Merge pull request #3778 from github/backport-v3.35.0-b8bb9f28b

Merge releases/v4 into releases/v3
Rebuild
2026-05-24 16:14:33 +00:00 · 2026-03-27 17:00:05 +01:00 · 2026-03-27 12:23:35 +00:00 · 2026-03-27 12:18:22 +00:00 · 2026-03-27 12:18:20 +00:00 · 2026-03-27 12:18:20 +00:00
182 changed files with 1463203 additions and 78360 deletions
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node24
+  using: node20
  main: index.js
@@ -41,38 +41,7 @@ runs:
        git add .
        git commit -m "Update changelog and version after ${VERSION}"

-    # Update the build artifacts with the new version number
-    - name: Rebuild the Action
-      shell: bash
-      run: |
-        set -exu
-        npm ci
-        npm run build
-
-    - name: Check for rebuild changes
-      id: rebuild_changes
-      shell: bash
-      run: |
-        set -exu
-        git add --all
-        if git diff --cached --quiet; then
-          echo "has_changes=false" >> "${GITHUB_OUTPUT}"
-        else
-          echo "has_changes=true" >> "${GITHUB_OUTPUT}"
-        fi
-
-    - name: Commit rebuild
-      if: steps.rebuild_changes.outputs.has_changes == 'true'
-      shell: bash
-      run: |
-        set -exu
-        git commit -m "Rebuild"
-
-    - name: Push mergeback branch
-      shell: bash
-      env:
-        NEW_BRANCH: "${{ inputs.branch }}"
-      run: git push origin "${NEW_BRANCH}"
+        git push origin "${NEW_BRANCH}"

    - name: Create PR
      shell: bash
@@ -91,6 +60,8 @@ runs:

          Please do the following:

+          - [ ] Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
+          - [ ] Wait for the "Rebuild" workflow to push a commit updating the distribution files.
          - [ ] Mark the PR as ready for review to trigger the full set of PR checks.
          - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
                selected rather than "Squash and merge" or "Rebase and merge".
@@ -103,6 +74,7 @@ runs:
          --head "${NEW_BRANCH}" \
          --base "${BASE_BRANCH}" \
          --title "${pr_title}" \
+          --label "Rebuild" \
          --body "${pr_body}" \
          --assignee "${GITHUB_ACTOR}" \
          --draft
@@ -18,7 +18,7 @@ runs:
    - name: Set up Node
      uses: actions/setup-node@v6
      with:
-        node-version: 24
+        node-version: 20
        cache: 'npm'

    - name: Set up Python
@@ -1,6 +1,6 @@
 name: Verify that the best-effort debug artifact scan completed
 description: Verifies that the best-effort debug artifact scan completed successfully during tests
 runs:
-  using: node24
+  using: node20
  main: index.js
  post: post.js
@@ -1,5 +1,5 @@
 name: "CodeQL config"
-queries:
+queries: 
  - name: Run custom queries
    uses: ./queries
  # Run all extra query suites, both because we want to
@@ -13,5 +13,3 @@ queries:
 paths-ignore:
  - lib
  - tests
-  - "**/*.test.ts"
-  - "**/testing-util.ts"
@@ -1,9 +1,7 @@
 version: 2
 updates:
  - package-ecosystem: npm
-    directories:
-      - "/"
-      - "/pr-checks"
+    directory: "/"
    schedule:
      interval: weekly
    cooldown:
@@ -16,27 +16,12 @@ No user facing changes.
 """

 # NB: This exact commit message is used to find commits for reverting during backports.
-# Changing it requires a transition period where both old and new versions are supported.
+# Changing it requires a transition period where both old and new versions are supported.
 BACKPORT_COMMIT_MESSAGE = 'Update version and changelog for v'

-# Commit message used for rebuild commits, both those produced by this script and those produced
-# by the `Rebuild Action` workflow (`.github/workflows/rebuild.yml`).
-REBUILD_COMMIT_MESSAGE = 'Rebuild'
-
 # Name of the remote
 ORIGIN = 'origin'

-# Environment variables to check for a GitHub API token.
-TOKEN_ENVIRONMENT_VARIABLES = ('GH_TOKEN', 'GITHUB_TOKEN')
-
-# Gets a GitHub API token from one of the supported environment variables.
-def get_github_token():
-  for variable_name in TOKEN_ENVIRONMENT_VARIABLES:
-    token = os.environ.get(variable_name, '').strip()
-    if token:
-      return token
-  raise Exception('Missing GitHub token. Set GITHUB_TOKEN or GH_TOKEN.')
-
 # Runs git with the given args and returns the stdout.
 # Raises an error if git does not exit successfully (unless passed
 # allow_non_zero_exit_code=True).
@@ -47,28 +32,6 @@ def run_git(*args, allow_non_zero_exit_code=False):
    raise Exception(f'Call to {" ".join(cmd)} exited with code {p.returncode} stderr: {p.stderr.decode("ascii")}.')
  return p.stdout.decode('ascii')

-# Runs the given command, streaming output to the console.
-# Raises an error if the command does not exit successfully.
-def run_command(*args):
-  cmd = list(args)
-  print(f'Running `{" ".join(cmd)}`.')
-  subprocess.run(cmd, check=True)
-
-# Rebuilds the action and commits any changes.
-def rebuild_action():
-  # For backports, the only source-level change vs the source branch is the new version number,
-  # so we just need to refresh the version embedded in `lib/`.
-  run_command('npm', 'ci')
-  run_command('npm', 'run', 'build')
-
-  run_git('add', '--all')
-  # `git diff --cached --quiet` exits 0 if there are no staged changes, 1 if there are.
-  if subprocess.run(['git', 'diff', '--cached', '--quiet']).returncode == 0:
-    print('Rebuild produced no changes; skipping Rebuild commit.')
-  else:
-    run_git('commit', '-m', REBUILD_COMMIT_MESSAGE)
-    print('Created Rebuild commit.')
-
 # Returns true if the given branch exists on the origin remote
 def branch_exists_on_remote(branch_name):
  return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
@@ -124,11 +87,9 @@ def open_pr(
  body.append('Please do the following:')
  if len(conflicted_files) > 0:
    body.append(' - [ ] Ensure `package.json` file contains the correct version.')
-    body.append(' - [ ] Add a commit to this branch to resolve the merge conflicts ' +
+    body.append(' - [ ] Add commits to this branch to resolve the merge conflicts ' +
      'in the following files:')
-    body.extend([f'    - `{file}`' for file in conflicted_files])
-    body.append(' - [ ] Rebuild the Action locally (`npm run build`) and push any changes to the ' +
-      f'built output in `lib` as a separate commit named exactly `{REBUILD_COMMIT_MESSAGE}`.')
+    body.extend([f'    - [ ] `{file}`' for file in conflicted_files])
    body.append(' - [ ] Ensure another maintainer has reviewed the additional commits you added to this ' +
      'branch to resolve the merge conflicts.')
  body.append(' - [ ] Ensure the CHANGELOG displays the correct version and date.')
@@ -136,6 +97,10 @@ def open_pr(
  body.append(f' - [ ] Check that there are not any unexpected commits being merged into the `{target_branch}` branch.')
  body.append(' - [ ] Ensure the docs team is aware of any documentation changes that need to be released.')

+  if not is_primary_release:
+    body.append(' - [ ] Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.')
+    body.append(' - [ ] Wait for the "Rebuild" workflow to push a commit updating the distribution files.')
+
  body.append(' - [ ] Mark the PR as ready for review to trigger the full set of PR checks.')
  body.append(' - [ ] Approve and merge this PR. Make sure `Create a merge commit` is selected rather than `Squash and merge` or `Rebase and merge`.')

@@ -144,11 +109,13 @@ def open_pr(
    body.append(' - [ ] Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.')

  title = f'Merge {source_branch} into {target_branch}'
+  labels = ['Rebuild'] if not is_primary_release else []

  # Create the pull request
  # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft so that
  # a maintainer can take the PR out of draft, thereby triggering the PR checks.
  pr = repo.create_pull(title=title, body='\n'.join(body), head=new_branch_name, base=target_branch, draft=True)
+  pr.add_to_labels(*labels)
  print(f'Created PR #{str(pr.number)}')

  # Assign the conductor
@@ -303,6 +270,12 @@ def update_changelog(version):
 def main():
  parser = argparse.ArgumentParser('update-release-branch.py')

+  parser.add_argument(
+    '--github-token',
+    type=str,
+    required=True,
+    help='GitHub token, typically from GitHub Actions.'
+  )
  parser.add_argument(
    '--repository-nwo',
    type=str,
@@ -340,7 +313,7 @@ def main():
  target_branch = args.target_branch
  is_primary_release = args.is_primary_release

-  repo = Github(get_github_token()).get_repo(args.repository_nwo)
+  repo = Github(args.github_token).get_repo(args.repository_nwo)

  # the target branch will be of the form releases/vN, where N is the major version number
  target_branch_major_version = target_branch.strip('releases/v')
@@ -407,9 +380,8 @@ def main():
      # releases.
      run_git('revert', vOlder_update_commits[0], '--no-edit')

-      # Also revert the "Rebuild" commit, whether created by this script or by the
-      # `Rebuild Action` workflow.
-      rebuild_commit = run_git('log', '--grep', f'^{REBUILD_COMMIT_MESSAGE}$', '--format=%H').split()[0]
+      # Also revert the "Rebuild" commit created by Actions.
+      rebuild_commit = run_git('log', '--grep', '^Rebuild$', '--format=%H').split()[0]
      print(f'  Reverting {rebuild_commit}')
      run_git('revert', rebuild_commit, '--no-edit')

@@ -424,10 +396,9 @@ def main():
      run_git('add', '.')
      run_git('commit', '--no-edit')

-    # Migrate the package version number from a vLatest version number to a vOlder version number.
-    # `package-lock.json` is updated as part of the subsequent rebuild step (see `rebuild_action`).
+    # Migrate the package version number from a vLatest version number to a vOlder version number
    print(f'Setting version number to {version} in package.json')
-    replace_version_package_json(get_current_version(), version)
+    replace_version_package_json(get_current_version(), version) # We rely on the `Rebuild` workflow to update package-lock.json
    run_git('add', 'package.json')

    # Migrate the changelog notes from vLatest version numbers to vOlder version numbers
@@ -450,13 +421,6 @@ def main():
    run_git('add', 'CHANGELOG.md')
    run_git('commit', '-m', f'Update changelog for v{version}')

-  if not is_primary_release:
-    if len(conflicted_files) == 0:
-      print('Rebuilding the Action.')
-      rebuild_action()
-    else:
-      print(f'Skipping automatic rebuild because the merge produced conflicts in {conflicted_files}.')
-
  run_git('push', ORIGIN, new_branch_name)

  # Open a PR to update the branch
@@ -49,6 +49,10 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: stable-v2.19.4
          - os: ubuntu-latest
@@ -57,10 +61,6 @@ jobs:
            version: stable-v2.21.4
          - os: ubuntu-latest
            version: stable-v2.22.4
-          - os: ubuntu-latest
-            version: stable-v2.23.9
-          - os: ubuntu-latest
-            version: stable-v2.24.3
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
@@ -49,6 +49,10 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: stable-v2.19.4
          - os: ubuntu-latest
@@ -57,10 +61,6 @@ jobs:
            version: stable-v2.21.4
          - os: ubuntu-latest
            version: stable-v2.22.4
-          - os: ubuntu-latest
-            version: stable-v2.23.9
-          - os: ubuntu-latest
-            version: stable-v2.24.3
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
@@ -49,6 +49,10 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: stable-v2.19.4
          - os: ubuntu-latest
@@ -57,10 +61,6 @@ jobs:
            version: stable-v2.21.4
          - os: ubuntu-latest
            version: stable-v2.22.4
-          - os: ubuntu-latest
-            version: stable-v2.23.9
-          - os: ubuntu-latest
-            version: stable-v2.24.3
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
@@ -60,12 +60,12 @@ jobs:
          setup-kotlin: 'true'
      - uses: ./../action/init
        with:
-          languages: C#,java-kotlin,typescript
+          languages: C#,java-kotlin,swift,typescript
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - name: 'Check languages'
        run: |
-          expected_languages="csharp,java,javascript"
+          expected_languages="csharp,java,swift,javascript"
          actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

          if [ "$expected_languages" != "$actual_languages" ]; then
@@ -59,41 +59,41 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: macos-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: stable-v2.19.4
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
            version: stable-v2.21.4
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: stable-v2.21.4
          - os: ubuntu-latest
            version: stable-v2.22.4
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: stable-v2.22.4
-          - os: ubuntu-latest
-            version: stable-v2.23.9
-          - os: macos-latest-xlarge
-            version: stable-v2.23.9
-          - os: ubuntu-latest
-            version: stable-v2.24.3
-          - os: macos-latest-xlarge
-            version: stable-v2.24.3
          - os: ubuntu-latest
            version: default
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: default
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: nightly-latest
    name: Multi-language repository
    if: github.triggering_actor != 'dependabot[bot]'
@@ -59,7 +59,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -40,7 +40,7 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
-            version: stable-v2.19.4
+            version: stable-v2.19.3
          - os: ubuntu-latest
            version: stable-v2.22.1
          - os: ubuntu-latest
@@ -71,17 +71,7 @@ jobs:
        id: proxy
        uses: ./../action/start-proxy
        with:
-          registry_secrets: |
-            [
-              {
-                "type": "maven_repository",
-                "url": "https://repo.maven.apache.org/maven2/"
-              },
-              {
-                "type": "maven_repository",
-                "url": "https://repo1.maven.org/maven2"
-              }
-            ]
+          registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

      - name: Print proxy outputs
        run: |
@@ -92,12 +82,5 @@ jobs:
      - name: Fail if proxy outputs are not set
        if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
        run: exit 1
-
-      - name: Fail if proxy_urls does not contain all registries
-        if: |
-          join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-          || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-        run: exit 1
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -39,7 +39,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: macos-latest-xlarge
+          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using autobuild
    if: github.triggering_actor != 'dependabot[bot]'
@@ -9,10 +9,6 @@ on:
    # by other workflows.
    types: [opened, synchronize, reopened, ready_for_review]

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -77,7 +77,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
+        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14,macos-15]
        tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
    runs-on: ${{ matrix.os }}

@@ -6,6 +6,13 @@ env:
  # Diff informed queries add an additional query filter which is not yet
  # taken into account by these tests.
  CODEQL_ACTION_DIFF_INFORMED_QUERIES: false
+  # Specify overlay enablement manually to ensure stability around the exclude-from-incremental
+  # query filter. Here we only enable for the default code scanning suite.
+  CODEQL_ACTION_OVERLAY_ANALYSIS: true
+  CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT: false
+  CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT: true
+  CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK: false
+  CODEQL_ACTION_OVERLAY_ANALYSIS_SKIP_RESOURCE_CHECKS: true

 on:
  push:
@@ -24,10 +31,6 @@ on:
    - cron: '0 5 * * *'
  workflow_dispatch:

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -76,13 +79,33 @@ jobs:
      with:
        version: ${{ matrix.version }}

-    - name: Empty file
+    # On PRs, overlay analysis may change the config that is passed to the CLI.
+    # Therefore, we have two variants of the following test, one for PRs and one for other events.
+    - name: Empty file (non-PR)
+      if: github.event_name != 'pull_request'
      uses: ./../action/.github/actions/check-codescanning-config
      with:
        expected-config-file-contents: "{}"
        languages: javascript
        tools: ${{ steps.prepare-test.outputs.tools-url }}

+    - name: Empty file (PR)
+      if: github.event_name == 'pull_request'
+      uses: ./../action/.github/actions/check-codescanning-config
+      with:
+        expected-config-file-contents: |
+          {
+            "query-filters": [
+              {
+                "exclude": {
+                  "tags": "exclude-from-incremental"
+                }
+              }
+            ]
+          }
+        languages: javascript
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+
    - name: Packs from input
      if: success() || failure()
      uses: ./../action/.github/actions/check-codescanning-config
@@ -20,10 +20,6 @@ on:
    - cron: '0 5 * * *'
  workflow_dispatch:

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -70,7 +66,6 @@ jobs:
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
        with:
-          languages: cpp,csharp,go,java,javascript,python
          tools: ${{ steps.prepare-test.outputs.tools-url }}
          debug: true
          debug-artifact-name: my-debug-artifacts
@@ -19,10 +19,6 @@ on:
    - cron: '0 5 * * *'
  workflow_dispatch:

