info(`- Removing '${currentCheck}' for branch '${branch}'`);
-      removals++;
-    } else {
-      unchanged++;
-    }
-  }
-  for (const newCheck of checkNames) {
-    if (!currentCheckNames.has(newCheck)) {
-      console.info(`+ Adding '${newCheck}' for branch '${branch}'`);
-      additions++;
-    }
-  }
-
-  console.info(
-    `For '${branch}': ${removals} removals; ${additions} additions; ${unchanged} unchanged`,
-  );
-
-  // Perform the update if there are changes and `--apply` was specified.
-  if (unchanged === checkNames.size && removals === 0 && additions === 0) {
-    console.info("Not applying changes because there is nothing to do.");
-  } else if (options.apply) {
-    await patchBranchProtectionRule(client, branch, checkNames);
-  } else {
-    console.info("Not applying changes because `--apply` was not specified.");
-  }
-}
-
-async function main(): Promise<void> {
-  const { values: options } = parseArgs({
-    options: {
-      // The token to use to authenticate to the API.
-      token: {
-        type: "string",
-      },
-      // The git ref for which to retrieve the check runs.
-      ref: {
-        type: "string",
-        default: "main",
-      },
-      // By default, we perform a dry-run. Setting `apply` to `true` actually applies the changes.
-      apply: {
-        type: "boolean",
-        default: false,
-      },
-      // Whether to output additional information.
-      verbose: {
-        type: "boolean",
-        default: false,
-      },
-    },
-    strict: true,
-  });
-
-  if (options.token === undefined) {
-    throw new Error("Missing --token");
-  }
-
-  console.info(
-    `Oldest supported major version is: ${OLDEST_SUPPORTED_MAJOR_VERSION}`,
-  );
-
-  // Initialise the API client.
-  const client = getApiClient(options.token);
-
-  // Find the check runs for the specified `ref` that we will later set as the required checks
-  // for the main and release branches.
-  const checkInfos = await getChecksFor(options, client, options.ref);
-  const checkNames = new Set(checkInfos.map((info) => info.context));
-
-  // Update the main branch.
-  await updateBranch(options, client, "main", checkNames);
-
-  // Retrieve the refs of the release branches.
-  const releaseBranches = await getReleaseBranches(client);
-  console.info(
-    `Found ${releaseBranches.length} release branches: ${releaseBranches.join(", ")}`,
-  );
-
-  for (const releaseBranchRef of releaseBranches) {
-    // Sanity check that the ref name is in the expected format and extract the major version.
-    const releaseBranchMatch = releaseBranchRef.match(
-      /^refs\/heads\/(releases\/v(\d+))/,
-    );
-    if (!releaseBranchMatch) {
-      console.warn(
-        `Branch ref '${releaseBranchRef}' not in the expected format.`,
-      );
-      continue;
-    }
-    const releaseBranch = releaseBranchMatch[1];
-    const releaseBranchMajor = Number.parseInt(releaseBranchMatch[2]);
-
-    // Update the required checks for this major version if it is still supported.
-    if (releaseBranchMajor < OLDEST_SUPPORTED_MAJOR_VERSION) {
-      console.info(
-        `Skipping '${releaseBranch}' since it is older than v${OLDEST_SUPPORTED_MAJOR_VERSION}`,
-      );
-      continue;
-    } else {
-      await updateBranch(options, client, releaseBranch, checkNames);
-    }
-  }
-
-  process.exit(0);
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -5,7 +5,7 @@ import * as path from "path";

 import * as yaml from "yaml";

-import { BuiltInLanguage } from "../src/languages";
+import { KnownLanguage } from "../src/languages";

 /** Known workflow input names. */
 enum KnownInputName {
@@ -57,12 +57,6 @@ interface Specification extends JobSpecification {
  collection?: string;
 }

-/** Minimal type to represent steps in Actions workflows. */
-interface Step {
-  name?: string;
-  [other: string]: any;
-}
-
 /** Represents job specifications. */
 interface JobSpecification {
  /** The display name for the check. */
@@ -73,7 +67,7 @@ interface JobSpecification {
  env?: Record<string, any>;

  /** The workflow steps specific to this check. */
-  steps: Step[];
+  steps: any[];

  installNode?: boolean;
  installGo?: boolean;
@@ -88,11 +82,11 @@ interface LanguageSetup {
  specProperty: keyof JobSpecification;
  /** The names of the known inputs which are required for this setup step. */
  inputs?: KnownInputName[];
-  steps: Step[];
+  steps: any[];
 }

-/** Describes partial mappings from built-in languages to their specific setup information. */
-type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
+/** Describes partial mappings from known languages to their specific setup information. */
+type LanguageSetups = Partial<Record<KnownLanguage, LanguageSetup>>;

 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
@@ -125,7 +119,7 @@ const defaultLanguageVersions = {
  java: "17",
  python: "3.13",
  csharp: "9.x",
-} as const satisfies Partial<Record<BuiltInLanguage, string>>;
+} as const satisfies Partial<Record<KnownLanguage, string>>;

 /** A mapping from known input names to their specifications. */
 const inputSpecs: WorkflowInputs = {
@@ -194,7 +188,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Go",
        uses: "actions/setup-go@v6",
        with: {
-          "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`,
+          "go-version":
+            "${{ inputs.go-version || '" + defaultLanguageVersions.go + "' }}",
          // to avoid potentially misleading autobuilder results where we expect it to download
          // dependencies successfully, but they actually come from a warm cache
          cache: false,
@@ -210,7 +205,10 @@ const languageSetups: LanguageSetups = {
        name: "Install Java",
        uses: "actions/setup-java@v5",
        with: {
-          "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
+          "java-version":
+            "${{ inputs.java-version || '" +
+            defaultLanguageVersions.java +
+            "' }}",
          distribution: "temurin",
        },
      },
@@ -224,7 +222,10 @@ const languageSetups: LanguageSetups = {
        name: "Install Python",
        uses: "actions/setup-python@v6",
        with: {
-          "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`,
+          "python-version":
+            "${{ inputs.python-version || '" +
+            defaultLanguageVersions.python +
+            "' }}",
        },
      },
    ],
@@ -237,7 +238,10 @@ const languageSetups: LanguageSetups = {
        name: "Install .NET",
        uses: "actions/setup-dotnet@v5",
        with: {
-          "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`,
+          "dotnet-version":
+            "${{ inputs.dotnet-version || '" +
+            defaultLanguageVersions.csharp +
+            "' }}",
        },
      },
    ],
@@ -359,12 +363,12 @@ function generateJobMatrix(
 */
 function getSetupSteps(checkSpecification: JobSpecification): {
  inputs: Set<KnownInputName>;
-  steps: Step[];
+  steps: any[];
 } {
  const inputs: Array<Set<KnownInputName>> = [];
-  const steps: Step[] = [];
+  const steps: any[] = [];

-  for (const language of Object.values(BuiltInLanguage).sort()) {
+  for (const language of Object.values(KnownLanguage).sort()) {
    const setupSpec = languageSetups[language];

    if (
@@ -422,7 +426,7 @@ function generateJob(
  const workflowInputs = setupInfo.inputs;