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -1,106 +0,0 @@
-# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
-# already passed CI before being merged. Therefore if they fail, we should make sure that there
-# wasn't a transient failure by rerunning the failed jobs once before investigating further.
-name: Deflake
-
-on:
-  workflow_run:
-    types: [completed]
-    # Exclude workflows that have significant side effects, like publishing releases. It's OK to
-    # retry CodeQL analysis.
-    workflows:
-      - Check Expected Release Files
-      - Code-Scanning config CLI tests
-      - CodeQL action
-      - Manual Check - go
-      - "PR Check - All-platform bundle"
-      - "PR Check - Analysis kinds"
-      - "PR Check - Analyze: 'ref' and 'sha' from inputs"
-      - "PR Check - autobuild-action"
-      - "PR Check - Autobuild direct tracing (custom working directory)"
-      - "PR Check - Autobuild working directory"
-      - "PR Check - Build mode autobuild"
-      - "PR Check - Build mode manual"
-      - "PR Check - Build mode none"
-      - "PR Check - Build mode rollback"
-      - "PR Check - Bundle: Caching checks"
-      - "PR Check - Bundle: From nightly"
-      - "PR Check - Bundle: From toolcache"
-      - "PR Check - Bundle: Zstandard checks"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
-      - "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
-      - "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
-      - "PR Check - Clean up database cluster directory"
-      - "PR Check - CodeQL Bundle All"
-      - "PR Check - Config export"
-      - "PR Check - Config input"
-      - "PR Check - Custom source root"
-      - "PR Check - Debug artifact upload"
-      - "PR Check - Debug artifacts after failure"
-      - "PR Check - Diagnostic export"
-      - "PR Check - Export file baseline information"
-      - "PR Check - Extractor ram and threads options test"
-      - "PR Check - Go: Custom queries"
-      - "PR Check - Go: diagnostic when Go is changed after init step"
-      - "PR Check - Go: diagnostic when `file` is not installed"
-      - "PR Check - Go: tracing with autobuilder step"
-      - "PR Check - Go: tracing with custom build steps"
-      - "PR Check - Go: tracing with legacy workflow"
-      - "PR Check - Go: workaround for indirect tracing"
-      - "PR Check - Job run UUID added to SARIF"
-      - "PR Check - Language aliases"
-      - "PR Check - Local CodeQL bundle"
-      - "PR Check - Multi-language repository"
-      - "PR Check - Overlay database init fallback"
-      - "PR Check - Packaging: Action input"
-      - "PR Check - Packaging: Config and input"
-      - "PR Check - Packaging: Config and input passed to the CLI"
-      - "PR Check - Packaging: Config file"
-      - "PR Check - Packaging: Download using registries"
-      - "PR Check - Proxy test"
-      - "PR Check - Remote config file"
-      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
-      - "PR Check - Ruby analysis"
-      - "PR Check - Rust analysis"
-      - "PR Check - Split workflow"
-      - "PR Check - Start proxy"
-      - "PR Check - Submit SARIF after failure"
-      - "PR Check - Swift analysis using a custom build command"
-      - "PR Check - Swift analysis using autobuild"
-      - "PR Check - Test different uses of `upload-sarif`"
-      - "PR Check - Test unsetting environment variables"
-      - "PR Check - Upload-sarif: ref and sha from inputs"
-      - "PR Check - Use a custom `checkout_path`"
-      - PR Checks
-      - Query filters tests
-      - Test that the workaround for python 3.12 on windows works
-
-jobs:
-  rerun-on-failure:
-    name: Rerun failed jobs
-    if: >-
-      github.event.workflow_run.conclusion == 'failure' &&
-      github.event.workflow_run.run_attempt == 1 &&
-      (
-        github.event.workflow_run.head_branch == 'main' ||
-        startsWith(github.event.workflow_run.head_branch, 'releases/') ||
-        github.event.workflow_run.event == 'merge_group'
-      )
-    runs-on: ubuntu-slim
-    permissions:
-      actions: write
-    steps:
-      - name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NAME: ${{ github.event.workflow_run.name }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          echo "Rerunning failed jobs for workflow run ${RUN_ID}"
-          gh run rerun "${RUN_ID}" --failed
-          echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"
@@ -24,7 +24,7 @@ defaults:

 jobs:
  merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    if: github.repository == 'github/codeql-action'
    env:
@@ -48,9 +48,6 @@ jobs:
        with:
          fetch-depth: 0  # ensure we have all tags and can push commits
      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: 'npm'
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
@@ -134,7 +131,7 @@ jobs:
          echo "::endgroup::"

      - name: Generate token
-        uses: actions/create-github-app-token@v3.2.0
+        uses: actions/create-github-app-token@v3.0.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -10,10 +10,6 @@ on:
    types: [checks_requested]
  workflow_dispatch:

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -33,10 +29,6 @@ jobs:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45

-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-unit-tests-${{ github.ref }}-${{ github.event_name }}-${{ matrix.os }}-node${{ matrix['node-version'] }}
-
    steps:
      - name: Prepare git (Windows)
        if: runner.os == 'Windows'
@@ -75,21 +67,22 @@ jobs:
          sarif_file: eslint.sarif
          category: eslint

-  # These checks do not need to be run as part of the same matrix that we use for the `unit-tests`
-  # job.
-  other-checks:
-    name: Other checks
+  # Verifying the PR checks are up-to-date requires Node 24. The PR checks are not dependent
+  # on the main codebase and therefore do not need to be run as part of the same matrix that
+  # we use for the `unit-tests` job.
+  verify-pr-checks:
+    name: Verify PR checks
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    timeout-minutes: 10

-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }}
-
    steps:
+      - name: Prepare git (Windows)
+        if: runner.os == 'Windows'
+        run: git config --global core.autocrlf false
+
      - name: Checkout repository
        uses: actions/checkout@v6

@@ -100,22 +93,34 @@ jobs:
          cache: 'npm'

      - name: Install dependencies
-        id: install-deps
        run: npm ci

      - name: Verify PR checks up to date
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        if: always()
        run: .github/workflows/script/verify-pr-checks.sh

      - name: Run pr-checks tests
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        if: always()
        working-directory: pr-checks
        run: npx tsx --test

-      - name: Verify all Actions use the same Node version
-        id: head-version
+  check-node-version:
+    if: github.triggering_actor != 'dependabot[bot]'
+    name: Check Action Node versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      BASE_REF: ${{ github.base_ref }}
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v6
+      - id: head-version
+        name: Verify all Actions use the same Node version
        run: |
-          NODE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
+          NODE_VERSION=$(find . -name "action.yml" -exec yq -e '.runs.using' {} \; | grep node | sort | uniq)
          echo "NODE_VERSION: ${NODE_VERSION}"
          if [[ $(echo "$NODE_VERSION" | wc -l) -gt 1 ]]; then
            echo "::error::More than one node version used in 'action.yml' files."
@@ -123,111 +128,22 @@ jobs:
          fi
          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT

-      - name: Fetch base commit
-        id: fetch-base
-        # Forks and Dependabot PRs don't have permission to write comments, so skip the repo size
-        # check in those cases.
-        if: >-
-          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.event.pull_request.user.login != 'dependabot[bot]'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Compare against the merge base so the size delta reflects only the commits actually
-          # added by this PR, ignoring any changes that have landed on the base branch since the
-          # PR branched off.
-          merge_base=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_SHA...$HEAD_SHA" --jq '.merge_base_commit.sha')
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-
-      - name: Check repo size
-        if: steps.fetch-base.outcome == 'success'
-        working-directory: pr-checks
-        env:
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: npx tsx check-repo-size.ts --output-dir "$RUNNER_TEMP/repo-size"
-
-      - name: Upload repo size comment
-        if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@v7
-        with:
-          name: repo-size-comment
-          path: ${{ runner.temp }}/repo-size/
-          if-no-files-found: error
-
-      - name: 'Backport: Check out base ref'
-        id: checkout-base
+      - id: checkout-base
+        name: 'Backport: Check out base ref'
        if: ${{ startsWith(github.head_ref, 'backport-') }}
        uses: actions/checkout@v6
        with:
-          ref: ${{ github.base_ref }}
+          ref: ${{ env.BASE_REF }}

      - name: 'Backport: Verify Node versions unchanged'
        if: steps.checkout-base.outcome == 'success'
        env:
          HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}
        run: |
-          BASE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
+          BASE_VERSION=$(find . -name "action.yml" -exec yq -e '.runs.using' {} \; | grep node | sort | uniq)
          echo "HEAD_VERSION: ${HEAD_VERSION}"
          echo "BASE_VERSION: ${BASE_VERSION}"
          if [[ "$BASE_VERSION" != "$HEAD_VERSION" ]]; then
            echo "::error::Cannot change the Node version of an Action in a backport PR."
            exit 1
          fi
-
-  post-repo-size-comment:
-    name: Post repo size comment
-    needs: other-checks
-    # Keep write permissions isolated from the job that checks out and tests PR code. This job only
-    # posts the candidate comment body produced by the read-only `pr-checks` job.
-    if: >-
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
-      needs.other-checks.result == 'success'
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 10
-
-    concurrency:
-      cancel-in-progress: true
-      group: check-repo-size-${{ github.event.pull_request.number }}
-
-    steps:
-      - name: Download repo size comment
-        uses: actions/download-artifact@v8
-        with:
-          name: repo-size-comment
-          path: repo-size-comment
-
-      - name: Post repo size comment
-        env:
-          COMMENT_MARKER: "<!-- repo-size-diff-bot -->"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          significant=$(jq -r '.significant' repo-size-comment/metadata.json)
-          comment_id=$(
-            gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-              --paginate \
-              --jq ".[] | select(.body | contains(\"$COMMENT_MARKER\")) | .id" \
-              | head -n 1
-          )
-
-          if [[ -n "$comment_id" ]]; then
-            echo "Updating existing comment $comment_id."
-            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --field body=@repo-size-comment/body.md
-          elif [[ "$significant" == "true" ]]; then
-            echo "Creating new repo size comment."
-            gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --field body=@repo-size-comment/body.md
-          else
-            echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
-          fi
@@ -29,7 +29,7 @@ defaults:
 jobs:
  prepare:
    name: "Prepare release"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.repository == 'github/codeql-action'

    permissions:
@@ -14,10 +14,6 @@ on:
    - cron: '0 0 * * 1'
  workflow_dispatch:

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -17,10 +17,6 @@ on:
    - cron: '0 5 * * *'
  workflow_dispatch:

-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -136,7 +136,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v3.2.0
+        uses: actions/create-github-app-token@v3.0.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -18,11 +18,6 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
  run:
    shell: bash
@@ -20,7 +20,7 @@ defaults:
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
@@ -57,17 +57,6 @@ jobs:
      - name: Update bundle
        uses: ./.github/actions/update-bundle

-      - name: Set up CodeQL CLI from new bundle
-        id: setup-codeql
-        uses: ./setup-codeql
-        with:
-          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
-
-      - name: Update built-in languages
-        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
-        env:
-          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
-
      - name: Bump Action minor version if new CodeQL minor version series
        id: bump-action-version
        run: |
@@ -26,7 +26,7 @@ jobs:

  update:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
@@ -64,12 +64,11 @@ jobs:

    - name: Update current release branch
      if: github.event_name == 'workflow_dispatch'
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        echo SOURCE_BRANCH=${REF_NAME}
        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
        python .github/update-release-branch.py \
+          --github-token ${{ secrets.GITHUB_TOKEN }} \
          --repository-nwo ${{ github.repository }} \
          --source-branch '${{ env.REF_NAME }}' \
          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
@@ -78,7 +77,7 @@ jobs:

  backport:
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -94,7 +93,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@v3.2.0
+      uses: actions/create-github-app-token@v3.0.0
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -108,12 +107,11 @@ jobs:
    - uses: ./.github/actions/release-initialise

    - name: Update older release branch
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        echo SOURCE_BRANCH=${SOURCE_BRANCH}
        echo TARGET_BRANCH=${TARGET_BRANCH}
        python .github/update-release-branch.py \
+          --github-token ${{ secrets.GITHUB_TOKEN }} \
          --repository-nwo ${{ github.repository }} \
          --source-branch ${SOURCE_BRANCH} \
          --target-branch ${TARGET_BRANCH} \
@@ -11,5 +11,3 @@ build/
 eslint.sarif
 # for local incremental compilation
 tsconfig.tsbuildinfo
-# esbuild metadata file
-meta.json
@@ -19,7 +19,7 @@
    "scope": "javascript, typescript",
    "prefix": "testMacro",
    "body": [
-      "const ${1:nameMacro} = makeMacro({",
+      "const ${1:nameMacro} = test.macro({",
      "  exec: async (t: ExecutionContext<unknown>) => {},",
      "",
      "  title: (providedTitle = \"\") => `${2:common title} - \\${providedTitle}`,",
@@ -2,62 +2,24 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## 4.36.0 - 22 May 2026
-
- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
- Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
- Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926)
-
-## 4.35.5 - 15 May 2026
-
- We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
- For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
- If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
- Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)
-
-## 4.35.4 - 07 May 2026
-
- Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)
-
-## 4.35.3 - 01 May 2026
-
- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
- Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
- Best-effort connection tests for private registries now use `GET` requests instead of `HEAD` for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. [#3853](https://github.com/github/codeql-action/pull/3853)
- Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
- Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)
-
-## 4.35.2 - 15 Apr 2026
-
- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
- The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
- Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://github.com/github/codeql-action/pull/3794)
- Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
- Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
-
-## 4.35.1 - 27 Mar 2026
-
- Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)
-
-## 4.35.0 - 27 Mar 2026
+## 3.35.0 - 27 Mar 2026

 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
 - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)

-## 4.34.1 - 20 Mar 2026
+## 3.34.1 - 20 Mar 2026

 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)

-## 4.34.0 - 20 Mar 2026
+## 3.34.0 - 20 Mar 2026

 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
 - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
 - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)

-## 4.33.0 - 16 Mar 2026
+## 3.33.0 - 16 Mar 2026

 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)
-
  To opt out of this change:
  - **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
  - **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow.
@@ -68,11 +30,11 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
 - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

-## 4.32.6 - 05 Mar 2026
+## 3.32.6 - 05 Mar 2026

 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)

-## 4.32.5 - 02 Mar 2026
+## 3.32.5 - 02 Mar 2026

 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
 - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
@@ -82,7 +44,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
 - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)

-## 4.32.4 - 20 Feb 2026
+## 3.32.4 - 20 Feb 2026

 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
 - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
@@ -90,88 +52,88 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
 - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)

-## 4.32.3 - 13 Feb 2026
+## 3.32.3 - 13 Feb 2026

 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

-## 4.32.2 - 05 Feb 2026
+## 3.32.2 - 05 Feb 2026

 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)

-## 4.32.1 - 02 Feb 2026
+## 3.32.1 - 02 Feb 2026

 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
 - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)

-## 4.32.0 - 26 Jan 2026
+## 3.32.0 - 26 Jan 2026

 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425)

-## 4.31.11 - 23 Jan 2026
+## 3.31.11 - 23 Jan 2026

 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409)
 - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415)
 - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318)
 - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403)

-## 4.31.10 - 12 Jan 2026
+## 3.31.10 - 12 Jan 2026

 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393)

-## 4.31.9 - 16 Dec 2025
+## 3.31.9 - 16 Dec 2025

 No user facing changes.

-## 4.31.8 - 11 Dec 2025
+## 3.31.8 - 11 Dec 2025

 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354)

-## 4.31.7 - 05 Dec 2025
+## 3.31.7 - 05 Dec 2025

 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343)

-## 4.31.6 - 01 Dec 2025
+## 3.31.6 - 01 Dec 2025

 No user facing changes.

-## 4.31.5 - 24 Nov 2025
+## 3.31.5 - 24 Nov 2025

 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321)

-## 4.31.4 - 18 Nov 2025
+## 3.31.4 - 18 Nov 2025

 No user facing changes.

-## 4.31.3 - 13 Nov 2025
+## 3.31.3 - 13 Nov 2025

 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
 - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)

-## 4.31.2 - 30 Oct 2025
+## 3.31.2 - 30 Oct 2025

 No user facing changes.

-## 4.31.1 - 30 Oct 2025
+## 3.31.1 - 30 Oct 2025

 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

-## 4.31.0 - 24 Oct 2025
+## 3.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 4.30.9 - 17 Oct 2025
+## 3.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 4.30.8 - 10 Oct 2025
+## 3.30.8 - 10 Oct 2025

 No user facing changes.

-## 4.30.7 - 06 Oct 2025
+## 3.30.7 - 06 Oct 2025

- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
+No user facing changes.

 ## 3.30.6 - 02 Oct 2025

@@ -407,17 +369,13 @@ No user facing changes.
 ## 3.26.12 - 07 Oct 2024

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520)
-
  - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
-
  - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

 ## 3.26.11 - 03 Oct 2024

 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts.
-
  Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then.
-
  This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES.
 - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519)

@@ -540,12 +498,9 @@ No user facing changes.
 ## 3.25.0 - 15 Apr 2024

 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224)
-
  As a result, the following inputs and environment variables are now ignored:
-
  - The `setup-python-dependencies` input to the `init` Action
  - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable
-
  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.
 - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229)
 - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232)
@@ -71,7 +71,7 @@ Once the mergeback and backport pull request have been merged, the release is co

 Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [sync-checks.ts](pr-checks/sync-checks.ts) script:

- At a minimum, you must provide a token with permissions to update branch protection rules. For example, `gh auth token | pr-checks/sync-checks.ts --token-stdin` uses the same token that `gh` uses. You can also set the `GH_TOKEN` or `GITHUB_TOKEN` environment variable. If no token is provided or the token has insufficient permissions, the script will fail.
+- At a minimum, you must provide an argument for the `--token` input. For example, `--token "$(gh auth token)"` to use the same token that `gh` uses. If no token is provided or the token has insufficient permissions, the script will fail.
 - By default, the script performs a dry run and outputs information about the changes it would make to the branch protection rules. To actually apply the changes, specify the `--apply` flag.
 - If you run the script without any other arguments, it will retrieve the set of workflows that ran for the latest commit on `main`.
 - You can specify a different git ref with the `--ref` input. You will likely want to use this if you have a PR that removes or adds PR checks. For example, `--ref "some/branch/name"` to use the HEAD of the `some/branch/name` branch.
@@ -72,12 +72,13 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n

 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
-| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
 | `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |
 | `v3.28.12` | `2.20.7` | Enterprise Server 3.17 | |
 | `v3.28.6` | `2.20.3` | Enterprise Server 3.16 | |
+| `v3.28.6` | `2.20.3` | Enterprise Server 3.15 | |
+| `v3.28.6` | `2.20.3` | Enterprise Server 3.14 | |

 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).

@@ -94,6 +94,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
-  main: "../lib/analyze-entry.js"
-  post: "../lib/analyze-post-entry.js"
+  using: node20
+  main: "../lib/analyze-action.js"
+  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node24
-  main: '../lib/autobuild-entry.js'
+  using: node20
+  main: '../lib/autobuild-action.js'
@@ -1,5 +1,5 @@
-import { copyFile, readFile, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { copyFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";

 import * as esbuild from "esbuild";
@@ -62,161 +62,19 @@ const onEndPlugin = {
  },
 };

-/** The name of the virtual `entry-points` module. */
-const SHARED_ENTRYPOINT = "entry-points";
-
-/** The property name under which `upload-lib`'s namespace is exposed in `entry-points`. */
-const UPLOAD_LIB_EXPORT = "uploadLib";
-
-/** The relative source path of the `upload-lib` module that we re-export from `entry-points`. */
-const UPLOAD_LIB_SRC = "./src/upload-lib";
-
-/**
- * This plugin finds all source files that contain Action entry points. It then generates the
- * virtual `entry-points` module which imports all identified files, and re-exports their
- * `runWrapper` functions with suitable aliases.
- *
- * The virtual module additionally re-exports `upload-lib` under the `uploadLib` namespace so that
- * external consumers can access it via the small `lib/upload-lib.js` stub emitted below.
- * 
- * A tiny stub file is emitted for each Action entrypoint, and one for `upload-lib`. Each stub
- * imports the shared bundle and calls/re-exports from the respective entry point.
- *
- * @type {esbuild.Plugin}
- */
-const entryPointsPlugin = {
-  name: "entry-points",
-  setup(build) {
-    const namespace = "actions";
-    const actions = [];
-
-    const toPascal = (s) =>
-      s.replace(/(^|-)([a-z0-9])/gi, (_, __, c) => c.toUpperCase());
-
-    // Find the source files containing Action entry points.
-    build.onStart(() => {
-      const actionFiles = globSync("src/*-action{,-post}.ts");
-      for (const actionFile of actionFiles) {
-        const match = basename(actionFile).match(/(.*)-action(-post)?/);
-
-        if (match.length < 2) {
-          throw new Error(`'${actionFile}' didn't match expected pattern.`);
-        }
-
-        const actionName = match[1];
-        const isPost = match[2] !== undefined;
-
-        actions.push({
-          path: actionFile,
-          name: actionName,
-          isPost,
-          pascalCaseName: `${toPascal(actionName)}${isPost ? "Post" : ""}Action`,
-        });
-      }
-    });
-
-    // Resolve the virtual `entry-points` file and set the corresponding namespace.
-    // Ideally, we'd `RegExp.escape` the entrypoint here, but that API isn't supported in Node 20.
-    // Since we're dealing with a hardcoded string, this isn't too much of a problem.
-    build.onResolve({ filter: new RegExp(`^${SHARED_ENTRYPOINT}$`) }, () => {
-      return { path: SHARED_ENTRYPOINT, namespace };
-    });
-
-    // Generate the virtual `entry-points` file based on the Actions we discovered.
-    // Restrict using the namespace. The path filter does not need to discriminate any further.
-    build.onLoad({ filter: /.*/, namespace }, async () => {
-      const wrapperTemplatePath = "entry-wrapper.js.tpl";
-      const wrapperTemplate = await readFile(
-        join(SRC_DIR, wrapperTemplatePath),
-        "utf-8",
-      );
-
-      const actionsSorted = actions.sort((a, b) =>
-        a.name.localeCompare(b.name),
-      );
-      const imports = actionsSorted
-        .map(
-          (action) =>
-            `import * as ${action.pascalCaseName} from "./src/${basename(action.path)}";`,
-        )
-        .join("\n");
-      const wrappers = actionsSorted
-        .map((action) =>
-          wrapperTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        )
-        .join("\n\n");
-
-      // Also re-export the `upload-lib` namespace so that external consumers can reach it
-      // via the `lib/upload-lib.js` stub without us having to bundle a second copy.
-      const uploadLibReExport = `export * as ${UPLOAD_LIB_EXPORT} from "${UPLOAD_LIB_SRC}";`;
-
-      return {
-        contents: `"use strict";\n${imports}\n\n${uploadLibReExport}\n\n${wrappers}\n`,
-        resolveDir: ".",
-        loader: "ts",
-      };
-    });
-
-    // Emit entry point stubs for each Action using the entry template.
-    build.onEnd(async () => {
-      const makeHeader = (templatePath, sourceFile) =>
-        `// Automatically generated from '${templatePath}' for 'src/${basename(sourceFile)}'.\n\n`;
-
-      // Read the entry point template.
-      const actionTemplatePath = "action-entry.js.tpl";
-      const actionTemplate = await readFile(
-        join(SRC_DIR, actionTemplatePath),
-        "utf-8",
-      );
-
-      // Write entry point stubs for each Action.
-      for (const action of actions) {
-        await writeFile(
-          join(
-            OUT_DIR,
-            `${action.name}${action.isPost ? "-post" : ""}-entry.js`,
-          ),
-          makeHeader(actionTemplatePath, action.path) +
-            actionTemplate.replaceAll("__ACTION__", action.pascalCaseName),
-        );
-      }
-
-      // Write a small stub for `upload-lib` that re-exports it from the shared bundle.
-      // External callers (e.g. internal testing environments) `require("./lib/upload-lib")`
-      // and expect the same shape as before, so we expose the namespace as `module.exports`.
-      const uploadLibStubTemplatePath = "upload-lib-stub.js.tpl";
-      const uploadLibStubTemplate = await readFile(
-        join(SRC_DIR, uploadLibStubTemplatePath),
-        "utf-8",
-      );
-      await writeFile(
-        join(OUT_DIR, "upload-lib.js"),
-        makeHeader(uploadLibStubTemplatePath, `${UPLOAD_LIB_SRC}.ts`) +
-          uploadLibStubTemplate.replaceAll(
-            "__UPLOAD_LIB_EXPORT__",
-            UPLOAD_LIB_EXPORT,
-          ),
-      );
-    });
-  },
-};
-
 const context = await esbuild.context({
-  entryPoints: [{ in: SHARED_ENTRYPOINT, out: SHARED_ENTRYPOINT }],
+  // Include upload-lib.ts as an entry point for use in testing environments.
+  entryPoints: globSync([`${SRC_DIR}/*-action.ts`, `${SRC_DIR}/*-action-post.ts`, "src/upload-lib.ts"]),
  bundle: true,
  format: "cjs",
  outdir: OUT_DIR,
  platform: "node",
-  external: ["./entry-points"],
-  plugins: [cleanPlugin, copyDefaultsPlugin, entryPointsPlugin, onEndPlugin],
+  plugins: [cleanPlugin, copyDefaultsPlugin, onEndPlugin],
  target: ["node20"],
  define: {
    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
  },
-  metafile: true,
 });