  // Construct the workflow steps needed for this check.
-  const steps: Step[] = [
+  const steps: any[] = [
    {
      name: "Check out repository",
      uses: "actions/checkout@v6",
@@ -643,7 +647,7 @@ function main(): void {

    let extraGroupName = "";
    for (const inputName of Object.keys(combinedInputs)) {
-      extraGroupName += `-\${{inputs.${inputName}}}`;
+      extraGroupName += "-${{inputs." + inputName + "}}";
    }

    const cron = new yaml.Scalar("0 5 * * *");
@@ -681,7 +685,7 @@ function main(): void {
      concurrency: {
        "cancel-in-progress":
          "${{ github.event_name == 'pull_request' || false }}",
-        group: `${checkName}-\${{github.ref}}${extraGroupName}`,
+        group: checkName + "-${{github.ref}}" + extraGroupName,
      },
      jobs: {
        [checkName]: checkJob,
@@ -705,7 +709,7 @@ function main(): void {
      combinedInputs = { ...combinedInputs, ...checkInputs };

      for (const inputName of Object.keys(checkInputs)) {
-        checkWith[inputName] = `\${{ inputs.${inputName} }}`;
+        checkWith[inputName] = "${{ inputs." + inputName + " }}";
      }

      jobs[checkName] = {
@@ -1,7 +1,7 @@
 #!/usr/bin/env npx tsx

 /*
-Tests for the sync-back.ts script
+Tests for the sync_back.ts script
 */

 import * as assert from "node:assert/strict";
@@ -14,7 +14,7 @@ import {
  scanGeneratedWorkflows,
  updateSyncTs,
  updateTemplateFiles,
-} from "./sync-back";
+} from "./sync_back";

 let testDir: string;
 let workflowDir: string;
@@ -38,8 +38,8 @@ afterEach(() => {
  fs.rmSync(testDir, { recursive: true, force: true });
 });

-describe("scanGeneratedWorkflows", async () => {
-  await it("basic workflow scanning", () => {
+describe("scanGeneratedWorkflows", () => {
+  it("basic workflow scanning", () => {
    /** Test basic workflow scanning functionality */
    const workflowContent = `
 name: Test Workflow
@@ -61,7 +61,7 @@ jobs:
    assert.equal(result["actions/setup-go"], "v6");
  });

-  await it("scanning workflows with version comments", () => {
+  it("scanning workflows with version comments", () => {
    /** Test scanning workflows with version comments */
    const workflowContent = `
 name: Test Workflow
@@ -86,7 +86,7 @@ jobs:
    assert.equal(result["actions/setup-python"], "v6 # Latest Python");
  });

-  await it("ignores local actions", () => {
+  it("ignores local actions", () => {
    /** Test that local actions (starting with ./) are ignored */
    const workflowContent = `
 name: Test Workflow
@@ -109,8 +109,8 @@ jobs:
  });
 });

-describe("updateSyncTs", async () => {
-  await it("updates sync.ts file", () => {
+describe("updateSyncTs", () => {
+  it("updates sync.ts file", () => {
    /** Test updating sync.ts file */
    const syncTsContent = `
 const steps = [
@@ -141,7 +141,7 @@ const steps = [
    assert.ok(updatedContent.includes('uses: "actions/setup-go@v6"'));
  });

-  await it("strips comments from versions", () => {
+  it("strips comments from versions", () => {
    /** Test updating sync.ts file when versions have comments */
    const syncTsContent = `
 const steps = [
@@ -168,7 +168,7 @@ const steps = [
    assert.ok(!updatedContent.includes("# Latest version"));
  });

-  await it("returns false when no changes are needed", () => {
+  it("returns false when no changes are needed", () => {
    /** Test that updateSyncTs returns false when no changes are needed */
    const syncTsContent = `
 const steps = [
@@ -190,8 +190,8 @@ const steps = [
  });
 });

-describe("updateTemplateFiles", async () => {
-  await it("updates template files", () => {
+describe("updateTemplateFiles", () => {
+  it("updates template files", () => {
    /** Test updating template files */
    const templateContent = `
 name: Test Template
@@ -220,7 +220,7 @@ steps:
    assert.ok(updatedContent.includes("uses: actions/setup-node@v5 # Latest"));
  });

-  await it("preserves version comments", () => {
+  it("preserves version comments", () => {
    /** Test that updating template files preserves version comments */
    const templateContent = `
 name: Test Template
@@ -232,7 +232,8 @@ steps:
    fs.writeFileSync(templatePath, templateContent);

    const actionVersions = {
-      "ruby/setup-ruby": "55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
+      "ruby/setup-ruby":
+        "55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0",
    };

    const result = updateTemplateFiles(checksDir, actionVersions);
@@ -17,8 +17,9 @@ those changes are properly synced back to the source templates. Regular workflow
 files are updated directly by Dependabot and don't need sync-back.
 */

-import * as fs from "fs";
 import { parseArgs } from "node:util";
+
+import * as fs from "fs";
 import * as path from "path";

 const THIS_DIR = __dirname;
@@ -32,9 +33,7 @@ const SYNC_TS_PATH = path.join(THIS_DIR, "sync.ts");
 * @param workflowDir - Path to .github/workflows directory
 * @returns Map from action names to their latest versions (including comments)
 */
-export function scanGeneratedWorkflows(
-  workflowDir: string,
-): Record<string, string> {
+export function scanGeneratedWorkflows(workflowDir: string): Record<string, string> {
  const actionVersions: Record<string, string> = {};

  const generatedFiles = fs
@@ -97,7 +96,10 @@ export function updateSyncTs(
    // variable - that's a risk we're happy to take since in that case the
    // PR checks will just fail.
    const escaped = actionName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const pattern = new RegExp(`(uses:\\s*")${escaped}@(?:[^"]+)(")`, "g");
+    const pattern = new RegExp(
+      `(uses:\\s*")${escaped}@(?:[^"]+)(")`,
+      "g",
+    );
    content = content.replace(pattern, `$1${actionName}@${version}$2`);
  }

@@ -139,7 +141,10 @@ export function updateTemplateFiles(
    )) {
      // Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment'
      const escaped = actionName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const pattern = new RegExp(`(uses:\\s+${escaped})@(?:[^@\n]+)`, "g");
+      const pattern = new RegExp(
+        `(uses:\\s+${escaped})@(?:[^@\n]+)`,
+        "g",
+      );
      content = content.replace(pattern, `$1@${versionWithComment}`);
    }