-const result = await context.rebuild();
-await writeFile(join(__dirname, "meta.json"), JSON.stringify(result.metafile));
-
+await context.rebuild();
 await context.dispose();
@@ -170,6 +170,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
-  main: '../lib/init-entry.js'
-  post: '../lib/init-post-entry.js'
+  using: node20
+  main: '../lib/init-action.js'
+  post: '../lib/init-action-post.js'
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzeAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/analyze-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAnalyzePostAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/autobuild-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runAutobuildAction)();
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.5",
-  "cliVersion": "2.25.5",
-  "priorBundleVersion": "codeql-bundle-v2.25.4",
-  "priorCliVersion": "2.25.4"
+  "bundleVersion": "codeql-bundle-v2.25.1",
+  "cliVersion": "2.25.1",
+  "priorBundleVersion": "codeql-bundle-v2.24.3",
+  "priorCliVersion": "2.24.3"
 }
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/init-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runInitAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/init-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runInitPostAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/resolve-environment-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runResolveEnvironmentAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/setup-codeql-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runSetupCodeqlAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runStartProxyAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/start-proxy-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runStartProxyPostAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runUploadSarifAction)();
@@ -1,6 +0,0 @@
-// Automatically generated from 'action-entry.js.tpl' for 'src/upload-sarif-action-post.ts'.
-
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.runUploadSarifPostAction)();
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.36.0",
+  "version": "3.35.0",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -12,8 +12,7 @@
    "ava": "npm run transpile && ava --verbose",
    "test": "npm run ava -- src/",
    "test-debug": "npm run test -- --timeout=20m",
-    "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "./pr-checks/sync.sh"
+    "transpile": "tsc --build --verbose"
  },
  "license": "MIT",
  "workspaces": [
@@ -30,46 +29,47 @@
    "@actions/http-client": "^3.0.0",
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
-    "@octokit/plugin-retry": "^8.1.0",
+    "@octokit/plugin-retry": "^8.0.0",
+    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
    "fast-deep-equal": "^3.1.3",
-    "follow-redirects": "^1.16.0",
+    "follow-redirects": "^1.15.11",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
    "js-yaml": "^4.1.1",
-    "jsonschema": "1.5.0",
+    "jsonschema": "1.4.1",
    "long": "^5.3.2",
-    "node-forge": "^1.4.0",
+    "node-forge": "^1.3.3",
    "semver": "^7.7.4",
-    "uuid": "^14.0.0"
+    "uuid": "^13.0.0"
  },
  "devDependencies": {
    "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^2.0.5",
+    "@eslint/compat": "^2.0.3",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
    "@octokit/types": "^16.0.0",
    "@types/archiver": "^7.0.0",
    "@types/follow-redirects": "^1.14.4",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.19.39",
+    "@types/node": "^20.19.9",
    "@types/node-forge": "^1.3.14",
    "@types/sarif": "^2.1.7",
    "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.1",
-    "ava": "^6.4.1",
-    "esbuild": "^0.28.0",
-    "eslint": "^9.39.4",
-    "eslint-import-resolver-typescript": "^4.4.4",
+    "@types/sinon": "^21.0.0",
+    "ava": "^7.0.0",
+    "esbuild": "^0.27.4",
+    "eslint": "^9.39.2",
+    "eslint-import-resolver-typescript": "^3.8.7",
    "eslint-plugin-github": "^6.0.0",
    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jsdoc": "^62.9.0",
+    "eslint-plugin-jsdoc": "^62.8.0",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^11.1.0",
-    "globals": "^17.6.0",
-    "nock": "^14.0.12",
-    "sinon": "^22.0.0",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.2"
+    "globals": "^17.4.0",
+    "nock": "^14.0.11",
+    "sinon": "^21.0.3",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.1"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -90,7 +90,7 @@
    "eslint-plugin-jsx-a11y": {
      "semver": ">=6.3.1"
    },
-    "glob": "^11.1.0",
-    "undici": "^6.24.0"
+    "brace-expansion@2.0.1": "2.0.2",
+    "glob": "^11.1.0"
  }
 }
@@ -1,13 +0,0 @@
-import * as githubUtils from "@actions/github/lib/utils";
-import { type Octokit } from "@octokit/core";
-import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
-import { type Api } from "@octokit/plugin-rest-endpoint-methods";
-
-/** The type of the Octokit client. */
-export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
-
-/** Constructs an `ApiClient` using `token` for authentication. */
-export function getApiClient(token: string): ApiClient {
-  const opts = githubUtils.getOctokitOptions(token);
-  return new githubUtils.GitHub(opts);
-}
@@ -1,48 +0,0 @@
-#!/usr/bin/env npx tsx
-
-import * as fs from "node:fs/promises";
-
-import { BUNDLE_METADATA_FILE } from "./config";
-
-interface InputInfo {
-  bytesInOutput: number;
-}
-
-type Inputs = Record<string, InputInfo>;
-
-interface Output {
-  bytes: number;
-  inputs: Inputs;
-}
-
-interface Metadata {
-  outputs: Record<string, Output>;
-}
-
-function toMB(bytes: number): string {
-  return `${(bytes / (1024 * 1024)).toFixed(2)}MB`;
-}
-
-async function main() {
-  const fileContents = await fs.readFile(BUNDLE_METADATA_FILE);
-  const metadata = JSON.parse(String(fileContents)) as Metadata;
-
-  for (const [outputFile, outputData] of Object.entries(
-    metadata.outputs,
-  ).reverse()) {
-    console.info(`${outputFile}: ${toMB(outputData.bytes)}`);
-
-    for (const [inputName, inputData] of Object.entries(outputData.inputs)) {
-      // Ignore any inputs that make up less than 5% of the output.
-      const percentage = (inputData.bytesInOutput / outputData.bytes) * 100.0;
-      if (percentage < 5.0) continue;
-
-      console.info(`  ${inputName}: ${toMB(inputData.bytesInOutput)}`);
-    }
-  }
-}
-
-// Only call `main` if this script was run directly.
-if (require.main === module) {
-  void main();
-}
@@ -1,259 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Tests for check-repo-size.ts.
-*/
-
-import * as assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { afterEach, beforeEach, describe, it } from "node:test";
-
-import {
-  COMMENT_MARKER,
-  DEFAULT_BASE_REF,
-  buildCommentBody,
-  formatBytes,
-  formatPercent,
-  isDeltaSignificant,
-  measureArchiveSize,
-  readArgs,
-} from "./check-repo-size";
-
-describe("formatBytes", async () => {
-  const cases: Array<[number, boolean, string]> = [
-    // Unsigned values, including sub-KiB amounts which round to 0.00.
-    [0, false, "0.00 KiB"],
-    [512, false, "0.50 KiB"],
-    [1024, false, "1.00 KiB"],
-    [1024 * 1024, false, "1024.00 KiB"],
-    [2 * 1024 * 1024, false, "2048.00 KiB"],
-    // Negative values always use a leading minus.
-    [-2 * 1024 * 1024, false, "-2048.00 KiB"],
-    // signed=true prepends a + to non-negative values.
-    [0, true, "+0.00 KiB"],
-    [2 * 1024 * 1024, true, "+2048.00 KiB"],
-    [-2 * 1024 * 1024, true, "-2048.00 KiB"],
-  ];
-  for (const [bytes, signed, expected] of cases) {
-    await it(`formats ${bytes} (signed=${signed}) as ${expected}`, () => {
-      assert.equal(formatBytes(bytes, signed), expected);
-    });
-  }
-});
-
-describe("formatPercent", async () => {
-  await it("formats positive fractions with a leading +", () => {
-    assert.equal(formatPercent(0.1), "+10.00%");
-    assert.equal(formatPercent(0.0123), "+1.23%");
-  });
-
-  await it("formats negative fractions with a leading -", () => {
-    assert.equal(formatPercent(-0.1), "-10.00%");
-  });
-
-  await it("formats zero without a sign", () => {
-    assert.equal(formatPercent(0), "0.00%");
-  });
-});
-
-describe("isDeltaSignificant", async () => {
-  const cases: Array<[number, number, number, boolean]> = [
-    // At and above threshold (both signs).
-    [100, 1000, 0.1, true],
-    [101, 1000, 0.1, true],
-    [-100, 1000, 0.1, true],
-    // Below threshold (both signs, plus exact zero).
-    [99, 1000, 0.1, false],
-    [-99, 1000, 0.1, false],
-    [0, 1000, 0.1, false],
-  ];
-  for (const [delta, base, fraction, expected] of cases) {
-    await it(`returns ${expected} for delta=${delta}, base=${base}, fraction=${fraction}`, () => {
-      assert.equal(isDeltaSignificant(delta, base, fraction), expected);
-    });
-  }
-});
-
-describe("buildCommentBody", async () => {
-  await it("includes the marker, the base/PR/delta rows, and the run URL", () => {
-    const body = buildCommentBody({
-      baseRef: "main",
-      baseSize: 2_000_000,
-      prSize: 2_300_000,
-      runUrl: "https://example.test/run",
-    });
-
-    assert.match(body, new RegExp(`^${escapeRegExp(COMMENT_MARKER)}`));
-    assert.match(body, /Base \(`main`\) \| 1953\.13 KiB \(2000000 bytes\)/);
-    assert.match(body, /This PR \| 2246\.09 KiB \(2300000 bytes\)/);
-    assert.match(
-      body,
-      /\*\*Delta\*\* \| \*\*\+292\.97 KiB \(\+300000 bytes, \+15\.00%\)\*\*/,
-    );
-    assert.match(body, /\[workflow run\]\(https:\/\/example\.test\/run\)/);
-  });
-
-  await it("formats negative deltas with a leading minus and omits the run URL when missing", () => {
-    const body = buildCommentBody({
-      baseRef: "main",
-      baseSize: 2_000_000,
-      prSize: 1_800_000,
-    });
-    assert.match(
-      body,
-      /\*\*Delta\*\* \| \*\*-195\.31 KiB \(-200000 bytes, -10\.00%\)\*\*/,
-    );
-    assert.doesNotMatch(body, /workflow run/);
-  });
-});
-
-describe("readArgs", async () => {
-  await it("defaults the base ref and head commit for local runs", () => {
-    const originalEnv = process.env;
-    const originalArgv = process.argv;
-
-    try {
-      process.env = {};
-      process.argv = ["node", "check-repo-size.ts", "--output-dir", "/tmp/out"];
-
-      const args = readArgs();
-
-      assert.equal(args.baseRef, DEFAULT_BASE_REF);
-      assert.equal(args.baseCommitish, `origin/${DEFAULT_BASE_REF}`);
-      assert.equal(args.headCommitish, "HEAD");
-      assert.equal(args.outputDir, "/tmp/out");
-      assert.equal(args.runUrl, undefined);
-    } finally {
-      process.env = originalEnv;
-      process.argv = originalArgv;
-    }
-  });
-
-  await it("uses the base and head SHAs when provided by the workflow", () => {
-    const originalEnv = process.env;
-    const originalArgv = process.argv;
-
-    try {
-      process.env = {
-        BASE_REF: "main",
-        BASE_SHA: "abc123",
-        HEAD_SHA: "def456",
-        RUN_URL: "https://example.test/run",
-      };
-      process.argv = ["node", "check-repo-size.ts", "--output-dir", "/tmp/out"];
-
-      const args = readArgs();
-
-      assert.equal(args.baseRef, "main");
-      assert.equal(args.baseCommitish, "abc123");
-      assert.equal(args.headCommitish, "def456");
-      assert.equal(args.outputDir, "/tmp/out");
-      assert.equal(args.runUrl, "https://example.test/run");
-    } finally {
-      process.env = originalEnv;
-      process.argv = originalArgv;
-    }
-  });
-
-  await it("throws when --output-dir is missing", () => {
-    const originalEnv = process.env;
-    const originalArgv = process.argv;
-
-    try {
-      process.env = {};
-      process.argv = ["node", "check-repo-size.ts"];
-      assert.throws(() => readArgs(), /--output-dir is required/);
-    } finally {
-      process.env = originalEnv;
-      process.argv = originalArgv;
-    }
-  });
-});
-
-let repoDir: string;
-
-beforeEach(() => {
-  repoDir = fs.mkdtempSync(path.join(os.tmpdir(), "check-repo-size-test-"));
-  execFileSync("git", ["init", "--initial-branch=main", "-q"], {
-    cwd: repoDir,
-  });
-  execFileSync("git", ["config", "user.email", "test@example.test"], {
-    cwd: repoDir,
-  });
-  execFileSync("git", ["config", "user.name", "Test"], { cwd: repoDir });
-  execFileSync("git", ["config", "commit.gpgsign", "false"], { cwd: repoDir });
-});
-
-afterEach(() => {
-  fs.rmSync(repoDir, { recursive: true, force: true });
-});
-
-function commit(name: string, content: string, message: string) {
-  fs.writeFileSync(path.join(repoDir, name), content);
-  execFileSync("git", ["add", name], { cwd: repoDir });
-  execFileSync("git", ["commit", "-q", "-m", message], { cwd: repoDir });
-}
-
-describe("measureArchiveSize", async () => {
-  await it("returns a positive byte count for a non-empty repo", async () => {
-    commit("a.txt", "hello world\n", "first");
-    const size = await measureArchiveSize("HEAD", repoDir);
-    assert.ok(size > 0, `expected size > 0, got ${size}`);
-  });
-
-  await it("returns the same size on repeated runs (deterministic)", async () => {
-    commit("a.txt", "hello world\n", "first");
-    const a = await measureArchiveSize("HEAD", repoDir);
-    const b = await measureArchiveSize("HEAD", repoDir);
-    assert.equal(a, b);
-  });
-
-  await it("returns a larger size when more content is added", async () => {
-    commit("a.txt", "hello world\n", "first");
-    const small = await measureArchiveSize("HEAD", repoDir);
-
-    // Use random bytes so the new content is incompressible and the archive
-    // is guaranteed to grow even after gzip.
-    commit("b.bin", randomBytes(8192).toString("base64"), "second");
-    const big = await measureArchiveSize("HEAD", repoDir);
-    assert.ok(
-      big > small,
-      `expected ${big} > ${small} after adding more content`,
-    );
-  });
-
-  await it("ignores untracked files (e.g. node_modules)", async () => {
-    commit("a.txt", "hello\n", "first");
-    commit(".gitignore", "node_modules/\n", "ignore node_modules");
-    const sizeBefore = await measureArchiveSize("HEAD", repoDir);
-
-    fs.mkdirSync(path.join(repoDir, "node_modules"));
-    fs.writeFileSync(
-      path.join(repoDir, "node_modules", "huge.bin"),
-      "x".repeat(1_000_000),
-    );
-
-    const sizeAfter = await measureArchiveSize("HEAD", repoDir);
-    assert.equal(
-      sizeAfter,
-      sizeBefore,
-      "untracked node_modules should not affect the archive size",
-    );
-  });
-
-  await it("rejects when the ref does not exist", async () => {
-    commit("a.txt", "hello\n", "first");
-    await assert.rejects(
-      () => measureArchiveSize("does-not-exist", repoDir),
-      /git archive does-not-exist exited with code/,
-    );
-  });
-});
-
-function escapeRegExp(s: string): string {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
@@ -1,223 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Measures the difference in the `.tar.gz`'d checkout size of the repo between the PR head and the PR
-base. This size is relevant because it corresponds to the duration of the "Download action
-repository" step that happens at the start of every job that uses this Action.
-
-Writes the candidate sticky-comment body and a small metadata file to `--output-dir`. A separate
-workflow job consumes those artifacts and decides whether to create or update a PR comment.
-*/
-
-import { spawn } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { parseArgs } from "node:util";
-
-import { REPO_ROOT } from "./config";
-
-/** Hidden marker used to find the existing sticky comment on a PR. */
-export const COMMENT_MARKER = "<!-- repo-size-diff-bot -->";
-
-export const DEFAULT_BASE_REF = "main";
-
-/**
- * Fraction of the base archive size at which a delta is considered significant enough to warrant
- * a new sticky comment. We always update an existing comment regardless, so the comment stays in
- * sync as the diff evolves.
- */
-export const SIGNIFICANT_DELTA_FRACTION = 0.1;
-
-/**
- * Stream `git archive --format=tar.gz <ref>` and count the compressed bytes.
- *
- * `git archive` only includes tracked files, so untracked directories like `node_modules` and
- * `build` aren't counted in the size downloaded when starting up a CodeQL job.
- */
-export async function measureArchiveSize(
-  ref: string,
-  cwd: string,
-): Promise<number> {
-  const git = spawn("git", ["archive", "--format=tar.gz", ref], { cwd });
-
-  let stderr = "";
-  git.stderr.on("data", (chunk: Buffer) => {
-    stderr += chunk.toString();
-  });
-
-  let size = 0;
-  git.stdout.on("data", (chunk: Buffer) => {
-    size += chunk.length;
-  });
-
-  const exitCode = await new Promise<number>((resolve, reject) => {
-    git.on("error", reject);
-    git.on("close", resolve);
-  });
-
-  if (exitCode !== 0) {
-    throw new Error(
-      `git archive ${ref} exited with code ${exitCode}: ${stderr.trim()}`,
-    );
-  }
-  return size;
-}
-
-/**
- * Format a byte count as KiB. If `signed` is true, a leading `+` is prepended for non-negative
- * values so gains and losses are visually distinct.
- */
-export function formatBytes(bytes: number, signed = false): string {
-  const sign = bytes < 0 ? "-" : signed ? "+" : "";
-  const kib = Math.abs(bytes) / 1024;
-  return `${sign}${kib.toFixed(2)} KiB`;
-}
-
-/** Format a fraction as a signed percentage with 2 decimal places. */
-export function formatPercent(fraction: number): string {
-  const pct = fraction * 100;
-  const sign = pct > 0 ? "+" : "";
-  return `${sign}${pct.toFixed(2)}%`;
-}
-
-export interface CommentBodyOptions {
-  baseRef: string;
-  baseSize: number;
-  prSize: number;
-  /** Optional URL of the workflow run, included in the comment footer. */
-  runUrl?: string;
-}
-
-export function buildCommentBody(opts: CommentBodyOptions): string {
-  const { baseRef, baseSize, prSize, runUrl } = opts;
-  const delta = prSize - baseSize;
-  const signedDelta = delta >= 0 ? `+${delta}` : `${delta}`;
-  const runUrlLine = runUrl
-    ? ` See the [workflow run](${runUrl}) for details.`
-    : "";
-
-  return [
-    COMMENT_MARKER,
-    "### Repository checkout size",
-    "",
-    "| | Compressed archive size |",
-    "|---|---|",
-    `| Base (\`${baseRef}\`) | ${formatBytes(baseSize)} (${baseSize} bytes) |`,
-    `| This PR | ${formatBytes(prSize)} (${prSize} bytes) |`,
-    `| **Delta** | **${formatBytes(delta, true)} (${signedDelta} bytes, ${formatPercent(delta / baseSize)})** |`,
-    "",
-    "Sizes are measured by streaming `git archive --format=tar.gz <ref>`, " +
-      "which includes tracked files and excludes untracked files such as " +
-      "`node_modules`. The compressed checkout is " +
-      "downloaded by every consumer of this Action, so changes here directly " +
-      `affect Action download time.${runUrlLine}`,
-  ].join("\n");
-}
-
-/**
- * Returns true when the absolute delta is at least `fraction` of the base size. Both increases and
- * decreases are considered significant, so we report wins as well as losses.
- */
-export function isDeltaSignificant(
-  delta: number,
-  baseSize: number,
-  fraction: number,
-): boolean {
-  return Math.abs(delta) >= baseSize * fraction;
-}
-
-interface MainArgs {
-  /** Base ref of the PR. Defaults to `main`. Used as the label in the PR comment. */
-  baseRef: string;
-  /** Base commit-ish to archive. Defaults to `origin/<baseRef>` for local runs. */
-  baseCommitish: string;
-  /** Head commit-ish to archive. Defaults to `HEAD` for local runs. */
-  headCommitish: string;
-  /** Optional URL of the workflow run, surfaced in the comment footer. */
-  runUrl?: string;
-  /** Directory where `body.md` and `metadata.json` are written. */
-  outputDir: string;
-}
-
-export function readArgs(): MainArgs {
-  const { values } = parseArgs({
-    options: {
-      "output-dir": { type: "string" },
-    },
-    strict: true,
-  });
-
-  const outputDir = values["output-dir"];
-  if (!outputDir) {
-    throw new Error("--output-dir is required");
-  }
-
-  const baseRef = process.env.BASE_REF ?? DEFAULT_BASE_REF;
-  const baseCommitish = process.env.BASE_SHA ?? `origin/${baseRef}`;
-  const headCommitish = process.env.HEAD_SHA ?? "HEAD";
-
-  return {
-    baseRef,
-    baseCommitish,
-    headCommitish,
-    runUrl: process.env.RUN_URL,
-    outputDir,
-  };
-}
-
-async function main(): Promise<number> {
-  const args = readArgs();
-
-  console.log(`Measuring base archive size for ${args.baseCommitish}...`);
-  const baseSize = await measureArchiveSize(args.baseCommitish, REPO_ROOT);
-  console.log(`  ${baseSize} bytes`);
-
-  console.log(`Measuring PR archive size for ${args.headCommitish}...`);
-  const prSize = await measureArchiveSize(args.headCommitish, REPO_ROOT);
-  console.log(`  ${prSize} bytes`);
-
-  const delta = prSize - baseSize;
-  const significant = isDeltaSignificant(
-    delta,
-    baseSize,
-    SIGNIFICANT_DELTA_FRACTION,
-  );
-  console.log(
-    `Delta: ${delta} bytes (significant=${significant}, threshold=${(
-      SIGNIFICANT_DELTA_FRACTION * 100
-    ).toFixed(2)}%)`,
-  );
-
-  const body = buildCommentBody({
-    baseRef: args.baseRef,
-    baseSize,
-    prSize,
-    runUrl: args.runUrl,
-  });
-
-  fs.mkdirSync(args.outputDir, { recursive: true });
-  fs.writeFileSync(path.join(args.outputDir, "body.md"), body);
-  fs.writeFileSync(
-    path.join(args.outputDir, "metadata.json"),
-    `${JSON.stringify(
-      { significant, baseRef: args.baseRef, baseSize, prSize, delta },
-      null,
-      2,
-    )}\n`,
-  );
-  console.log(`Wrote body.md and metadata.json to ${args.outputDir}.`);
-  return 0;
-}
-
-async function run(): Promise<void> {
-  try {
-    process.exit(await main());
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-  }
-}
-
-if (require.main === module) {
-  void run();
-}
@@ -5,12 +5,12 @@ versions:
 steps:
  - uses: ./../action/init
    with:
-      languages: C#,java-kotlin,typescript
+      languages: C#,java-kotlin,swift,typescript
      tools: ${{ steps.prepare-test.outputs.tools-url }}

  - name: "Check languages"
    run: |
-      expected_languages="csharp,java,javascript"
+      expected_languages="csharp,java,swift,javascript"
      actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)

      if [ "$expected_languages" != "$actual_languages" ]; then
@@ -2,8 +2,7 @@ name: "Multi-language repository"
 description: "An end-to-end integration test of a multi-language repository using automatic language detection"
 operatingSystems:
  - ubuntu
-  - os: macos
-    runner-image: macos-latest-xlarge
+  - macos
 env:
  CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
 installGo: true
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+    uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -2,7 +2,7 @@ name: "Rust analysis"
 description: "Tests creation of a Rust database"
 versions:
  # experimental rust support introduced, requires action to set `CODEQL_ENABLE_EXPERIMENTAL_FEATURES`
-  - stable-v2.19.4
+  - stable-v2.19.3
  # first public preview version
  - stable-v2.22.1
  - linked
@@ -16,17 +16,7 @@ steps:
    id: proxy
    uses: ./../action/start-proxy
    with:
-      registry_secrets: |
-        [
-          {
-            "type": "maven_repository",
-            "url": "https://repo.maven.apache.org/maven2/"
-          },
-          {
-            "type": "maven_repository",
-            "url": "https://repo1.maven.org/maven2"
-          }
-        ]
+      registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'

  - name: Print proxy outputs
    run: |
@@ -37,10 +27,3 @@ steps:
  - name: Fail if proxy outputs are not set
    if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
    run: exit 1
-
-  - name: Fail if proxy_urls does not contain all registries
-    if: |
-      join(fromJSON(steps.proxy.outputs.proxy_urls)[*].type, ',') != 'maven_repository,maven_repository'
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
-      || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
-    run: exit 1
@@ -3,8 +3,7 @@ description: "Tests creation of a Swift database using autobuild"
 versions:
  - nightly-latest
 operatingSystems:
-  - os: macos
-    runner-image: macos-latest-xlarge
+  - macos
 steps:
  - uses: ./../action/init
    id: init
@@ -6,21 +6,5 @@ export const OLDEST_SUPPORTED_MAJOR_VERSION = 3;
 /** The `pr-checks` directory. */
 export const PR_CHECKS_DIR = __dirname;

-/** The repository root. */
-export const REPO_ROOT = path.join(PR_CHECKS_DIR, "..");
-
 /** The path of the file configuring which checks shouldn't be required. */
 export const PR_CHECK_EXCLUDED_FILE = path.join(PR_CHECKS_DIR, "excluded.yml");
-
-/** The path to the esbuild metadata file. */
-export const BUNDLE_METADATA_FILE = path.join(REPO_ROOT, "meta.json");
-
-/** The `src` directory. */
-const SOURCE_ROOT = path.join(REPO_ROOT, "src");
-
-/** The path to the built-in languages file. */
-export const BUILTIN_LANGUAGES_FILE = path.join(
-  SOURCE_ROOT,
-  "languages",
-  "builtin.json",
-);
@@ -1,17 +1,16 @@
 # PR checks to exclude from required checks
 contains:
-  - "ESLint"
  - "https://"
-  - "test-setup-python-scripts"
-  - "update"
  - "Update"
+  - "ESLint"
+  - "update"
+  - "test-setup-python-scripts"
 is:
-  - "Agent"
-  - "check-expected-release-files"
-  - "Cleanup artifacts"
  - "CodeQL"
  - "Dependabot"
-  - "Label PR with size"
-  - "Post repo size comment"
+  - "check-expected-release-files"
+  - "Agent"
+  - "Cleanup artifacts"
  - "Prepare"
  - "Upload results"
+  - "Label PR with size"
@@ -7,10 +7,10 @@
    "@octokit/core": "^7.0.6",
    "@octokit/plugin-paginate-rest": ">=9.2.2",
    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
-    "yaml": "^2.8.4"
+    "yaml": "^2.8.3"
  },
  "devDependencies": {
-    "@types/node": "^20.19.39",
+    "@types/node": "^20.19.9",
    "tsx": "^4.21.0"
  }
 }
@@ -7,13 +7,7 @@ Tests for the sync-checks.ts script
 import * as assert from "node:assert/strict";
 import { describe, it } from "node:test";

-import {
-  CheckInfo,
-  Exclusions,
-  Options,
-  removeExcluded,
-  resolveToken,
-} from "./sync-checks";
+import { CheckInfo, Exclusions, Options, removeExcluded } from "./sync-checks";

 const defaultOptions: Options = {
  apply: false,
@@ -64,46 +58,3 @@ describe("removeExcluded", async () => {
    assert.deepEqual(retained, expectedExactMatches);
  });
 });
-
-describe("resolveToken", async () => {
-  await it("reads the token from standard input", async () => {
-    const token = await resolveToken(
-      { tokenStdin: true },
-      { env: {}, readStdin: async () => " stdin-token\n" },
-    );
-    assert.equal(token, "stdin-token");
-  });
-
-  await it("reads the token from the GH_TOKEN environment variable", async () => {
-    const token = await resolveToken(
-      {},
-      { env: { GH_TOKEN: "env-token" }, readStdin: async () => "" },
-    );
-    assert.equal(token, "env-token");
-  });
-
-  await it("reads the token from the GITHUB_TOKEN environment variable", async () => {
-    const token = await resolveToken(
-      {},
-      { env: { GITHUB_TOKEN: "env-token" }, readStdin: async () => "" },
-    );
-    assert.equal(token, "env-token");
-  });
-
-  await it("rejects an empty standard input token", async () => {
-    await assert.rejects(
-      resolveToken(
-        { tokenStdin: true },
-        { env: {}, readStdin: async () => "\n" },
-      ),
-      /No token received on standard input/,
-    );
-  });
-
-  await it("rejects missing token sources", async () => {
-    await assert.rejects(
-      resolveToken({}, { env: {}, readStdin: async () => "" }),
-      /Missing authentication token/,
-    );
-  });
-});
@@ -5,9 +5,12 @@
 import * as fs from "fs";
 import { parseArgs } from "node:util";

+import * as githubUtils from "@actions/github/lib/utils";
+import { type Octokit } from "@octokit/core";
+import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
+import { type Api } from "@octokit/plugin-rest-endpoint-methods";
 import * as yaml from "yaml";

-import { type ApiClient, getApiClient } from "./api-client";
 import {
  OLDEST_SUPPORTED_MAJOR_VERSION,
  PR_CHECK_EXCLUDED_FILE,
@@ -15,8 +18,8 @@ import {

 /** Represents the command-line options. */
 export interface Options {
-  /** Whether to read the GitHub API token from standard input. */
-  tokenStdin?: boolean;
+  /** The token to use to authenticate to the GitHub API. */
+  token?: string;
  /** The git ref to use the checks for. */
  ref?: string;
  /** Whether to actually apply the changes or not. */
@@ -31,65 +34,6 @@ const codeqlActionRepo = {
  repo: "codeql-action",
 };

-/** Environment variables to check for a GitHub API token. */
-const TOKEN_ENVIRONMENT_VARIABLES = ["GH_TOKEN", "GITHUB_TOKEN"];
-
-/** Represents the sources from which we can retrieve the GitHub API token. */
-interface TokenSource {
-  /** Environment variables to inspect. */
-  env: NodeJS.ProcessEnv;
-  /** Reads a token from standard input. */
-  readStdin: () => Promise<string>;
-}
-
-/** Reads the GitHub API token from standard input. */
-async function readTokenFromStdin(): Promise<string> {
-  let token = "";
-  process.stdin.setEncoding("utf8");
-  for await (const chunk of process.stdin) {
-    token += chunk;
-  }
-  return token.trim();
-}
-
-/** Gets a GitHub API token from one of the supported environment variables. */
-function getTokenFromEnvironment(env: NodeJS.ProcessEnv): string | undefined {
-  for (const variableName of TOKEN_ENVIRONMENT_VARIABLES) {
-    const token = env[variableName]?.trim();
-    if (token) {
-      return token;
-    }
-  }
-  return undefined;
-}
-
-/** Gets the token to use to authenticate to the GitHub API. */
-export async function resolveToken(
-  options: Pick<Options, "tokenStdin">,
-  tokenSource: TokenSource = {
-    env: process.env,
-    readStdin: readTokenFromStdin,
-  },
-): Promise<string> {
-  if (options.tokenStdin) {
-    const token = (await tokenSource.readStdin()).trim();
-    if (token.length === 0) {
-      throw new Error("No token received on standard input.");
-    }
-    return token;
-  }
-
-  const environmentToken = getTokenFromEnvironment(tokenSource.env);
-  if (environmentToken !== undefined) {
-    return environmentToken;
-  }
-
-  throw new Error(
-    "Missing authentication token. Set GH_TOKEN/GITHUB_TOKEN or pipe a token " +
-      "to --token-stdin.",
-  );
-}
-
 /** Represents a configuration of which checks should not be set up as required checks. */
 export interface Exclusions {
  /** A list of strings that, if contained in a check name, are excluded. */
@@ -105,6 +49,15 @@ function loadExclusions(): Exclusions {
  ) as Exclusions;
 }

+/** The type of the Octokit client. */
+type ApiClient = Octokit & Api & { paginate: PaginateInterface };
+
+/** Constructs an `ApiClient` using `token` for authentication. */
+function getApiClient(token: string): ApiClient {
+  const opts = githubUtils.getOctokitOptions(token);
+  return new githubUtils.GitHub(opts);
+}
+
 /**
 * Represents information about a check run. We track the `app_id` that generated the check,
 * because the API will require it in addition to the name in the future.
@@ -264,10 +217,9 @@ async function updateBranch(
 async function main(): Promise<void> {
  const { values: options } = parseArgs({
    options: {
-      // Read the token to use to authenticate to the API from standard input.
-      "token-stdin": {
-        type: "boolean",
-        default: false,
+      // The token to use to authenticate to the API.
+      token: {
+        type: "string",
      },
      // The git ref for which to retrieve the check runs.
      ref: {
@@ -288,16 +240,16 @@ async function main(): Promise<void> {
    strict: true,
  });

-  const token = await resolveToken({
-    tokenStdin: options["token-stdin"],
-  });
+  if (options.token === undefined) {
+    throw new Error("Missing --token");
+  }

  console.info(
    `Oldest supported major version is: ${OLDEST_SUPPORTED_MAJOR_VERSION}`,
  );

  // Initialise the API client.
-  const client = getApiClient(token);
+  const client = getApiClient(options.token);

  // Find the check runs for the specified `ref` that we will later set as the required checks
  // for the main and release branches.
@@ -5,7 +5,7 @@ import * as path from "path";

 import * as yaml from "yaml";

-import { BuiltInLanguage } from "../src/languages";
+import { KnownLanguage } from "../src/languages";

 /** Known workflow input names. */
 enum KnownInputName {
@@ -28,24 +28,6 @@ interface WorkflowInput {
 /** A partial mapping from known input names to input definitions. */
 type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;

-/** An operating system identifier. */
-type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows";
-
-/**
- * Represents an operating system matrix entry for a generated PR check workflow.
- *
- * Either a string containing the OS identifier or an object containing the OS identifier and an
- * optional runner image label.
- */
-type OperatingSystem =
-  | OperatingSystemIdentifier
-  | {
-      /** OS identifier. */
-      os: OperatingSystemIdentifier;
-      /** Optional runner image label. */
-      "runner-image"?: string;
-    };
-
 /**
 * Represents PR check specifications.
 */
@@ -54,8 +36,8 @@ interface Specification extends JobSpecification {
  inputs?: Record<string, WorkflowInput>;
  /** CodeQL bundle versions to test against. Defaults to `DEFAULT_TEST_VERSIONS`. */
  versions?: string[];
-  /** Operating system prefixes, either as strings or with explicit runner image labels. */
-  operatingSystems?: OperatingSystem[];
+  /** Operating system prefixes used to select runner images (e.g. `["ubuntu", "macos"]`). */
+  operatingSystems?: string[];
  /** Per-OS version overrides. If specified for an OS, only those versions are tested on that OS. */
  osCodeQlVersions?: Record<string, string[]>;
  /** Whether to use the all-platform CodeQL bundle. */
@@ -109,12 +91,16 @@ interface LanguageSetup {
  steps: Step[];
 }

-/** Describes partial mappings from built-in languages to their specific setup information. */
-type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
+/** Describes partial mappings from known languages to their specific setup information. */
+type LanguageSetups = Partial<Record<KnownLanguage, LanguageSetup>>;

 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
  // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
+  "stable-v2.17.6",
+  // The last CodeQL release in the 2.18 series.
+  "stable-v2.18.4",
+  // The last CodeQL release in the 2.19 series.
  "stable-v2.19.4",
  // The last CodeQL release in the 2.20 series.
  "stable-v2.20.7",
@@ -122,10 +108,6 @@ const defaultTestVersions = [
  "stable-v2.21.4",
  // The last CodeQL release in the 2.22 series.
  "stable-v2.22.4",
-  // The last CodeQL release in the 2.23 series.
-  "stable-v2.23.9",
-  // The last CodeQL release in the 2.24 series.
-  "stable-v2.24.3",
  // The default version of CodeQL for Dotcom, as determined by feature flags.
  "default",
  // The version of CodeQL shipped with the Action in `defaults.json`. During the release process
@@ -143,7 +125,7 @@ const defaultLanguageVersions = {
  java: "17",
  python: "3.13",
  csharp: "9.x",
-} as const satisfies Partial<Record<BuiltInLanguage, string>>;
+} as const satisfies Partial<Record<KnownLanguage, string>>;

 /** A mapping from known input names to their specifications. */
 const inputSpecs: WorkflowInputs = {
@@ -329,19 +311,10 @@ function generateJobMatrix(
      );
    }

-    const defaultRunnerImages = [
-      "ubuntu-latest",
-      "macos-latest",
-      "windows-latest",
-    ];
+    const runnerImages = ["ubuntu-latest", "macos-latest", "windows-latest"];
    const operatingSystems = checkSpecification.operatingSystems ?? ["ubuntu"];

-    for (const operatingSystemConfig of operatingSystems) {
-      const operatingSystem =
-        typeof operatingSystemConfig === "string"
-          ? operatingSystemConfig
-          : operatingSystemConfig.os;
-
+    for (const operatingSystem of operatingSystems) {
      // If osCodeQlVersions is set for this OS, only include the specified CodeQL versions.
      const allowedVersions =
        checkSpecification.osCodeQlVersions?.[operatingSystem];
@@ -349,13 +322,9 @@ function generateJobMatrix(
        continue;
      }

-      const runnerImagesForOs =
-        typeof operatingSystemConfig === "string" ||
-        operatingSystemConfig["runner-image"] === undefined
-          ? defaultRunnerImages.filter((image) =>
-              image.startsWith(operatingSystem),
-            )
-          : [operatingSystemConfig["runner-image"]];
+      const runnerImagesForOs = runnerImages.filter((image) =>
+        image.startsWith(operatingSystem),
+      );

      for (const runnerImage of runnerImagesForOs) {
        matrix.push({
@@ -395,7 +364,7 @@ function getSetupSteps(checkSpecification: JobSpecification): {
  const inputs: Array<Set<KnownInputName>> = [];
  const steps: Step[] = [];

-  for (const language of Object.values(BuiltInLanguage).sort()) {
+  for (const language of Object.values(KnownLanguage).sort()) {
    const setupSpec = languageSetups[language];

    if (
@@ -3,7 +3,6 @@
  "compilerOptions": {
    /* Basic Options */
    "lib": ["esnext"],
-    "module": "preserve",
    "rootDir": "..",
    "sourceMap": false,
    "noEmit": true,
@@ -1,131 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
- * Updates src/languages/builtin.json by querying the CodeQL CLI for:
- * - Languages that have default queries (via codeql-extractor.yml)
- * - Language aliases (via `codeql resolve languages --format=betterjson --extractor-include-aliases`)
- *
- * Usage:
- *   npx tsx pr-checks/update-builtin-languages.ts [path-to-codeql]
- *
- * If no path is given, falls back to "codeql".
- */
-
-import { execFileSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import * as yaml from "yaml";
-
-import { EnvVar } from "../src/environment";
-
-import { BUILTIN_LANGUAGES_FILE } from "./config";
-
-/** Resolve all known language extractor directories. */
-function resolveLanguages(codeqlPath: string): Record<string, string[]> {
-  return JSON.parse(
-    execFileSync(codeqlPath, ["resolve", "languages", "--format=json"], {
-      encoding: "utf8",
-      env: {
-        ...process.env,
-        [EnvVar.EXPERIMENTAL_FEATURES]: "true", // include experimental languages
-      },
-    }),
-  ) as Record<string, string[]>;
-}
-
-/**
- * Return the sorted list of languages whose extractors ship default queries.
- *
- * @param extractorDirs - Map from language to list of extractor directories
- */
-function findLanguagesWithDefaultQueries(
-  extractorDirs: Record<string, string[]>,
-): string[] {
-  const languages: string[] = [];
-
-  for (const [language, dirs] of Object.entries(extractorDirs)) {
-    if (dirs.length !== 1) {
-      throw new Error(
-        `Expected exactly one extractor directory for language '${language}', but found ${dirs.length}: ${dirs.join(
-          ", ",
-        )}`,
-      );
-    }
-
-    const extractorYmlPath = path.join(dirs[0], "codeql-extractor.yml");
-
-    if (!fs.existsSync(extractorYmlPath)) {
-      throw new Error(
-        `Extractor YAML not found for language '${language}' at expected path: ${extractorYmlPath}`,
-      );
-    }
-
-    const extractorYml = yaml.parse(fs.readFileSync(extractorYmlPath, "utf8"));
-    const defaultQueries: unknown[] | undefined = extractorYml.default_queries;
-
-    if (Array.isArray(defaultQueries) && defaultQueries.length > 0) {
-      console.log(
-        `  ✅ ${language}: included (default queries: ${JSON.stringify(defaultQueries)})`,
-      );
-      languages.push(language);
-    } else {
-      console.log(`  ❌ ${language}: excluded (no default queries)`);
-    }
-  }
-
-  return languages.sort();
-}
-
-/**
- * Resolve language aliases from the CodeQL CLI, keeping only those whose
- * target is in the given set of included languages.
- */
-function resolveAliases(
-  codeqlPath: string,
-  includedLanguages: Set<string>,
-): Record<string, string> {
-  const betterjsonOutput = JSON.parse(
-    execFileSync(
-      codeqlPath,
-      [
-        "resolve",
-        "languages",
-        "--format=betterjson",
-        "--extractor-include-aliases",
-      ],
-      { encoding: "utf8" },
-    ),
-  );
-
-  return Object.fromEntries(
-    Object.entries((betterjsonOutput.aliases ?? {}) as Record<string, string>)
-      .filter(([, target]) => includedLanguages.has(target))
-      .sort(([a], [b]) => a.localeCompare(b)),
-  );
-}
-
-/** Write the built-in languages data to disk. */
-function writeBuiltinLanguages(
-  languages: string[],
-  aliases: Record<string, string>,
-): void {
-  const content = `${JSON.stringify({ languages, aliases }, null, 2)}\n`;
-  fs.mkdirSync(path.dirname(BUILTIN_LANGUAGES_FILE), { recursive: true });
-  fs.writeFileSync(BUILTIN_LANGUAGES_FILE, content);
-
-  console.log(`\nWrote ${BUILTIN_LANGUAGES_FILE}`);
-  console.log(`  Languages: ${languages.join(", ")}`);
-  console.log(`  Aliases: ${Object.keys(aliases).join(", ")}`);
-}
-
-function main(): void {
-  const codeqlPath = process.argv[2] || "codeql";
-
-  const extractorDirs = resolveLanguages(codeqlPath);
-  const languages = findLanguagesWithDefaultQueries(extractorDirs);
-  const aliases = resolveAliases(codeqlPath, new Set(languages));
-  writeBuiltinLanguages(languages, aliases);
-}
-
-main();
@@ -43,7 +43,6 @@ predicate envVarRead(DataFlow::Node node, string envVar) {
 from DataFlow::Node read, string envVar
 where
  envVarRead(read, envVar) and
-  read.getFile().getRelativePath().matches("src/%") and
  not read.getFile().getBaseName().matches("%.test.ts") and
  not isSafeForDefaultSetup(envVar)
 select read,
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node24
-  main: '../lib/resolve-environment-entry.js'
+  using: node20
+  main: '../lib/resolve-environment-action.js'
@@ -19,25 +19,6 @@ inputs:
      If not specified, the Action will check in several places until it finds
      the CodeQL tools.
    required: false
-  languages:
-    description: >-
-      A comma-separated list of CodeQL languages that will be analyzed in subsequent
-      `github/codeql-action/init` and `github/codeql-action/analyze` invocations. If specified, the
-      Action may use this list to select a CodeQL CLI version that is best suited to analyzing those
-      languages, for example by preferring a version that has a cached overlay-base database for the
-      specified languages. This input is not remembered and must also be passed to
-      `github/codeql-action/init`.
-    required: false
-  analysis-kinds:
-    description: >-
-      [Internal] A comma-separated list of analysis kinds that subsequent
-      `github/codeql-action/init` invocations will enable. If specified, the Action may use this
-      list to select a CodeQL CLI version that is best suited to those analysis kinds. This input is
-      not remembered and must also be passed to `github/codeql-action/init`.
-
-      Available options are the same as for the `analysis-kinds` input on the `init` Action.
-    default: 'code-scanning'
-    required: true
  token:
    description: GitHub token to use for authenticating with this instance of GitHub.
    default: ${{ github.token }}
@@ -54,5 +35,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node24
-  main: '../lib/setup-codeql-entry.js'
+  using: node20
+  main: '../lib/setup-codeql-action.js'
@@ -1,4 +0,0 @@
-"use strict";
-
-const import_entry_points = require("./entry-points");
-void (0, import_entry_points.run__ACTION__)();
@@ -16,12 +16,7 @@ import {
 } from "./analyses";
 import { EnvVar } from "./environment";
 import { getRunnerLogger } from "./logging";
-import {
-  createFeatures,
-  RecordingLogger,
-  setupBaseActionsVars,
-  setupTests,
-} from "./testing-utils";
+import { setupTests } from "./testing-utils";
 import { AssessmentPayload } from "./upload-lib/types";
 import { ConfigurationError } from "./util";