@@ -3,7 +3,6 @@
  "compilerOptions": {
    /* Basic Options */
    "lib": ["esnext"],
-    "module": "preserve",
    "rootDir": "..",
    "sourceMap": false,
    "noEmit": true,
@@ -1,131 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
- * Updates src/languages/builtin.json by querying the CodeQL CLI for:
- * - Languages that have default queries (via codeql-extractor.yml)
- * - Language aliases (via `codeql resolve languages --format=betterjson --extractor-include-aliases`)
- *
- * Usage:
- *   npx tsx pr-checks/update-builtin-languages.ts [path-to-codeql]
- *
- * If no path is given, falls back to "codeql".
- */
-
-import { execFileSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import * as yaml from "yaml";
-
-import { EnvVar } from "../src/environment";
-
-import { BUILTIN_LANGUAGES_FILE } from "./config";
-
-/** Resolve all known language extractor directories. */
-function resolveLanguages(codeqlPath: string): Record<string, string[]> {
-  return JSON.parse(
-    execFileSync(codeqlPath, ["resolve", "languages", "--format=json"], {
-      encoding: "utf8",
-      env: {
-        ...process.env,
-        [EnvVar.EXPERIMENTAL_FEATURES]: "true", // include experimental languages
-      },
-    }),
-  ) as Record<string, string[]>;
-}
-
-/**
- * Return the sorted list of languages whose extractors ship default queries.
- *
- * @param extractorDirs - Map from language to list of extractor directories
- */
-function findLanguagesWithDefaultQueries(
-  extractorDirs: Record<string, string[]>,
-): string[] {
-  const languages: string[] = [];
-
-  for (const [language, dirs] of Object.entries(extractorDirs)) {
-    if (dirs.length !== 1) {
-      throw new Error(
-        `Expected exactly one extractor directory for language '${language}', but found ${dirs.length}: ${dirs.join(
-          ", ",
-        )}`,
-      );
-    }
-
-    const extractorYmlPath = path.join(dirs[0], "codeql-extractor.yml");
-
-    if (!fs.existsSync(extractorYmlPath)) {
-      throw new Error(
-        `Extractor YAML not found for language '${language}' at expected path: ${extractorYmlPath}`,
-      );
-    }
-
-    const extractorYml = yaml.parse(fs.readFileSync(extractorYmlPath, "utf8"));
-    const defaultQueries: unknown[] | undefined = extractorYml.default_queries;
-
-    if (Array.isArray(defaultQueries) && defaultQueries.length > 0) {
-      console.log(
-        `  ✅ ${language}: included (default queries: ${JSON.stringify(defaultQueries)})`,
-      );
-      languages.push(language);
-    } else {
-      console.log(`  ❌ ${language}: excluded (no default queries)`);
-    }
-  }
-
-  return languages.sort();
-}
-
-/**
- * Resolve language aliases from the CodeQL CLI, keeping only those whose
- * target is in the given set of included languages.
- */
-function resolveAliases(
-  codeqlPath: string,
-  includedLanguages: Set<string>,
-): Record<string, string> {
-  const betterjsonOutput = JSON.parse(
-    execFileSync(
-      codeqlPath,
-      [
-        "resolve",
-        "languages",
-        "--format=betterjson",
-        "--extractor-include-aliases",
-      ],
-      { encoding: "utf8" },
-    ),
-  );
-
-  return Object.fromEntries(
-    Object.entries((betterjsonOutput.aliases ?? {}) as Record<string, string>)
-      .filter(([, target]) => includedLanguages.has(target))
-      .sort(([a], [b]) => a.localeCompare(b)),
-  );
-}
-
-/** Write the built-in languages data to disk. */
-function writeBuiltinLanguages(
-  languages: string[],
-  aliases: Record<string, string>,
-): void {
-  const content = `${JSON.stringify({ languages, aliases }, null, 2)}\n`;
-  fs.mkdirSync(path.dirname(BUILTIN_LANGUAGES_FILE), { recursive: true });
-  fs.writeFileSync(BUILTIN_LANGUAGES_FILE, content);
-
-  console.log(`\nWrote ${BUILTIN_LANGUAGES_FILE}`);
-  console.log(`  Languages: ${languages.join(", ")}`);
-  console.log(`  Aliases: ${Object.keys(aliases).join(", ")}`);
-}
-
-function main(): void {
-  const codeqlPath = process.argv[2] || "codeql";
-
-  const extractorDirs = resolveLanguages(codeqlPath);
-  const languages = findLanguagesWithDefaultQueries(extractorDirs);
-  const aliases = resolveAliases(codeqlPath, new Set(languages));
-  writeBuiltinLanguages(languages, aliases);
-}
-
-main();
@@ -22,4 +22,4 @@ outputs:
    description: The inferred build environment configuration.
 runs:
  using: node24
-  main: '../lib/resolve-environment-entry.js'
+  main: '../lib/resolve-environment-action.js'
@@ -19,25 +19,6 @@ inputs:
      If not specified, the Action will check in several places until it finds
      the CodeQL tools.
    required: false
-  languages:
-    description: >-
-      A comma-separated list of CodeQL languages that will be analyzed in subsequent
-      `github/codeql-action/init` and `github/codeql-action/analyze` invocations. If specified, the
-      Action may use this list to select a CodeQL CLI version that is best suited to analyzing those
-      languages, for example by preferring a version that has a cached overlay-base database for the
-      specified languages. This input is not remembered and must also be passed to
-      `github/codeql-action/init`.
-    required: false
-  analysis-kinds:
-    description: >-
-      [Internal] A comma-separated list of analysis kinds that subsequent
-      `github/codeql-action/init` invocations will enable. If specified, the Action may use this
-      list to select a CodeQL CLI version that is best suited to those analysis kinds. This input is
-      not remembered and must also be passed to `github/codeql-action/init`.
-
-      Available options are the same as for the `analysis-kinds` input on the `init` Action.
-    default: 'code-scanning'
-    required: true
  token:
    description: GitHub token to use for authenticating with this instance of GitHub.
    default: ${{ github.token }}
@@ -55,4 +36,4 @@ outputs:
    description: The version of the CodeQL binary that was installed.
 runs:
  using: node24
-  main: '../lib/setup-codeql-entry.js'
+  main: '../lib/setup-codeql-action.js'
@@ -1,4 +0,0 @@
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.run__ACTION__)();
@@ -5,6 +5,7 @@ import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";
+import { JSONSchemaForNPMPackageJsonFiles } from "@schemastore/package";

 import type { Config } from "./config-utils";
 import { Logger } from "./logging";
@@ -15,11 +16,8 @@ import {
  ConfigurationError,
 } from "./util";

-/**
- * This constant is set to the value of the `"version"` property in `package.json` by `esbuild`.
- * It is also set in `ava.setup.mjs` for tests.
- */
-declare const __CODEQL_ACTION_VERSION__: string;
+// eslint-disable-next-line import/no-commonjs, @typescript-eslint/no-require-imports
+const pkg = require("../package.json") as JSONSchemaForNPMPackageJsonFiles;

 /**
 * Wrapper around core.getInput for inputs that always have a value.
@@ -53,14 +51,8 @@ export function getTemporaryDirectory(): string {
    : getRequiredEnvParam("RUNNER_TEMP");
 }

-const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-
-export function getDiffRangesJsonFilePath(): string {
-  return path.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
-}
-
 export function getActionVersion(): string {
-  return __CODEQL_ACTION_VERSION__;
+  return pkg.version!;
 }

 /**
@@ -16,7 +16,7 @@ import {
 } from "./analyses";
 import { EnvVar } from "./environment";
 import { getRunnerLogger } from "./logging";
-import { createFeatures, RecordingLogger, setupTests } from "./testing-utils";
+import { setupTests } from "./testing-utils";
 import { AssessmentPayload } from "./upload-lib/types";
 import { ConfigurationError } from "./util";

@@ -53,56 +53,24 @@ test("Parsing analysis kinds requires at least one analysis kind", async (t) =>
 test.serial(
  "getAnalysisKinds - returns expected analysis kinds for `analysis-kinds` input",
  async (t) => {
-    process.env[EnvVar.TEST_MODE] = "true";
-    const features = createFeatures([]);
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub
      .withArgs("analysis-kinds")
      .returns("code-scanning,code-quality");
-    const result = await getAnalysisKinds(
-      getRunnerLogger(true),
-      features,
-      true,
-    );
+    const result = await getAnalysisKinds(getRunnerLogger(true), true);
    t.assert(result.includes(AnalysisKind.CodeScanning));
    t.assert(result.includes(AnalysisKind.CodeQuality));
  },
 );