@@ -58,91 +53,24 @@ test("Parsing analysis kinds requires at least one analysis kind", async (t) =>
 test.serial(
  "getAnalysisKinds - returns expected analysis kinds for `analysis-kinds` input",
  async (t) => {
-    process.env[EnvVar.TEST_MODE] = "true";
-    const features = createFeatures([]);
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub
      .withArgs("analysis-kinds")
      .returns("code-scanning,code-quality");
-    const result = await getAnalysisKinds(
-      getRunnerLogger(true),
-      features,
-      true,
-    );
+    const result = await getAnalysisKinds(getRunnerLogger(true), true);
    t.assert(result.includes(AnalysisKind.CodeScanning));
    t.assert(result.includes(AnalysisKind.CodeQuality));
  },
 );

-test.serial(
-  "getAnalysisKinds - only use `code-scanning` for multiple analysis kinds outside of test mode",
-  async (t) => {
-    setupBaseActionsVars();
-    process.env[EnvVar.TEST_MODE] = "false";
-    const features = createFeatures([]);
-    const logger = new RecordingLogger();
-    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-    requiredInputStub
-      .withArgs("analysis-kinds")
-      .returns("code-scanning,code-quality");
-    const result = await getAnalysisKinds(logger, features, true);
-    t.deepEqual(result, [AnalysisKind.CodeScanning]);
-    t.assert(
-      logger.hasMessage(
-        "Continuing with only `analysis-kinds: code-scanning`.",
-      ),
-    );
-  },
-);
-
-test.serial(
-  "getAnalysisKinds - logs error for non-default `analysis-kinds` in custom workflow",
-  async (t) => {
-    setupBaseActionsVars({ GITHUB_EVENT_NAME: "push" });
-    process.env[EnvVar.TEST_MODE] = "false";
-    const features = createFeatures([]);
-    const logger = new RecordingLogger();
-    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-    requiredInputStub.withArgs("analysis-kinds").returns("code-quality");
-    const result = await getAnalysisKinds(logger, features, true);
-    t.deepEqual(result, [AnalysisKind.CodeQuality]);
-    t.assert(
-      logger.hasMessage(
-        "An analysis kind other than `code-scanning` was specified in a custom workflow.",
-      ),
-    );
-  },
-);
-
-test.serial(
-  "getAnalysisKinds - no error for non-default `analysis-kinds` in managed workflow",
-  async (t) => {
-    setupBaseActionsVars({ GITHUB_EVENT_NAME: "dynamic" });
-    process.env[EnvVar.TEST_MODE] = "false";
-    const features = createFeatures([]);
-    const logger = new RecordingLogger();
-    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-    requiredInputStub.withArgs("analysis-kinds").returns("code-quality");
-    const result = await getAnalysisKinds(logger, features, true);
-    t.deepEqual(result, [AnalysisKind.CodeQuality]);
-    t.deepEqual(logger.messages, []);
-  },
-);
-
 test.serial(
  "getAnalysisKinds - includes `code-quality` when deprecated `quality-queries` input is used",
  async (t) => {
-    process.env[EnvVar.TEST_MODE] = "true";
-    const features = createFeatures([]);
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub.withArgs("analysis-kinds").returns("code-scanning");
    const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
    optionalInputStub.withArgs("quality-queries").returns("code-quality");
-    const result = await getAnalysisKinds(
-      getRunnerLogger(true),
-      features,
-      true,
-    );
+    const result = await getAnalysisKinds(getRunnerLogger(true), true);
    t.assert(result.includes(AnalysisKind.CodeScanning));
    t.assert(result.includes(AnalysisKind.CodeQuality));
  },
@@ -151,12 +79,9 @@ test.serial(
 test.serial(
  "getAnalysisKinds - throws if `analysis-kinds` input is invalid",
  async (t) => {
-    const features = createFeatures([]);
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub.withArgs("analysis-kinds").returns("no-such-thing");
-    await t.throwsAsync(
-      getAnalysisKinds(getRunnerLogger(true), features, true),
-    );
+    await t.throwsAsync(getAnalysisKinds(getRunnerLogger(true), true));
  },
 );

@@ -173,18 +98,11 @@ for (let i = 0; i < analysisKinds.length; i++) {
      test.serial(
        `getAnalysisKinds - allows ${analysisKind} with ${otherAnalysis}`,
        async (t) => {
-          setupBaseActionsVars();
-          process.env[EnvVar.TEST_MODE] = "true";
-          const features = createFeatures([]);
          const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
          requiredInputStub
            .withArgs("analysis-kinds")
            .returns([analysisKind, otherAnalysis].join(","));
-          const result = await getAnalysisKinds(
-            getRunnerLogger(true),
-            features,
-            true,
-          );
+          const result = await getAnalysisKinds(getRunnerLogger(true), true);
          t.is(result.length, 2);
        },
      );
@@ -192,19 +110,14 @@ for (let i = 0; i < analysisKinds.length; i++) {
      test.serial(
        `getAnalysisKinds - throws if ${analysisKind} is enabled with ${otherAnalysis}`,
        async (t) => {
-          setupBaseActionsVars();
-          const features = createFeatures([]);
          const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
          requiredInputStub
            .withArgs("analysis-kinds")
            .returns([analysisKind, otherAnalysis].join(","));
-          await t.throwsAsync(
-            getAnalysisKinds(getRunnerLogger(true), features, true),
-            {
-              instanceOf: ConfigurationError,
-              message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,
-            },
-          );
+          await t.throwsAsync(getAnalysisKinds(getRunnerLogger(true), true), {
+            instanceOf: ConfigurationError,
+            message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,
+          });
        },
      );
    }
@@ -2,17 +2,15 @@ import {
  fixCodeQualityCategory,
  getOptionalInput,
  getRequiredInput,
-  isDynamicWorkflow,
 } from "./actions-util";
 import { EnvVar } from "./environment";
-import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
 import {
  AssessmentPayload,
  BasePayload,
  UploadPayload,
 } from "./upload-lib/types";
-import { ConfigurationError, getRequiredEnvParam, isInTestMode } from "./util";
+import { ConfigurationError, getRequiredEnvParam } from "./util";

 export enum AnalysisKind {
  CodeScanning = "code-scanning",
@@ -66,21 +64,6 @@ export async function parseAnalysisKinds(
 // Used to avoid re-parsing the input after we have done it once.
 let cachedAnalysisKinds: AnalysisKind[] | undefined;

-/** Determines whether `code-scanning` is the only enabled analysis kind in `analysisKinds`. */
-function isOnlyCodeScanningEnabled(analysisKinds: AnalysisKind[]) {
-  return (
-    analysisKinds.length === 1 && analysisKinds[0] === AnalysisKind.CodeScanning
-  );
-}
-
-/** Prepends a generic message about the intended usage for `analysis-kinds` to `message`. */
-function makeAnalysisKindUsageError(message: string) {
-  return (
-    "The `analysis-kinds` input is experimental and for GitHub-internal use only. " +
-    `Its behaviour may change at any time or be removed entirely. ${message}`
-  );
-}
-
 /**
 * Initialises the analysis kinds for the analysis based on the `analysis-kinds` input.
 * This function will also use the deprecated `quality-queries` input as an indicator to enable `code-quality`.
@@ -94,7 +77,6 @@ function makeAnalysisKindUsageError(message: string) {
 */
 export async function getAnalysisKinds(
  logger: Logger,
-  features: FeatureEnablement,
  skipCache: boolean = false,
 ): Promise<AnalysisKind[]> {
  if (!skipCache && cachedAnalysisKinds !== undefined) {
@@ -105,26 +87,6 @@ export async function getAnalysisKinds(
    getRequiredInput("analysis-kinds"),
  );

-  // Log an error if we are outside of a GitHub-managed workflow and an analysis kind
-  // other than `code-scanning` is enabled.
-  if (
-    !isInTestMode() &&
-    !isDynamicWorkflow() &&
-    !isOnlyCodeScanningEnabled(analysisKinds)
-  ) {
-    const codeQualityHint = analysisKinds.includes(AnalysisKind.CodeQuality)
-      ? " If your intention is to use quality queries outside of Code Quality, " +
-        "use the `queries` input with `code-quality` instead."
-      : "";
-
-    logger.error(
-      makeAnalysisKindUsageError(
-        "An analysis kind other than `code-scanning` was specified in a custom workflow. " +
-          `This is not supported and will become a fatal error in a future version of the CodeQL Action.${codeQualityHint}`,
-      ),
-    );
-  }
-
  // Warn that `quality-queries` is deprecated if there is an argument for it.
  const qualityQueriesInput = getOptionalInput("quality-queries");

@@ -158,25 +120,6 @@ export async function getAnalysisKinds(
    }
  }

-  // Log an error if we have multiple inputs for `analysis-kinds` outside of test mode,
-  // and enable only `code-scanning`.
-  if (
-    !isInTestMode() &&
-    analysisKinds.length > 1 &&
-    !(await features.getValue(Feature.AllowMultipleAnalysisKinds))
-  ) {
-    logger.error(
-      makeAnalysisKindUsageError(
-        "Specifying multiple values as input is no longer supported. " +
-          "Continuing with only `analysis-kinds: code-scanning`.",
-      ),
-    );
-
-    // Only enable Code Scanning.
-    cachedAnalysisKinds = [AnalysisKind.CodeScanning];
-    return cachedAnalysisKinds;
-  }
-
  // Cache the analysis kinds and return them.
  cachedAnalysisKinds = analysisKinds;
  return cachedAnalysisKinds;
@@ -0,0 +1,90 @@
+import test from "ava";
+import * as sinon from "sinon";
+
+import * as actionsUtil from "./actions-util";
+import * as analyze from "./analyze";
+import * as api from "./api-client";
+import * as configUtils from "./config-utils";
+import * as gitUtils from "./git-utils";
+import * as statusReport from "./status-report";
+import {
+  setupTests,
+  setupActionsVars,
+  mockFeatureFlagApiEndpoint,
+} from "./testing-utils";
+import * as util from "./util";
+
+setupTests(test);
+
+// This test needs to be in its own file so that ava would run it in its own
+// nodejs process. The code being tested is in analyze-action.ts, which runs
+// immediately on load. So the file needs to be loaded during part of the test,
+// and that can happen only once per nodejs process. If multiple such tests are
+// in the same test file, ava would run them in the same nodejs process, and all
+// but the first test would fail.
+
+test("analyze action with RAM & threads from environment variables", async (t) => {
+  // This test frequently times out on Windows with the default timeout, so we bump
+  // it a bit to 20s.
+  t.timeout(1000 * 20);
+  await util.withTmpDir(async (tmpDir) => {
+    setupActionsVars(tmpDir, tmpDir);
+    sinon
+      .stub(statusReport, "createStatusReportBase")
+      .resolves({} as statusReport.StatusReportBase);
+    sinon.stub(statusReport, "sendStatusReport").resolves();
+    sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
+
+    const gitHubVersion: util.GitHubVersion = {
+      type: util.GitHubVariant.DOTCOM,
+    };
+    sinon.stub(configUtils, "getConfig").resolves({
+      gitHubVersion,
+      augmentationProperties: {},
+      languages: [],
+      packs: [],
+      trapCaches: {},
+    } as unknown as configUtils.Config);
+    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
+    requiredInputStub.withArgs("token").returns("fake-token");
+    requiredInputStub.withArgs("upload-database").returns("false");
+    requiredInputStub.withArgs("output").returns("out");
+    const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
+    optionalInputStub.withArgs("expect-error").returns("false");
+    sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
+    mockFeatureFlagApiEndpoint(200, {});
+
+    // When there are no action inputs for RAM and threads, the action uses
+    // environment variables (passed down from the init action) to set RAM and
+    // threads usage.
+    process.env["CODEQL_THREADS"] = "-1";
+    process.env["CODEQL_RAM"] = "4992";
+
+    const runFinalizeStub = sinon.stub(analyze, "runFinalize");
+    const runQueriesStub = sinon.stub(analyze, "runQueries");
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const analyzeAction = require("./analyze-action");
+
+    // When analyze-action.ts loads, it runs an async function from the top
+    // level but does not wait for it to finish. To ensure that calls to
+    // runFinalize and runQueries are correctly captured by spies, we explicitly
+    // wait for the action promise to complete before starting verification.
+    await analyzeAction.runPromise;
+
+    t.assert(
+      runFinalizeStub.calledOnceWith(
+        sinon.match.any,
+        sinon.match.any,
+        "--threads=-1",
+        "--ram=4992",
+      ),
+    );
+    t.assert(
+      runQueriesStub.calledOnceWith(
+        sinon.match.any,
+        "--ram=4992",
+        "--threads=-1",
+      ),
+    );
+  });
+});
@@ -0,0 +1,88 @@
+import test from "ava";
+import * as sinon from "sinon";
+
+import * as actionsUtil from "./actions-util";
+import * as analyze from "./analyze";
+import * as api from "./api-client";
+import * as configUtils from "./config-utils";
+import * as gitUtils from "./git-utils";
+import * as statusReport from "./status-report";
+import {
+  setupTests,
+  setupActionsVars,
+  mockFeatureFlagApiEndpoint,
+} from "./testing-utils";
+import * as util from "./util";
+
+setupTests(test);
+
+// This test needs to be in its own file so that ava would run it in its own
+// nodejs process. The code being tested is in analyze-action.ts, which runs
+// immediately on load. So the file needs to be loaded during part of the test,
+// and that can happen only once per nodejs process. If multiple such tests are
+// in the same test file, ava would run them in the same nodejs process, and all
+// but the first test would fail.
+
+test("analyze action with RAM & threads from action inputs", async (t) => {
+  t.timeout(1000 * 20);
+  await util.withTmpDir(async (tmpDir) => {
+    setupActionsVars(tmpDir, tmpDir);
+    sinon
+      .stub(statusReport, "createStatusReportBase")
+      .resolves({} as statusReport.StatusReportBase);
+    sinon.stub(statusReport, "sendStatusReport").resolves();
+    const gitHubVersion: util.GitHubVersion = {
+      type: util.GitHubVariant.DOTCOM,
+    };
+    sinon.stub(configUtils, "getConfig").resolves({
+      gitHubVersion,
+      augmentationProperties: {},
+      languages: [],
+      packs: [],
+      trapCaches: {},
+    } as unknown as configUtils.Config);
+    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
+    requiredInputStub.withArgs("token").returns("fake-token");
+    requiredInputStub.withArgs("upload-database").returns("false");
+    requiredInputStub.withArgs("output").returns("out");
+    const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
+    optionalInputStub.withArgs("expect-error").returns("false");
+    sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
+    sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
+    mockFeatureFlagApiEndpoint(200, {});
+
+    process.env["CODEQL_THREADS"] = "1";
+    process.env["CODEQL_RAM"] = "4992";
+
+    // Action inputs have precedence over environment variables.
+    optionalInputStub.withArgs("threads").returns("-1");
+    optionalInputStub.withArgs("ram").returns("3012");
+
+    const runFinalizeStub = sinon.stub(analyze, "runFinalize");
+    const runQueriesStub = sinon.stub(analyze, "runQueries");
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const analyzeAction = require("./analyze-action");
+
+    // When analyze-action.ts loads, it runs an async function from the top
+    // level but does not wait for it to finish. To ensure that calls to
+    // runFinalize and runQueries are correctly captured by spies, we explicitly
+    // wait for the action promise to complete before starting verification.
+    await analyzeAction.runPromise;
+
+    t.assert(
+      runFinalizeStub.calledOnceWith(
+        sinon.match.any,
+        sinon.match.any,
+        "--threads=-1",
+        "--ram=3012",
+      ),
+    );
+    t.assert(
+      runQueriesStub.calledOnceWith(
+        sinon.match.any,
+        "--ram=3012",
+        "--threads=-1",
+      ),
+    );
+  });
+});
@@ -20,7 +20,7 @@ import { EnvVar } from "./environment";
 import { getActionsLogger } from "./logging";
 import { checkGitHubVersionInRange, getErrorMessage } from "./util";