-test.serial(
-  "getAnalysisKinds - only use `code-scanning` for multiple analysis kinds outside of test mode",
-  async (t) => {
-    process.env[EnvVar.TEST_MODE] = "false";
-    const features = createFeatures([]);
-    const logger = new RecordingLogger();
-    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-    requiredInputStub
-      .withArgs("analysis-kinds")
-      .returns("code-scanning,code-quality");
-    const result = await getAnalysisKinds(logger, features, true);
-    t.deepEqual(result, [AnalysisKind.CodeScanning]);
-    t.assert(
-      logger.hasMessage(
-        "Continuing with only `analysis-kinds: code-scanning`.",
-      ),
-    );
-  },
-);
-
 test.serial(
  "getAnalysisKinds - includes `code-quality` when deprecated `quality-queries` input is used",
  async (t) => {
-    process.env[EnvVar.TEST_MODE] = "true";
-    const features = createFeatures([]);
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub.withArgs("analysis-kinds").returns("code-scanning");
    const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
    optionalInputStub.withArgs("quality-queries").returns("code-quality");
-    const result = await getAnalysisKinds(
-      getRunnerLogger(true),
-      features,
-      true,
-    );
+    const result = await getAnalysisKinds(getRunnerLogger(true), true);
    t.assert(result.includes(AnalysisKind.CodeScanning));
    t.assert(result.includes(AnalysisKind.CodeQuality));
  },
@@ -111,12 +79,9 @@ test.serial(
 test.serial(
  "getAnalysisKinds - throws if `analysis-kinds` input is invalid",
  async (t) => {
-    const features = createFeatures([]);
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub.withArgs("analysis-kinds").returns("no-such-thing");
-    await t.throwsAsync(
-      getAnalysisKinds(getRunnerLogger(true), features, true),
-    );
+    await t.throwsAsync(getAnalysisKinds(getRunnerLogger(true), true));
  },
 );

@@ -133,17 +98,11 @@ for (let i = 0; i < analysisKinds.length; i++) {
      test.serial(
        `getAnalysisKinds - allows ${analysisKind} with ${otherAnalysis}`,
        async (t) => {
-          process.env[EnvVar.TEST_MODE] = "true";
-          const features = createFeatures([]);
          const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
          requiredInputStub
            .withArgs("analysis-kinds")
            .returns([analysisKind, otherAnalysis].join(","));
-          const result = await getAnalysisKinds(
-            getRunnerLogger(true),
-            features,
-            true,
-          );
+          const result = await getAnalysisKinds(getRunnerLogger(true), true);
          t.is(result.length, 2);
        },
      );
@@ -151,18 +110,14 @@ for (let i = 0; i < analysisKinds.length; i++) {
      test.serial(
        `getAnalysisKinds - throws if ${analysisKind} is enabled with ${otherAnalysis}`,
        async (t) => {
-          const features = createFeatures([]);
          const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
          requiredInputStub
            .withArgs("analysis-kinds")
            .returns([analysisKind, otherAnalysis].join(","));
-          await t.throwsAsync(
-            getAnalysisKinds(getRunnerLogger(true), features, true),
-            {
-              instanceOf: ConfigurationError,
-              message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,
-            },
-          );
+          await t.throwsAsync(getAnalysisKinds(getRunnerLogger(true), true), {
+            instanceOf: ConfigurationError,
+            message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,
+          });
        },
      );
    }
@@ -4,14 +4,13 @@ import {
  getRequiredInput,
 } from "./actions-util";
 import { EnvVar } from "./environment";
-import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
 import {
  AssessmentPayload,
  BasePayload,
  UploadPayload,
 } from "./upload-lib/types";
-import { ConfigurationError, getRequiredEnvParam, isInTestMode } from "./util";
+import { ConfigurationError, getRequiredEnvParam } from "./util";

 export enum AnalysisKind {
  CodeScanning = "code-scanning",
@@ -78,7 +77,6 @@ let cachedAnalysisKinds: AnalysisKind[] | undefined;
 */
 export async function getAnalysisKinds(
  logger: Logger,
-  features: FeatureEnablement,
  skipCache: boolean = false,
 ): Promise<AnalysisKind[]> {
  if (!skipCache && cachedAnalysisKinds !== undefined) {
@@ -122,25 +120,6 @@ export async function getAnalysisKinds(
    }
  }

-  // Log an error if we have multiple inputs for `analysis-kinds` outside of test mode,
-  // and enable only `code-scanning`.
-  if (
-    !isInTestMode() &&
-    analysisKinds.length > 1 &&
-    !(await features.getValue(Feature.AllowMultipleAnalysisKinds))
-  ) {
-    logger.error(
-      "The `analysis-kinds` input is experimental and for GitHub-internal use only. " +
-        "Its behaviour may change at any time or be removed entirely. " +
-        "Specifying multiple values as input is no longer supported. " +
-        "Continuing with only `analysis-kinds: code-scanning`.",
-    );
-
-    // Only enable Code Scanning.
-    cachedAnalysisKinds = [AnalysisKind.CodeScanning];
-    return cachedAnalysisKinds;
-  }
-
  // Cache the analysis kinds and return them.
  cachedAnalysisKinds = analysisKinds;
  return cachedAnalysisKinds;
@@ -3,7 +3,6 @@ import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
 import * as analyze from "./analyze";
-import { runWrapper } from "./analyze-action";
 import * as api from "./api-client";
 import * as configUtils from "./config-utils";
 import * as gitUtils from "./git-utils";
@@ -63,8 +62,14 @@ test("analyze action with RAM & threads from environment variables", async (t) =

    const runFinalizeStub = sinon.stub(analyze, "runFinalize");
    const runQueriesStub = sinon.stub(analyze, "runQueries");
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const analyzeAction = require("./analyze-action");

-    await runWrapper();
+    // When analyze-action.ts loads, it runs an async function from the top
+    // level but does not wait for it to finish. To ensure that calls to
+    // runFinalize and runQueries are correctly captured by spies, we explicitly
+    // wait for the action promise to complete before starting verification.
+    await analyzeAction.runPromise;

    t.assert(
      runFinalizeStub.calledOnceWith(
@@ -3,7 +3,6 @@ import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
 import * as analyze from "./analyze";
-import { runWrapper } from "./analyze-action";
 import * as api from "./api-client";
 import * as configUtils from "./config-utils";
 import * as gitUtils from "./git-utils";
@@ -61,8 +60,14 @@ test("analyze action with RAM & threads from action inputs", async (t) => {

    const runFinalizeStub = sinon.stub(analyze, "runFinalize");
    const runQueriesStub = sinon.stub(analyze, "runQueries");
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const analyzeAction = require("./analyze-action");

-    await runWrapper();
+    // When analyze-action.ts loads, it runs an async function from the top
+    // level but does not wait for it to finish. To ensure that calls to
+    // runFinalize and runQueries are correctly captured by spies, we explicitly
+    // wait for the action promise to complete before starting verification.
+    await analyzeAction.runPromise;

    t.assert(
      runFinalizeStub.calledOnceWith(
@@ -20,7 +20,7 @@ import { EnvVar } from "./environment";
 import { getActionsLogger } from "./logging";
 import { checkGitHubVersionInRange, getErrorMessage } from "./util";

-export async function runWrapper() {
+async function runWrapper() {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -72,3 +72,5 @@ export async function runWrapper() {
    );
  }
 }
+
+void runWrapper();
@@ -28,11 +28,12 @@ import {
  DependencyCacheUploadStatusReport,
  uploadDependencyCaches,
 } from "./dependency-caching";
+import { getDiffInformedAnalysisBranches } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
-import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay/caching";
+import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay";
 import { getRepositoryNwo } from "./repository";
 import * as statusReport from "./status-report";
 import {
@@ -135,13 +136,9 @@ function hasBadExpectErrorInput(): boolean {
 function doesGoExtractionOutputExist(config: Config): boolean {
  const golangDbDirectory = util.getCodeQLDatabasePath(
    config,
-    BuiltInLanguage.go,
-  );
-  const trapDirectory = path.join(
-    golangDbDirectory,
-    "trap",
-    BuiltInLanguage.go,
+    KnownLanguage.go,
  );
+  const trapDirectory = path.join(golangDbDirectory, "trap", KnownLanguage.go);
  return (
    fs.existsSync(trapDirectory) &&
    fs
@@ -173,7 +170,7 @@ function doesGoExtractionOutputExist(config: Config): boolean {
 * whether any extraction output already exists for Go.
 */
 async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
-  if (!config.languages.includes(BuiltInLanguage.go)) {
+  if (!config.languages.includes(KnownLanguage.go)) {
    return;
  }
  if (config.buildMode) {
@@ -186,7 +183,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
    logger.debug("Won't run Go autobuild since it has already been run.");
    return;
  }
-  if (dbIsFinalized(config, BuiltInLanguage.go, logger)) {
+  if (dbIsFinalized(config, KnownLanguage.go, logger)) {
    logger.debug(
      "Won't run Go autobuild since there is already a finalized database for Go.",
    );
@@ -209,7 +206,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  logger.debug(
    "Running Go autobuild because extraction output (TRAP files) for Go code has not been found.",
  );
-  await runAutobuild(config, BuiltInLanguage.go, logger);
+  await runAutobuild(config, KnownLanguage.go, logger);
 }

 async function run(startedAt: Date) {
@@ -308,8 +305,14 @@ async function run(startedAt: Date) {
      logger,
    );

-    // Setup diff informed analysis if needed (based on whether init created the file)
-    const diffRangePackDir = await setupDiffInformedQueryRun(logger);
+    const branches = await getDiffInformedAnalysisBranches(
+      codeql,
+      features,
+      logger,
+    );
+    const diffRangePackDir = branches
+      ? await setupDiffInformedQueryRun(branches, logger)
+      : undefined;

    await warnIfGoInstalledAfterInit(config, logger);
    await runAutobuildIfLegacyGoWorkflow(config, logger);
@@ -523,11 +526,14 @@ async function run(startedAt: Date) {
  }
 }

-export async function runWrapper() {
-  const startedAt = new Date();
+// Module-level startedAt so it can be accessed by runWrapper for error reporting
+const startedAt = new Date();
+export const runPromise = run(startedAt);
+
+async function runWrapper() {
  const logger = getActionsLogger();
  try {
-    await run(startedAt);
+    await runPromise;
  } catch (error) {
    core.setFailed(`analyze action failed: ${util.getErrorMessage(error)}`);
    await sendUnhandledErrorStatusReport(
@@ -539,3 +545,5 @@ export async function runWrapper() {
  }
  await util.checkForTimeout();
 }
+
+void runWrapper();
@@ -10,11 +10,10 @@ import {
  defaultSuites,
  resolveQuerySuiteAlias,
  addSarifExtension,
-  diffRangeExtensionPackContents,
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
 import { Feature } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
  setupTests,
@@ -41,7 +40,7 @@ test.serial("status report fields", async (t) => {
    const threadsFlag = "";
    sinon.stub(uploadLib, "validateSarifFileSchema");

-    for (const language of Object.values(BuiltInLanguage)) {
+    for (const language of Object.values(KnownLanguage)) {
      const codeql = createStubCodeQL({
        databaseRunQueries: async () => {},
        databaseInterpretResults: async (
@@ -130,13 +129,13 @@ test.serial("status report fields", async (t) => {
 test("resolveQuerySuiteAlias", (t) => {
  // default query suite names should resolve to something language-specific ending in `.qls`.
  for (const suite of defaultSuites) {
-    const resolved = resolveQuerySuiteAlias(BuiltInLanguage.go, suite);
+    const resolved = resolveQuerySuiteAlias(KnownLanguage.go, suite);
    t.assert(
      path.extname(resolved) === ".qls",
      "Resolved default suite doesn't end in .qls",
    );
    t.assert(
-      resolved.indexOf(BuiltInLanguage.go) >= 0,
+      resolved.indexOf(KnownLanguage.go) >= 0,
      "Resolved default suite doesn't contain language name",
    );
  }
@@ -145,12 +144,12 @@ test("resolveQuerySuiteAlias", (t) => {
  const names = ["foo", "bar", "codeql/go-queries@1.0"];

  for (const name of names) {
-    t.deepEqual(resolveQuerySuiteAlias(BuiltInLanguage.go, name), name);
+    t.deepEqual(resolveQuerySuiteAlias(KnownLanguage.go, name), name);
  }
 });

 test("addSarifExtension", (t) => {
-  for (const language of Object.values(BuiltInLanguage)) {
+  for (const language of Object.values(KnownLanguage)) {
    t.deepEqual(addSarifExtension(CodeScanning, language), `${language}.sarif`);
    t.deepEqual(
      addSarifExtension(CodeQuality, language),
@@ -159,22 +158,3 @@ test("addSarifExtension", (t) => {
    t.is(addSarifExtension(RiskAssessment, language), `${language}.csra.sarif`);
  }
 });
-
-test("diffRangeExtensionPackContents", (t) => {
-  const output = diffRangeExtensionPackContents(
-    [
-      {
-        path: "main.js",
-        startLine: 10,
-        endLine: 20,
-      },
-    ],
-    "/checkout/path",
-  );
-
-  const expected = fs.readFileSync(
-    `${__dirname}/../src/testdata/pr-diff-range.yml`,
-    "utf8",
-  );
-  t.deepEqual(output, expected);
-});
@@ -5,7 +5,7 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";

-import { getTemporaryDirectory, getRequiredInput } from "./actions-util";
+import { getTemporaryDirectory, PullRequestBranches } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
@@ -17,13 +17,14 @@ import {
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
  DiffThunkRange,
-  readDiffRangesJsonFile,
+  writeDiffRangesJsonFile,
+  getPullRequestEditedDiffRanges,
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import type * as sarif from "./sarif";
 import { DatabaseCreationTimings, EventReport } from "./status-report";
 import { endTracingForCluster } from "./tracer-config";
@@ -41,7 +42,7 @@ export class CodeQLAnalysisError extends Error {
  }
 }

-type BuiltInLanguageKey = keyof typeof BuiltInLanguage;
+type KnownLanguageKey = keyof typeof KnownLanguage;

 type RunQueriesDurationStatusReport = {
  /**
@@ -50,12 +51,12 @@ type RunQueriesDurationStatusReport = {
   * The "builtin" designation is now outdated with the move to CLI config parsing: this is the time
   * taken to run _all_ the queries.
   */
-  [L in BuiltInLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
 };

 type InterpretResultsDurationStatusReport = {
  /** Time taken in ms to interpret results for the language (or undefined if this language was not analyzed). */
-  [L in BuiltInLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
 };

 export interface QueriesStatusReport
@@ -115,12 +116,12 @@ export async function runExtraction(