-export async function runWrapper() {
+async function runWrapper() {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -72,3 +72,5 @@ export async function runWrapper() {
    );
  }
 }
+
+void runWrapper();
@@ -1,142 +0,0 @@
-import test from "ava";
-import * as sinon from "sinon";
-
-import * as actionsUtil from "./actions-util";
-import * as analyze from "./analyze";
-import { runWrapper } from "./analyze-action";
-import * as api from "./api-client";
-import * as configUtils from "./config-utils";
-import * as gitUtils from "./git-utils";
-import * as statusReport from "./status-report";
-import {
-  setupTests,
-  setupActionsVars,
-  mockFeatureFlagApiEndpoint,
-} from "./testing-utils";
-import * as util from "./util";
-
-setupTests(test);
-
-test.serial(
-  "analyze action with RAM & threads from environment variables",
-  async (t) => {
-    // This test frequently times out on Windows with the default timeout, so we bump
-    // it a bit to 20s.
-    t.timeout(1000 * 20);
-    await util.withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      sinon
-        .stub(statusReport, "createStatusReportBase")
-        .resolves({} as statusReport.StatusReportBase);
-      sinon.stub(statusReport, "sendStatusReport").resolves();
-      sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-
-      const gitHubVersion: util.GitHubVersion = {
-        type: util.GitHubVariant.DOTCOM,
-      };
-      sinon.stub(configUtils, "getConfig").resolves({
-        gitHubVersion,
-        augmentationProperties: {},
-        languages: [],
-        packs: [],
-        trapCaches: {},
-      } as unknown as configUtils.Config);
-      const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-      requiredInputStub.withArgs("token").returns("fake-token");
-      requiredInputStub.withArgs("upload-database").returns("false");
-      requiredInputStub.withArgs("output").returns("out");
-      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
-      optionalInputStub.withArgs("expect-error").returns("false");
-      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
-      mockFeatureFlagApiEndpoint(200, {});
-
-      // When there are no action inputs for RAM and threads, the action uses
-      // environment variables (passed down from the init action) to set RAM and
-      // threads usage.
-      process.env["CODEQL_THREADS"] = "-1";
-      process.env["CODEQL_RAM"] = "4992";
-
-      const runFinalizeStub = sinon.stub(analyze, "runFinalize");
-      const runQueriesStub = sinon.stub(analyze, "runQueries");
-
-      await runWrapper();
-
-      t.assert(
-        runFinalizeStub.calledOnceWith(
-          sinon.match.any,
-          sinon.match.any,
-          "--threads=-1",
-          "--ram=4992",
-        ),
-      );
-      t.assert(
-        runQueriesStub.calledOnceWith(
-          sinon.match.any,
-          "--ram=4992",
-          "--threads=-1",
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "analyze action with RAM & threads from action inputs",
-  async (t) => {
-    t.timeout(1000 * 20);
-    await util.withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      sinon
-        .stub(statusReport, "createStatusReportBase")
-        .resolves({} as statusReport.StatusReportBase);
-      sinon.stub(statusReport, "sendStatusReport").resolves();
-      const gitHubVersion: util.GitHubVersion = {
-        type: util.GitHubVariant.DOTCOM,
-      };
-      sinon.stub(configUtils, "getConfig").resolves({
-        gitHubVersion,
-        augmentationProperties: {},
-        languages: [],
-        packs: [],
-        trapCaches: {},
-      } as unknown as configUtils.Config);
-      const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
-      requiredInputStub.withArgs("token").returns("fake-token");
-      requiredInputStub.withArgs("upload-database").returns("false");
-      requiredInputStub.withArgs("output").returns("out");
-      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
-      optionalInputStub.withArgs("expect-error").returns("false");
-      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
-      sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
-      mockFeatureFlagApiEndpoint(200, {});
-
-      process.env["CODEQL_THREADS"] = "1";
-      process.env["CODEQL_RAM"] = "4992";
-
-      // Action inputs have precedence over environment variables.
-      optionalInputStub.withArgs("threads").returns("-1");
-      optionalInputStub.withArgs("ram").returns("3012");
-
-      const runFinalizeStub = sinon.stub(analyze, "runFinalize");
-      const runQueriesStub = sinon.stub(analyze, "runQueries");
-
-      await runWrapper();
-
-      t.assert(
-        runFinalizeStub.calledOnceWith(
-          sinon.match.any,
-          sinon.match.any,
-          "--threads=-1",
-          "--ram=3012",
-        ),
-      );
-      t.assert(
-        runQueriesStub.calledOnceWith(
-          sinon.match.any,
-          "--ram=3012",
-          "--threads=-1",
-        ),
-      );
-    });
-  },
-);
@@ -30,9 +30,9 @@ import {
 } from "./dependency-caching";
 import { EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
-import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay/caching";
+import { cleanupAndUploadOverlayBaseDatabaseToCache } from "./overlay";
 import { getRepositoryNwo } from "./repository";
 import * as statusReport from "./status-report";
 import {
@@ -135,13 +135,9 @@ function hasBadExpectErrorInput(): boolean {
 function doesGoExtractionOutputExist(config: Config): boolean {
  const golangDbDirectory = util.getCodeQLDatabasePath(
    config,
-    BuiltInLanguage.go,
-  );
-  const trapDirectory = path.join(
-    golangDbDirectory,
-    "trap",
-    BuiltInLanguage.go,
+    KnownLanguage.go,
  );
+  const trapDirectory = path.join(golangDbDirectory, "trap", KnownLanguage.go);
  return (
    fs.existsSync(trapDirectory) &&
    fs
@@ -173,7 +169,7 @@ function doesGoExtractionOutputExist(config: Config): boolean {
 * whether any extraction output already exists for Go.
 */
 async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
-  if (!config.languages.includes(BuiltInLanguage.go)) {
+  if (!config.languages.includes(KnownLanguage.go)) {
    return;
  }
  if (config.buildMode) {
@@ -186,7 +182,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
    logger.debug("Won't run Go autobuild since it has already been run.");
    return;
  }
-  if (dbIsFinalized(config, BuiltInLanguage.go, logger)) {
+  if (dbIsFinalized(config, KnownLanguage.go, logger)) {
    logger.debug(
      "Won't run Go autobuild since there is already a finalized database for Go.",
    );
@@ -209,7 +205,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  logger.debug(
    "Running Go autobuild because extraction output (TRAP files) for Go code has not been found.",
  );
-  await runAutobuild(config, BuiltInLanguage.go, logger);
+  await runAutobuild(config, KnownLanguage.go, logger);
 }

 async function run(startedAt: Date) {
@@ -523,11 +519,14 @@ async function run(startedAt: Date) {
  }
 }

-export async function runWrapper() {
-  const startedAt = new Date();
+// Module-level startedAt so it can be accessed by runWrapper for error reporting
+const startedAt = new Date();
+export const runPromise = run(startedAt);
+
+async function runWrapper() {
  const logger = getActionsLogger();
  try {
-    await run(startedAt);
+    await runPromise;
  } catch (error) {
    core.setFailed(`analyze action failed: ${util.getErrorMessage(error)}`);
    await sendUnhandledErrorStatusReport(
@@ -539,3 +538,5 @@ export async function runWrapper() {
  }
  await util.checkForTimeout();
 }
+
+void runWrapper();
@@ -14,7 +14,7 @@ import {
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
 import { Feature } from "./feature-flags";
-import { BuiltInLanguage } from "./languages";
+import { KnownLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
  setupTests,
@@ -41,7 +41,7 @@ test.serial("status report fields", async (t) => {
    const threadsFlag = "";
    sinon.stub(uploadLib, "validateSarifFileSchema");

-    for (const language of Object.values(BuiltInLanguage)) {
+    for (const language of Object.values(KnownLanguage)) {
      const codeql = createStubCodeQL({
        databaseRunQueries: async () => {},
        databaseInterpretResults: async (
@@ -130,13 +130,13 @@ test.serial("status report fields", async (t) => {
 test("resolveQuerySuiteAlias", (t) => {
  // default query suite names should resolve to something language-specific ending in `.qls`.
  for (const suite of defaultSuites) {
-    const resolved = resolveQuerySuiteAlias(BuiltInLanguage.go, suite);
+    const resolved = resolveQuerySuiteAlias(KnownLanguage.go, suite);
    t.assert(
      path.extname(resolved) === ".qls",
      "Resolved default suite doesn't end in .qls",
    );
    t.assert(
-      resolved.indexOf(BuiltInLanguage.go) >= 0,
+      resolved.indexOf(KnownLanguage.go) >= 0,
      "Resolved default suite doesn't contain language name",
    );
  }
@@ -145,12 +145,12 @@ test("resolveQuerySuiteAlias", (t) => {
  const names = ["foo", "bar", "codeql/go-queries@1.0"];

  for (const name of names) {
-    t.deepEqual(resolveQuerySuiteAlias(BuiltInLanguage.go, name), name);
+    t.deepEqual(resolveQuerySuiteAlias(KnownLanguage.go, name), name);
  }
 });

 test("addSarifExtension", (t) => {
-  for (const language of Object.values(BuiltInLanguage)) {
+  for (const language of Object.values(KnownLanguage)) {
    t.deepEqual(addSarifExtension(CodeScanning, language), `${language}.sarif`);
    t.deepEqual(
      addSarifExtension(CodeQuality, language),
@@ -21,9 +21,9 @@ import {
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { BuiltInLanguage, Language } from "./languages";
+import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
-import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
+import { OverlayDatabaseMode } from "./overlay";
 import type * as sarif from "./sarif";
 import { DatabaseCreationTimings, EventReport } from "./status-report";
 import { endTracingForCluster } from "./tracer-config";
@@ -41,7 +41,7 @@ export class CodeQLAnalysisError extends Error {
  }
 }

-type BuiltInLanguageKey = keyof typeof BuiltInLanguage;
+type KnownLanguageKey = keyof typeof KnownLanguage;

 type RunQueriesDurationStatusReport = {
  /**
@@ -50,12 +50,12 @@ type RunQueriesDurationStatusReport = {
   * The "builtin" designation is now outdated with the move to CLI config parsing: this is the time
   * taken to run _all_ the queries.
   */
-  [L in BuiltInLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
 };

 type InterpretResultsDurationStatusReport = {
  /** Time taken in ms to interpret results for the language (or undefined if this language was not analyzed). */
-  [L in BuiltInLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
+  [L in KnownLanguageKey as `interpret_results_${L}_duration_ms`]?: number;
 };

 export interface QueriesStatusReport
@@ -115,12 +115,12 @@ export async function runExtraction(

    if (await shouldExtractLanguage(codeql, config, language)) {
      logger.startGroup(`Extracting ${language}`);
-      if (language === BuiltInLanguage.python) {
+      if (language === KnownLanguage.python) {
        await setupPythonExtractor(logger);
      }
      if (config.buildMode) {
        if (
-          language === BuiltInLanguage.cpp &&
+          language === KnownLanguage.cpp &&
          config.buildMode === BuildMode.Autobuild
        ) {
          await setupCppAutobuild(codeql, logger);
@@ -131,14 +131,14 @@ export async function runExtraction(
        // a stable path that caches can be restored into and that we can cache at the
        // end of the workflow (i.e. that does not get removed when the scratch directory is).
        if (
-          language === BuiltInLanguage.java &&
+          language === KnownLanguage.java &&
          config.buildMode === BuildMode.None
        ) {
          process.env["CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_DEPENDENCY_DIR"] =
            getJavaTempDependencyDir();
        }
        if (
-          language === BuiltInLanguage.csharp &&
+          language === KnownLanguage.csharp &&
          config.buildMode === BuildMode.None &&
          (await features.getValue(Feature.CsharpCacheBuildModeNone))
        ) {
@@ -251,9 +251,16 @@ export async function setupDiffInformedQueryRun(
        diffRanges,
        checkoutPath,
      );
-      logger.info(
-        `Successfully created diff range extension pack at ${packDir}.`,
-      );
+      if (packDir === undefined) {
+        logger.warning(
+          "Cannot create diff range extension pack for diff-informed queries; " +
+            "reverting to performing full analysis.",
+        );
+      } else {
+        logger.info(
+          `Successfully created diff range extension pack at ${packDir}.`,
+        );
+      }
      return packDir;
    },
  );
@@ -307,13 +314,18 @@ extensions:
 * @param ranges The file line ranges, as returned by
 * `getPullRequestEditedDiffRanges`.
 * @param checkoutPath The path at which the repository was checked out.
- * @returns The absolute path of the directory containing the extension pack.
+ * @returns The absolute path of the directory containing the extension pack, or
+ * `undefined` if no extension pack was created.
 */
 function writeDiffRangeDataExtensionPack(
  logger: Logger,
-  ranges: DiffThunkRange[],
+  ranges: DiffThunkRange[] | undefined,
  checkoutPath: string,
-): string {
+): string | undefined {
+  if (ranges === undefined) {
+    return undefined;
+  }
+
  if (ranges.length === 0) {
    // An empty diff range means that there are no added or modified lines in
    // the pull request. But the `restrictAlertsTo` extensible predicate
@@ -686,7 +698,7 @@ export async function warnIfGoInstalledAfterInit(

      addDiagnostic(
        config,
-        BuiltInLanguage.go,
+        KnownLanguage.go,
        makeDiagnostic(
          "go/workflow/go-installed-after-codeql-init",
          "Go was installed after the `codeql-action/init` Action was run",
@@ -128,8 +128,6 @@ export async function getGitHubVersionFromApi(

  // Doesn't strictly have to be the meta endpoint as we're only
  // using the response headers which are available on every request.
-  //
-  // See https://docs.github.com/en/rest/meta/meta#get-github-meta-information.
  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
  const response = await apiClient.rest.meta.get();

@@ -166,9 +164,6 @@ export async function getGitHubVersion(): Promise<GitHubVersion> {

 /**
 * Get the path of the currently executing workflow relative to the repository root.
- *
- * See https://docs.github.com/en/rest/actions/workflow-runs#get-a-workflow-run
- * and https://docs.github.com/en/rest/actions/workflows#get-a-workflow.
 */
 export async function getWorkflowRelativePath(): Promise<string> {
  const repo_nwo = getRepositoryNwo();
@@ -257,13 +252,9 @@ export interface ActionsCacheItem {
  size_in_bytes?: number;
 }

-/**
- * List all Actions cache entries starting with the provided key prefix and matching the provided ref.
- *
- * See https://docs.github.com/en/rest/actions/cache#list-github-actions-caches-for-a-repository.
- */
+/** List all Actions cache entries matching the provided key and ref. */
 export async function listActionsCaches(
-  keyPrefix: string,
+  key: string,
  ref?: string,
 ): Promise<ActionsCacheItem[]> {
  const repositoryNwo = getRepositoryNwo();
@@ -273,17 +264,13 @@ export async function listActionsCaches(
    {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
-      key: keyPrefix,
+      key,
      ref,
    },
  );
 }

-/**
- * Delete an Actions cache item by its ID.
- *
- * See https://docs.github.com/en/rest/actions/cache#delete-a-github-actions-cache-for-a-repository-using-a-cache-id.
- */
+/** Delete an Actions cache item by its ID. */
 export async function deleteActionsCache(id: number) {
  const repositoryNwo = getRepositoryNwo();

@@ -294,11 +281,7 @@ export async function deleteActionsCache(id: number) {
  });
 }

-/**
- * Retrieve all custom repository properties.
- *
- * See https://docs.github.com/en/rest/repos/custom-properties#get-all-custom-property-values-for-a-repository.
- */
+/** Retrieve all custom repository properties. */
 export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
  return getApiClient().request("GET /repos/:owner/:repo/properties/values", {
    owner: repositoryNwo.owner,
@@ -1 +1 @@
-{"maximumVersion": "3.21", "minimumVersion": "3.16"}
+{"maximumVersion": "3.21", "minimumVersion": "3.14"}
@@ -141,9 +141,9 @@ test("scanArtifactsForTokens handles files without tokens", async (t) => {
  }
 });