    if (await shouldExtractLanguage(codeql, config, language)) {
      logger.startGroup(`Extracting ${language}`);
-      if (language === BuiltInLanguage.python) {
+      if (language === KnownLanguage.python) {
        await setupPythonExtractor(logger);
      }
      if (config.buildMode) {
        if (
-          language === BuiltInLanguage.cpp &&
+          language === KnownLanguage.cpp &&
          config.buildMode === BuildMode.Autobuild
        ) {
          await setupCppAutobuild(codeql, logger);
@@ -131,14 +132,14 @@ export async function runExtraction(
        // a stable path that caches can be restored into and that we can cache at the
        // end of the workflow (i.e. that does not get removed when the scratch directory is).
        if (
-          language === BuiltInLanguage.java &&
+          language === KnownLanguage.java &&
          config.buildMode === BuildMode.None
        ) {
          process.env["CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_DEPENDENCY_DIR"] =
            getJavaTempDependencyDir();
        }
        if (
-          language === BuiltInLanguage.csharp &&
+          language === KnownLanguage.csharp &&
          config.buildMode === BuildMode.None &&
          (await features.getValue(Feature.CsharpCacheBuildModeNone))
        ) {
@@ -232,73 +233,32 @@ async function finalizeDatabaseCreation(
 * the diff range information, or `undefined` if the feature is disabled.
 */
 export async function setupDiffInformedQueryRun(
+  branches: PullRequestBranches,
  logger: Logger,
 ): Promise<string | undefined> {
  return await withGroupAsync(
    "Generating diff range extension pack",
    async () => {
-      const diffRanges = readDiffRangesJsonFile(logger);
-      if (diffRanges === undefined) {
-        logger.info(
-          "No precomputed diff ranges found; skipping diff-informed analysis stage.",
-        );
-        return undefined;
-      }
-
-      const checkoutPath = getRequiredInput("checkout_path");
-      const packDir = writeDiffRangeDataExtensionPack(
-        logger,
-        diffRanges,
-        checkoutPath,
-      );
      logger.info(
-        `Successfully created diff range extension pack at ${packDir}.`,
+        `Calculating diff ranges for ${branches.base}...${branches.head}`,
      );
+      const diffRanges = await getPullRequestEditedDiffRanges(branches, logger);
+      const packDir = writeDiffRangeDataExtensionPack(logger, diffRanges);
+      if (packDir === undefined) {
+        logger.warning(
+          "Cannot create diff range extension pack for diff-informed queries; " +
+            "reverting to performing full analysis.",
+        );
+      } else {
+        logger.info(
+          `Successfully created diff range extension pack at ${packDir}.`,
+        );
+      }
      return packDir;
    },
  );
 }

-export function diffRangeExtensionPackContents(
-  ranges: DiffThunkRange[],
-  checkoutPath: string,
-): string {
-  const header = `
-extensions:
-  - addsTo:
-      pack: codeql/util
-      extensible: restrictAlertsTo
-      checkPresence: false
-    data:
-`;
-
-  let data = ranges
-    .map((range) => {
-      // Diff-informed queries expect the file path to be absolute. CodeQL always
-      // uses forward slashes as the path separator, so on Windows we need to
-      // replace any backslashes with forward slashes.
-      const filename = path
-        .join(checkoutPath, range.path)
-        .replaceAll(path.sep, "/");
-
-      // Using yaml.dump() with `forceQuotes: true` ensures that all special
-      // characters are escaped, and that the path is always rendered as a
-      // quoted string on a single line.
-      return (
-        `      - [${yaml.dump(filename, { forceQuotes: true }).trim()}, ` +
-        `${range.startLine}, ${range.endLine}]\n`
-      );
-    })
-    .join("");
-  if (!data) {
-    // Ensure that the data extension is not empty, so that a pull request with
-    // no edited lines would exclude (instead of accepting) all alerts.
-    data = '      - ["", 0, 0]\n';
-  }
-
-  return header + data;
-}
-
 /**
 * Create an extension pack in the temporary directory that contains the file
 * line ranges that were added or modified in the pull request.
@@ -306,14 +266,17 @@ extensions:
 * @param logger
 * @param ranges The file line ranges, as returned by
 * `getPullRequestEditedDiffRanges`.
- * @param checkoutPath The path at which the repository was checked out.
- * @returns The absolute path of the directory containing the extension pack.
+ * @returns The absolute path of the directory containing the extension pack, or
+ * `undefined` if no extension pack was created.
 */
 function writeDiffRangeDataExtensionPack(
  logger: Logger,
-  ranges: DiffThunkRange[],
-  checkoutPath: string,
-): string {
+  ranges: DiffThunkRange[] | undefined,
+): string | undefined {
+  if (ranges === undefined) {
+    return undefined;
+  }
+
  if (ranges.length === 0) {
    // An empty diff range means that there are no added or modified lines in
    // the pull request. But the `restrictAlertsTo` extensible predicate
@@ -344,16 +307,42 @@ dataExtensions:
 `,
  );

-  const extensionContents = diffRangeExtensionPackContents(
-    ranges,
-    checkoutPath,
-  );
+  const header = `
+extensions:
+  - addsTo:
+      pack: codeql/util
+      extensible: restrictAlertsTo
+      checkPresence: false
+    data:
+`;
+
+  let data = ranges
+    .map(
+      (range) =>
+        // Using yaml.dump() with `forceQuotes: true` ensures that all special
+        // characters are escaped, and that the path is always rendered as a
+        // quoted string on a single line.
+        `      - [${yaml.dump(range.path, { forceQuotes: true }).trim()}, ` +
+        `${range.startLine}, ${range.endLine}]\n`,
+    )
+    .join("");
+  if (!data) {
+    // Ensure that the data extension is not empty, so that a pull request with
+    // no edited lines would exclude (instead of accepting) all alerts.
+    data = '      - ["", 0, 0]\n';
+  }
+
+  const extensionContents = header + data;
  const extensionFilePath = path.join(diffRangeDir, "pr-diff-range.yml");
  fs.writeFileSync(extensionFilePath, extensionContents);
  logger.debug(
    `Wrote pr-diff-range extension pack to ${extensionFilePath}:\n${extensionContents}`,
  );

+  // Write the diff ranges to a JSON file, for action-side alert filtering by the
+  // upload-lib module.
+  writeDiffRangesJsonFile(logger, ranges);
+
  return diffRangeDir;
 }

@@ -686,7 +675,7 @@ export async function warnIfGoInstalledAfterInit(

      addDiagnostic(
        config,
-        BuiltInLanguage.go,
+        KnownLanguage.go,
        makeDiagnostic(
          "go/workflow/go-installed-after-codeql-init",
          "Go was installed after the `codeql-action/init` Action was run",
@@ -128,8 +128,6 @@ export async function getGitHubVersionFromApi(

  // Doesn't strictly have to be the meta endpoint as we're only
  // using the response headers which are available on every request.
-  //
-  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
  const response = await apiClient.rest.meta.get();

@@ -166,9 +164,6 @@ export async function getGitHubVersion(): Promise<GitHubVersion> {

 /**
 * Get the path of the currently executing workflow relative to the repository root.
- *
- * See https://docs.github.com/en/rest/actions/workflow-runs#get-a-workflow-run
- * and https://docs.github.com/en/rest/actions/workflows#get-a-workflow.
 */
 export async function getWorkflowRelativePath(): Promise<string> {
  const repo_nwo = getRepositoryNwo();
@@ -257,13 +252,9 @@ export interface ActionsCacheItem {
  size_in_bytes?: number;
 }

-/**
- * List all Actions cache entries starting with the provided key prefix and matching the provided ref.
- *
- * See https://docs.github.com/en/rest/actions/cache#list-github-actions-caches-for-a-repository.
- */
+/** List all Actions cache entries matching the provided key and ref. */
 export async function listActionsCaches(
-  keyPrefix: string,
+  key: string,
  ref?: string,
 ): Promise<ActionsCacheItem[]> {
  const repositoryNwo = getRepositoryNwo();
@@ -273,17 +264,13 @@ export async function listActionsCaches(
    {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
-      key: keyPrefix,
+      key,
      ref,
    },
  );
 }

-/**
- * Delete an Actions cache item by its ID.
- *
- * See https://docs.github.com/en/rest/actions/cache#delete-a-github-actions-cache-for-a-repository-using-a-cache-id.
- */
+/** Delete an Actions cache item by its ID. */
 export async function deleteActionsCache(id: number) {
  const repositoryNwo = getRepositoryNwo();

@@ -294,11 +281,7 @@ export async function deleteActionsCache(id: number) {
  });
 }

-/**
- * Retrieve all custom repository properties.
- *
- * See https://docs.github.com/en/rest/repos/custom-properties#get-all-custom-property-values-for-a-repository.
- */
+/** Retrieve all custom repository properties. */
 export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
  return getApiClient().request("GET /repos/:owner/:repo/properties/values", {
    owner: repositoryNwo.owner,
@@ -1 +1 @@
-{"maximumVersion": "3.21", "minimumVersion": "3.16"}
+{"maximumVersion": "3.21", "minimumVersion": "3.14"}
@@ -141,9 +141,9 @@ test("scanArtifactsForTokens handles files without tokens", async (t) => {
  }
 });

-// `scanArchiveFile` does not support Windows, so we skip this test there.
 if (os.platform() !== "win32") {
  test("scanArtifactsForTokens finds token in debug artifacts", async (t) => {
+    t.timeout(15000); // 15 seconds
    const messages: LoggedMessage[] = [];
    const logger = getRecordingLogger(messages, { logToConsole: false });
    // The zip here is a regression test based on
@@ -156,10 +156,6 @@ async function scanArchiveFile(
    );
  }

-  if (process.platform === "win32") {
-    throw new Error("Scanning archives is not supported on Windows.");
-  }
-
  const result: ScanResult = {
    scannedFiles: 0,
    findings: [],
@@ -142,7 +142,7 @@ async function run(startedAt: Date) {
  await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
 }

-export async function runWrapper() {
+async function runWrapper() {
  const startedAt = new Date();
  const logger = getActionsLogger();
  try {
@@ -157,3 +157,5 @@ export async function runWrapper() {
    );
  }
 }
+
+void runWrapper();
@@ -7,7 +7,7 @@ import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
 import { EnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
 import { asyncFilter, BuildMode } from "./util";
@@ -72,7 +72,7 @@ export async function determineAutobuildLanguages(
   * version of the CodeQL Action.
   */
  const autobuildLanguagesWithoutGo = autobuildLanguages.filter(
-    (l) => l !== BuiltInLanguage.go,
+    (l) => l !== KnownLanguage.go,
  );

  const languages: Language[] = [];
@@ -84,7 +84,7 @@ export async function determineAutobuildLanguages(
  // If Go is requested, run the Go autobuilder last to ensure it doesn't
  // interfere with the other autobuilder.
  if (autobuildLanguages.length !== autobuildLanguagesWithoutGo.length) {
-    languages.push(BuiltInLanguage.go);
+    languages.push(KnownLanguage.go);
  }

  logger.debug(`Will autobuild ${languages.join(" and ")}.`);
@@ -156,7 +156,7 @@ export async function runAutobuild(
 ) {
  logger.startGroup(`Attempting to automatically build ${language} code`);
  const codeQL = await getCodeQL(config.codeQLCmd);
-  if (language === BuiltInLanguage.cpp) {
+  if (language === KnownLanguage.cpp) {
    await setupCppAutobuild(codeQL, logger);
  }
  if (config.buildMode) {
@@ -164,7 +164,7 @@ export async function runAutobuild(
  } else {
    await codeQL.runAutobuild(config, language);
  }
-  if (language === BuiltInLanguage.go) {
+  if (language === KnownLanguage.go) {
    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
  }
  logger.endGroup();
@@ -299,20 +299,6 @@ test("wrapCliConfigurationError - swift build failed", (t) => {
  t.true(wrappedError instanceof ConfigurationError);
 });

-test("wrapCliConfigurationError - swift incompatible os", (t) => {
-  const commandError = new CommandInvocationError(
-    "codeql",
-    ["swift/tools/autobuild.sh"],
-    1,
-    "2026-04-01 18:35:00 EST ERRO [extractor/main] [incompatible-os] Currently, Swift analysis is only supported on macOS. (IncompatibleOs.cpp:26)",
-  );
-  const cliError = new CliError(commandError);
-
-  const wrappedError = wrapCliConfigurationError(cliError);
-
-  t.true(wrappedError instanceof ConfigurationError);
-});
-
 test("wrapCliConfigurationError - pack cannot be found", (t) => {
  const commandError = new CommandInvocationError(
    "codeql",
@@ -144,7 +144,6 @@ export enum CliConfigErrorCategory {
  OutOfMemoryOrDisk = "OutOfMemoryOrDisk",
  PackCannotBeFound = "PackCannotBeFound",
  PackMissingAuth = "PackMissingAuth",
-  SwiftIncompatibleOs = "SwiftIncompatibleOs",
  SwiftBuildFailed = "SwiftBuildFailed",
  UnsupportedBuildMode = "UnsupportedBuildMode",
 }
@@ -282,12 +281,6 @@ const cliErrorsConfig: Record<CliConfigErrorCategory, CliErrorConfiguration> = {
      ),
    ],
  },
-  [CliConfigErrorCategory.SwiftIncompatibleOs]: {
-    cliErrorMessageCandidates: [
-      new RegExp("\\[incompatible-os\\]"),
-      new RegExp("Swift analysis is only supported on macOS"),
-    ],
-  },
  [CliConfigErrorCategory.UnsupportedBuildMode]: {
    cliErrorMessageCandidates: [
      new RegExp(
@@ -21,7 +21,7 @@ import {
 import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import {
@@ -33,7 +33,6 @@ import {
  mockBundleDownloadApi,
  makeVersionInfo,
  createTestConfig,
-  makeMacro,
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
@@ -47,7 +46,7 @@ test.beforeEach(() => {
  initializeEnvironment("1.2.3");

  stubConfig = createTestConfig({
-    languages: [BuiltInLanguage.cpp],
+    languages: [KnownLanguage.cpp],
  });
 });

@@ -71,10 +70,8 @@ async function installIntoToolcache({
    tmpDir,
    util.GitHubVariant.GHES,
    cliVersion !== undefined
-      ? { enabledVersions: [{ cliVersion, tagName }] }
+      ? { cliVersion, tagName }
      : SAMPLE_DEFAULT_CLI_VERSION,
-    undefined, // rawLanguages
-    false, // useOverlayAwareDefaultCliVersion
    createFeatures([]),
    getRunnerLogger(true),
    false,
@@ -118,7 +115,7 @@ async function stubCodeql(): Promise<codeql.CodeQL> {
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
  sinon
    .stub(codeqlObject, "isTracedLanguage")
-    .withArgs(BuiltInLanguage.cpp)
+    .withArgs(KnownLanguage.cpp)
    .resolves(true);
  return codeqlObject;
 }
@@ -146,8 +143,6 @@ test.serial(
          tmpDir,
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
-          undefined, // rawLanguages
-          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
          false,
@@ -180,8 +175,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -221,8 +214,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -273,8 +264,6 @@ for (const {
          tmpDir,
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
-          undefined, // rawLanguages
-          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
          false,
@@ -295,11 +284,11 @@ for (const {
 for (const toolcacheVersion of [
  // Test that we use the tools from the toolcache when `SAMPLE_DEFAULT_CLI_VERSION` is requested
  // and `SAMPLE_DEFAULT_CLI_VERSION-` is in the toolcache.
-  SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
-  `${SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion}-20230101`,
+  SAMPLE_DEFAULT_CLI_VERSION.cliVersion,
+  `${SAMPLE_DEFAULT_CLI_VERSION.cliVersion}-20230101`,
 ]) {
  test.serial(
-    `uses tools from toolcache when ${SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion} is requested and ` +
+    `uses tools from toolcache when ${SAMPLE_DEFAULT_CLI_VERSION.cliVersion} is requested and ` +
      `${toolcacheVersion} is installed`,
    async (t) => {
      const features = createFeatures([]);
@@ -319,16 +308,11 @@ for (const toolcacheVersion of [
          tmpDir,
          util.GitHubVariant.DOTCOM,
          SAMPLE_DEFAULT_CLI_VERSION,
-          undefined, // rawLanguages
-          false, // useOverlayAwareDefaultCliVersion
          features,
          getRunnerLogger(true),
          false,
        );
-        t.is(
-          result.toolsVersion,
-          SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
-        );
+        t.is(result.toolsVersion, SAMPLE_DEFAULT_CLI_VERSION.cliVersion);
        t.is(result.toolsSource, ToolsSource.Toolcache);
        t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined);
        t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined);
@@ -358,15 +342,9 @@ test.serial(
        tmpDir,
        util.GitHubVariant.GHES,
        {
-          enabledVersions: [
-            {
-              cliVersion: defaults.cliVersion,
-              tagName: defaults.bundleVersion,
-            },
-          ],
+          cliVersion: defaults.cliVersion,
+          tagName: defaults.bundleVersion,
        },
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -406,15 +384,9 @@ test.serial(
        tmpDir,
        util.GitHubVariant.GHES,
        {
-          enabledVersions: [
-            {
-              cliVersion: defaults.cliVersion,
-              tagName: defaults.bundleVersion,
-            },
-          ],
+          cliVersion: defaults.cliVersion,
+          tagName: defaults.bundleVersion,
        },
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -454,8 +426,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -497,8 +467,6 @@ test.serial(
        tmpDir,
        util.GitHubVariant.DOTCOM,
        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
        features,
        getRunnerLogger(true),
        false,
@@ -572,7 +540,7 @@ test.serial("getExtraOptions throws for bad content", (t) => {
 });

 // Test macro for ensuring different variants of injected augmented configurations
-const injectedConfigMacro = makeMacro({
+const injectedConfigMacro = test.macro({
  exec: async (
    t: ExecutionContext<unknown>,
    augmentationProperties: AugmentationProperties,
@@ -622,8 +590,9 @@ const injectedConfigMacro = makeMacro({
    `databaseInitCluster() injected config: ${providedTitle}`,
 });

-injectedConfigMacro.serial(
+test.serial(
  "basic",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
  },
@@ -631,8 +600,9 @@ injectedConfigMacro.serial(
  {},
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected packs from input",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    packsInput: ["xxx", "yyy"],
@@ -643,8 +613,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected packs from input with existing packs combines",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    packsInputCombines: true,
@@ -664,8 +635,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected packs from input with existing packs overrides",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    packsInput: ["xxx", "yyy"],
@@ -683,8 +655,9 @@ injectedConfigMacro.serial(
 );

 // similar, but with queries
-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@@ -702,8 +675,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input overrides",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@@ -725,8 +699,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input combines",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -752,8 +727,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries from input combines 2",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -773,8 +749,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "injected queries and packs, but empty",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -791,8 +768,9 @@ injectedConfigMacro.serial(
  {},
 );

-injectedConfigMacro.serial(
+test.serial(
  "repo property queries have the highest precedence",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -812,8 +790,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "repo property queries combines with queries input",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: false,
@@ -838,8 +817,9 @@ injectedConfigMacro.serial(
  },
 );

-injectedConfigMacro.serial(
+test.serial(
  "repo property queries combines everything else",
+  injectedConfigMacro,
  {
    ...defaultAugmentationProperties,
    queriesInputCombines: true,
@@ -976,8 +956,7 @@ test.serial("runTool summarizes autobuilder errors", async (t) => {
  sinon.stub(io, "which").resolves("");

  await t.throwsAsync(
-    async () =>
-      await codeqlObject.runAutobuild(stubConfig, BuiltInLanguage.java),
+    async () => await codeqlObject.runAutobuild(stubConfig, KnownLanguage.java),
    {
      instanceOf: util.ConfigurationError,
      message:
@@ -1003,8 +982,7 @@ test.serial("runTool truncates long autobuilder errors", async (t) => {
  sinon.stub(io, "which").resolves("");

  await t.throwsAsync(
-    async () =>
-      await codeqlObject.runAutobuild(stubConfig, BuiltInLanguage.java),
+    async () => await codeqlObject.runAutobuild(stubConfig, KnownLanguage.java),
    {
      instanceOf: util.ConfigurationError,
      message:
@@ -24,8 +24,11 @@ import {
 import { isAnalyzingDefaultBranch } from "./git-utils";
 import { Language } from "./languages";
 import { Logger } from "./logging";
-import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import {
+  OverlayDatabaseMode,
+  writeBaseDatabaseOidsFile,
+  writeOverlayChangesFile,
+} from "./overlay";
 import * as setupCodeql from "./setup-codeql";
 import { ZstdAvailability } from "./tar";
 import { ToolsDownloadStatusReport } from "./tools-download";
@@ -282,21 +285,34 @@ const CODEQL_MINIMUM_VERSION = "2.17.6";
 /**
 * This version will shortly become the oldest version of CodeQL that the Action will run with.
 */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";

 /**
 * This is the version of GHES that was most recently deprecated.
 */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";

 /**
 * This is the deprecation date for the version of GHES that was most recently deprecated.
 */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";

 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";

+/*
+ * Deprecated in favor of ToolsFeature.
+ *
+ * Versions of CodeQL that version-flag certain functionality in the Action.
+ * For convenience, please keep these in descending order. Once a version
+ * flag is older than the oldest supported version above, it may be removed.
+ */
+
+/**
+ * Versions 2.17.1+ of the CodeQL CLI support the `--cache-cleanup` option.
+ */
+const CODEQL_VERSION_CACHE_CLEANUP = "2.17.1";
+
 /**
 * Set up CodeQL CLI access.
 *
@@ -305,8 +321,6 @@ const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 * @param tempDir
 * @param variant
 * @param defaultCliVersion
- * @param rawLanguages Raw set of languages.
- * @param useOverlayAwareDefaultCliVersion Whether to select an overlay-aware default CLI version.
 * @param features Information about the features that are enabled.
 * @param logger
 * @param checkVersion Whether to check that CodeQL CLI meets the minimum
@@ -319,8 +333,6 @@ export async function setupCodeQL(
  tempDir: string,
  variant: util.GitHubVariant,
  defaultCliVersion: CodeQLDefaultVersionInfo,
-  rawLanguages: string[] | undefined,
-  useOverlayAwareDefaultCliVersion: boolean,
  features: FeatureEnablement,
  logger: Logger,
  checkVersion: boolean,
@@ -344,8 +356,6 @@ export async function setupCodeQL(
      tempDir,
      variant,
      defaultCliVersion,
-      rawLanguages,
-      useOverlayAwareDefaultCliVersion,
      features,
      logger,
    );
@@ -881,13 +891,19 @@ async function getCodeQLForCmd(
      config: Config,
      cleanupLevel: CleanupLevel,
    ): Promise<void> {
+      const cacheCleanupFlag = (await util.codeQlVersionAtLeast(
+        this,
+        CODEQL_VERSION_CACHE_CLEANUP,
+      ))
+        ? "--cache-cleanup"
+        : "--mode";
      for (const language of config.languages) {
        const databasePath = util.getCodeQLDatabasePath(config, language);
        const codeqlArgs = [
          "database",
          "cleanup",
          databasePath,
-          `--cache-cleanup=${cleanupLevel}`,
+          `${cacheCleanupFlag}=${cleanupLevel}`,
          ...getExtraOptionsFromEnv(["database", "cleanup"]),
        ];
        await runCli(cmd, codeqlArgs);
--- a/Show More
+++ b/Show More