-// `scanArchiveFile` does not support Windows, so we skip this test there.
 if (os.platform() !== "win32") {
  test("scanArtifactsForTokens finds token in debug artifacts", async (t) => {
+    t.timeout(15000); // 15 seconds
    const messages: LoggedMessage[] = [];
    const logger = getRecordingLogger(messages, { logToConsole: false });
    // The zip here is a regression test based on
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Óscar San José	13efb23391	Merge pull request #3778 from github/backport-v3.35.0-b8bb9f28b Merge releases/v4 into releases/v3	2026-03-27 17:00:05 +01:00
github-actions[bot]	b1a5f00cf1	Rebuild	2026-03-27 12:23:35 +00:00
github-actions[bot]	124f6eec3b	Update version and changelog for v3.35.0	2026-03-27 12:18:22 +00:00
github-actions[bot]	a88fb3cde0	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.35.0-b8bb9f28b	2026-03-27 12:18:20 +00:00
github-actions[bot]	57d591c67c	Revert "Rebuild" This reverts commit `97fd992228`.	2026-03-27 12:18:20 +00:00
github-actions[bot]	dba1849cf2	Revert "Update version and changelog for v3.34.1" This reverts commit `95a562052b`.	2026-03-27 12:18:20 +00:00
Henry Mercer	ebcb5b36de	Merge pull request #3765 from github/backport-v3.34.1-386975555 Merge releases/v4 into releases/v3	2026-03-20 18:37:00 +00:00
github-actions[bot]	97fd992228	Rebuild	2026-03-20 18:19:37 +00:00
github-actions[bot]	95a562052b	Update version and changelog for v3.34.1	2026-03-20 18:16:44 +00:00
github-actions[bot]	ae8b37eb31	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.34.1-386975555	2026-03-20 18:16:42 +00:00
github-actions[bot]	d75030c604	Revert "Rebuild" This reverts commit `c146cd2193`.	2026-03-20 18:16:42 +00:00
github-actions[bot]	a777590c0f	Revert "Update version and changelog for v3.34.0" This reverts commit `3fef31e9b5`.	2026-03-20 18:16:41 +00:00
Óscar San José	dfad8f8ebc	Merge pull request #3590 from github/backport-v3.34.0-c6f931105 Merge releases/v4 into releases/v3	2026-03-20 16:15:08 +01:00
github-actions[bot]	c146cd2193	Rebuild	2026-03-20 12:03:47 +00:00
github-actions[bot]	3fef31e9b5	Update version and changelog for v3.34.0	2026-03-20 11:59:46 +00:00
github-actions[bot]	3d7478b23a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.34.0-c6f931105	2026-03-20 11:59:44 +00:00
github-actions[bot]	f874badee7	Revert "Rebuild" This reverts commit `9ed0d758ce`.	2026-03-20 11:59:44 +00:00
github-actions[bot]	1c3843e226	Revert "Update version and changelog for v3.33.0" This reverts commit `2da877a512`.	2026-03-20 11:59:44 +00:00
Michael B. Gale	603b797f8b	Merge pull request #3577 from github/backport-v3.33.0-b1bff8193 Merge releases/v4 into releases/v3	2026-03-16 12:23:22 +00:00
github-actions[bot]	9ed0d758ce	Rebuild	2026-03-16 11:10:08 +00:00
github-actions[bot]	2da877a512	Update version and changelog for v3.33.0	2026-03-16 09:08:36 +00:00
github-actions[bot]	4ccf9a5deb	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.33.0-b1bff8193	2026-03-16 09:08:34 +00:00
github-actions[bot]	e50ab6dc1d	Revert "Rebuild" This reverts commit `dabb34c95a`.	2026-03-16 09:08:33 +00:00
github-actions[bot]	ee6db5e4f5	Revert "Update version and changelog for v3.32.6" This reverts commit `c0e7770e36`.	2026-03-16 09:08:33 +00:00
Óscar San José	820e3160e2	Merge pull request #3553 from github/backport-v3.32.6-0d579ffd0 Merge releases/v4 into releases/v3	2026-03-06 10:44:37 +01:00
github-actions[bot]	dabb34c95a	Rebuild	2026-03-05 19:44:24 +00:00
github-actions[bot]	c0e7770e36	Update version and changelog for v3.32.6	2026-03-05 19:35:55 +00:00
github-actions[bot]	dbc2ac9b7a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.6-0d579ffd0	2026-03-05 19:35:54 +00:00
github-actions[bot]	e61b8b4cf5	Revert "Rebuild" This reverts commit `b58ecf644d`.	2026-03-05 19:35:53 +00:00
github-actions[bot]	b7ebceaf1a	Revert "Update version and changelog for v3.32.5" This reverts commit `e3632d0ee3`.	2026-03-05 19:35:53 +00:00
Henry Mercer	ae9ef3a1d2	Merge pull request #3533 from github/backport-v3.32.5-c793b717b Merge releases/v4 into releases/v3	2026-03-02 12:01:34 +00:00
github-actions[bot]	b58ecf644d	Rebuild	2026-03-02 11:34:55 +00:00
github-actions[bot]	e3632d0ee3	Update version and changelog for v3.32.5	2026-03-02 11:17:26 +00:00
github-actions[bot]	cdcb071e67	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.5-c793b717b	2026-03-02 11:17:25 +00:00
github-actions[bot]	177cb24be1	Revert "Rebuild" This reverts commit `a3696cdbdf`.	2026-03-02 11:17:24 +00:00
github-actions[bot]	2427cfc4a9	Revert "Update version and changelog for v3.32.4" This reverts commit `147ec67ee5`.	2026-03-02 11:17:23 +00:00
Michael B. Gale	45580472a5	Merge pull request #3496 from github/backport-v3.32.4-89a39a4e5	2026-02-20 15:34:23 +00:00
github-actions[bot]	a3696cdbdf	Rebuild	2026-02-20 14:52:56 +00:00
github-actions[bot]	147ec67ee5	Update version and changelog for v3.32.4	2026-02-20 14:21:14 +00:00
github-actions[bot]	acb91bd91f	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.4-89a39a4e5	2026-02-20 14:21:13 +00:00
github-actions[bot]	88d9aba91d	Revert "Rebuild" This reverts commit `70a71a57dd`.	2026-02-20 14:21:12 +00:00
github-actions[bot]	72edeaa05b	Revert "Update version and changelog for v3.32.3" This reverts commit `676a1ceb5c`.	2026-02-20 14:21:12 +00:00
Henry Mercer	f5c2471be7	Merge pull request #3481 from github/backport-v3.32.3-9e907b5e6 Merge releases/v4 into releases/v3	2026-02-13 12:21:24 +00:00
github-actions[bot]	70a71a57dd	Rebuild	2026-02-13 12:01:04 +00:00
github-actions[bot]	676a1ceb5c	Update version and changelog for v3.32.3	2026-02-13 11:55:54 +00:00
github-actions[bot]	e127ec2647	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.3-9e907b5e6	2026-02-13 11:55:52 +00:00
github-actions[bot]	f5e6f52190	Revert "Rebuild" This reverts commit `bb159524f9`.	2026-02-13 11:55:52 +00:00
github-actions[bot]	e2a90d3e23	Revert "Update version and changelog for v3.32.2" This reverts commit `6b68dd5d27`.	2026-02-13 11:55:52 +00:00
Henry Mercer	b5ebac6f4c	Merge pull request #3463 from github/backport-v3.32.2-45cbd0c69 Merge releases/v4 into releases/v3	2026-02-06 11:22:57 +00:00
github-actions[bot]	bb159524f9	Rebuild	2026-02-06 11:00:51 +00:00
github-actions[bot]	6b68dd5d27	Update version and changelog for v3.32.2	2026-02-05 17:12:29 +00:00
github-actions[bot]	24e739f51f	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.2-45cbd0c69	2026-02-05 17:12:25 +00:00
github-actions[bot]	e5a63de15c	Revert "Rebuild" This reverts commit `fd13ffa22c`.	2026-02-05 17:12:25 +00:00
github-actions[bot]	c2d57b0fc7	Revert "Update version and changelog for v3.32.1" This reverts commit `ce04bc5815`.	2026-02-05 17:12:24 +00:00
Henry Mercer	2588666de8	Merge pull request #3449 from github/backport-v3.32.1-6bc82e05f Merge releases/v4 into releases/v3	2026-02-02 07:47:27 -08:00
github-actions[bot]	fd13ffa22c	Rebuild	2026-02-02 15:21:36 +00:00
github-actions[bot]	ce04bc5815	Update version and changelog for v3.32.1	2026-02-02 15:14:15 +00:00
github-actions[bot]	27eb5f56eb	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.1-6bc82e05f	2026-02-02 15:14:12 +00:00
github-actions[bot]	44f67f0887	Revert "Rebuild" This reverts commit `f5ab452606`.	2026-02-02 15:14:12 +00:00
github-actions[bot]	5d24c86a89	Revert "Update version and changelog for v3.32.0" This reverts commit `56c8e1c8a8`.	2026-02-02 15:14:12 +00:00
Henry Mercer	439137e1b5	Merge pull request #3430 from github/backport-v3.32.0-b20883b0c Merge releases/v4 into releases/v3	2026-01-26 11:23:41 -08:00
github-actions[bot]	f5ab452606	Rebuild	2026-01-26 18:54:38 +00:00
github-actions[bot]	56c8e1c8a8	Update version and changelog for v3.32.0	2026-01-26 18:41:33 +00:00
github-actions[bot]	4f5ca6f9a5	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.32.0-b20883b0c	2026-01-26 18:41:32 +00:00
github-actions[bot]	92f3a2822b	Revert "Rebuild" This reverts commit `c9e0329cc4`.	2026-01-26 18:41:32 +00:00
github-actions[bot]	e9bf22fb0e	Revert "Update version and changelog for v3.31.11" This reverts commit `9ffacc75e8`.	2026-01-26 18:41:32 +00:00
Michael B. Gale	38e701f46e	Merge pull request #3419 from github/backport-v3.31.11-19b2f06db	2026-01-23 15:44:23 +00:00
github-actions[bot]	c9e0329cc4	Rebuild	2026-01-23 15:14:24 +00:00
github-actions[bot]	9ffacc75e8	Update version and changelog for v3.31.11	2026-01-23 13:56:12 +00:00
github-actions[bot]	21961f3b6f	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.11-19b2f06db	2026-01-23 13:56:10 +00:00
github-actions[bot]	8233700206	Revert "Rebuild" This reverts commit `6252d140cd`.	2026-01-23 13:56:10 +00:00
github-actions[bot]	23e84a39f0	Revert "Update version and changelog for v3.31.10" This reverts commit `84cf4b44bb`.	2026-01-23 13:56:09 +00:00
Ian Lynagh	4bdb89f480	Merge pull request #3396 from github/backport-v3.31.10-cdefb33c0 Merge releases/v4 into releases/v3	2026-01-12 16:26:37 +00:00
Michael B. Gale	ed629463c0	Set `using: node20` for `verify-debug-artifact-scan-completed` on `releases/v3`	2026-01-12 15:44:23 +00:00
github-actions[bot]	6252d140cd	Rebuild	2026-01-12 15:28:18 +00:00
github-actions[bot]	84cf4b44bb	Update version and changelog for v3.31.10	2026-01-12 14:37:46 +00:00
github-actions[bot]	52cebb523a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.10-cdefb33c0	2026-01-12 14:37:43 +00:00
github-actions[bot]	fc6e643fe1	Revert "Rebuild" This reverts commit `311b632b9d`.	2026-01-12 14:37:43 +00:00
github-actions[bot]	f8ee3fcc9a	Revert "Update version and changelog for v3.31.9" This reverts commit `d300581d5e`.	2026-01-12 14:37:43 +00:00
Henry Mercer	45c373516f	Merge pull request #3373 from github/backport-v3.31.9-5d4e8d1ac Merge releases/v4 into releases/v3	2025-12-16 19:21:59 +00:00
github-actions[bot]	311b632b9d	Rebuild	2025-12-16 18:51:43 +00:00
github-actions[bot]	d300581d5e	Update version and changelog for v3.31.9	2025-12-16 18:34:57 +00:00
github-actions[bot]	7348876640	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.9-5d4e8d1ac	2025-12-16 18:34:56 +00:00
github-actions[bot]	4f34645a82	Revert "Rebuild" This reverts commit `74951318a2`.	2025-12-16 18:34:56 +00:00
github-actions[bot]	e7c7a2d323	Revert "Update version and changelog for v3.31.8" This reverts commit `5676d1f64a`.	2025-12-16 18:34:56 +00:00
Óscar San José	f47c8e6a9b	Merge pull request #3357 from github/backport-v3.31.8-1b168cd39 Merge releases/v4 into releases/v3	2025-12-12 10:43:49 +01:00
github-actions[bot]	74951318a2	Rebuild	2025-12-12 08:53:47 +00:00
github-actions[bot]	5676d1f64a	Update version and changelog for v3.31.8	2025-12-12 08:46:33 +00:00
github-actions[bot]	c1bea80e56	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.8-1b168cd39	2025-12-12 08:46:32 +00:00
github-actions[bot]	2d9c0b97af	Revert "Rebuild" This reverts commit `817dbfb39b`.	2025-12-12 08:46:32 +00:00
github-actions[bot]	827017f97b	Revert "Update version and changelog for v3.31.7" This reverts commit `793f7006bb`.	2025-12-12 08:46:31 +00:00
Henry Mercer	bffd034ab1	Merge pull request #3346 from github/backport-v3.31.7-cf1bb45a2 Merge releases/v4 into releases/v3	2025-12-09 13:26:37 +00:00
github-actions[bot]	817dbfb39b	Rebuild	2025-12-05 20:45:51 +00:00
github-actions[bot]	793f7006bb	Update version and changelog for v3.31.7	2025-12-05 17:21:20 +00:00
github-actions[bot]	d2e9832330	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.7-cf1bb45a2	2025-12-05 17:21:19 +00:00
github-actions[bot]	c2e4b7785f	Revert "Rebuild" This reverts commit `89cb79a131`.	2025-12-05 17:21:18 +00:00
github-actions[bot]	66d7f51a10	Revert "Update version and changelog for v3.31.6" This reverts commit `dbf6819ebd`.	2025-12-05 17:21:18 +00:00
Michael B. Gale	497990dfed	Merge pull request #3338 from github/backport-v3.31.6-fe4161a26 Merge releases/v4 into releases/v3	2025-12-01 10:24:24 +00:00
github-actions[bot]	89cb79a131	Rebuild	2025-12-01 09:59:32 +00:00
github-actions[bot]	dbf6819ebd	Update version and changelog for v3.31.6	2025-12-01 09:52:51 +00:00
github-actions[bot]	5af51f4048	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.6-fe4161a26	2025-12-01 09:52:49 +00:00
github-actions[bot]	e439418aab	Revert "Rebuild" This reverts commit `c12d7c1f2d`.	2025-12-01 09:52:49 +00:00
github-actions[bot]	249860e323	Revert "Update version and changelog for v3.31.5" This reverts commit `2e2a1cf1ef`.	2025-12-01 09:52:49 +00:00
Paolo Tranquilli	d3ced5c96c	Merge pull request #3324 from github/backport-v3.31.5-fdbfb4d27 Merge releases/v4 into releases/v3	2025-11-24 12:16:57 +01:00
github-actions[bot]	c12d7c1f2d	Rebuild	2025-11-24 10:56:57 +00:00
github-actions[bot]	2e2a1cf1ef	Update version and changelog for v3.31.5	2025-11-24 09:33:54 +00:00
github-actions[bot]	e2cca77d06	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.5-fdbfb4d27	2025-11-24 09:33:53 +00:00
github-actions[bot]	801a18bea6	Revert "Rebuild" This reverts commit `9031cd9330`.	2025-11-24 09:33:52 +00:00
github-actions[bot]	1c715a714c	Revert "Update version and changelog for v3.31.4" This reverts commit `f58938aee2`.	2025-11-24 09:33:52 +00:00
Henry Mercer	c3d42c5d08	Merge pull request #3314 from github/backport-v3.31.4-e12f01789 Merge releases/v4 into releases/v3	2025-11-19 10:02:25 +00:00
github-actions[bot]	9031cd9330	Rebuild	2025-11-18 17:06:56 +00:00
github-actions[bot]	f58938aee2	Update version and changelog for v3.31.4	2025-11-18 16:16:32 +00:00
github-actions[bot]	1f1c162805	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.4-e12f01789	2025-11-18 16:16:30 +00:00
github-actions[bot]	7ab96a0e6f	Revert "Rebuild" This reverts commit `e5971bdba6`.	2025-11-18 16:16:30 +00:00
github-actions[bot]	e3cb86275a	Revert "Update version and changelog for v3.31.3" This reverts commit `c5a9d29dc9`.	2025-11-18 16:16:29 +00:00
Michael B. Gale	f94c9befff	Merge pull request #3295 from github/backport-v3.31.3-014f16e7a Merge releases/v4 into releases/v3	2025-11-13 22:45:46 +00:00
github-actions[bot]	e5971bdba6	Rebuild	2025-11-13 22:03:22 +00:00
github-actions[bot]	c5a9d29dc9	Update version and changelog for v3.31.3	2025-11-13 21:57:42 +00:00
github-actions[bot]	9f1109665d	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.3-014f16e7a	2025-11-13 21:57:40 +00:00
github-actions[bot]	f8f60f3a2b	Revert "Rebuild" This reverts commit `c6eb09db21`.	2025-11-13 21:57:40 +00:00
github-actions[bot]	f4d10b9ef7	Revert "Update version and changelog for v3.31.2" This reverts commit `09db9044dc`.	2025-11-13 21:57:39 +00:00
Henry Mercer	5d5cd550d3	Merge pull request #3263 from github/backport-v3.31.2-0499de31b Merge releases/v4 into releases/v3	2025-10-30 15:01:09 +00:00
github-actions[bot]	c6eb09db21	Rebuild	2025-10-30 14:37:32 +00:00
github-actions[bot]	09db9044dc	Update version and changelog for v3.31.2	2025-10-30 14:34:26 +00:00
github-actions[bot]	d3cd47d8d6	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.2-0499de31b	2025-10-30 14:34:25 +00:00
github-actions[bot]	8e9caa5100	Revert "Rebuild" This reverts commit `c2805e0a04`.	2025-10-30 14:34:25 +00:00
github-actions[bot]	23a6333b88	Revert "Update version and changelog for v3.31.1" This reverts commit `c0d3370b54`.	2025-10-30 14:34:24 +00:00
Henry Mercer	c503cb4fbb	Merge pull request #3254 from github/backport-v3.31.1-5fe9434cd Merge releases/v4 into releases/v3	2025-10-30 11:00:54 +00:00
github-actions[bot]	c2805e0a04	Rebuild	2025-10-30 10:35:44 +00:00
github-actions[bot]	c0d3370b54	Update version and changelog for v3.31.1	2025-10-30 10:31:02 +00:00
github-actions[bot]	ddd0dc746a	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.1-5fe9434cd	2025-10-30 10:31:01 +00:00
github-actions[bot]	2f607936ce	Revert "Rebuild" This reverts commit `9e3918e481`.	2025-10-30 10:31:00 +00:00
github-actions[bot]	37e7dfbaa0	Revert "Update version and changelog for v3.31.0" This reverts commit `7dd1575dac`.	2025-10-30 10:31:00 +00:00
Michael B. Gale	d198d2fabf	Merge pull request #3237 from github/backport-v3.31.0-4e94bd11f Merge releases/v4 into releases/v3	2025-10-24 19:30:34 +01:00
github-actions[bot]	9e3918e481	Rebuild	2025-10-24 17:18:40 +00:00
github-actions[bot]	7dd1575dac	Update version and changelog for v3.31.0	2025-10-24 17:11:07 +00:00
github-actions[bot]	28fc48d83c	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31.0-4e94bd11f	2025-10-24 17:11:06 +00:00
github-actions[bot]	12c6008004	Revert "Rebuild" This reverts commit `5f3f3164ad`.	2025-10-24 17:11:05 +00:00
github-actions[bot]	d3019effb0	Revert "Update version and changelog for v3.30.9" This reverts commit `ba42101490`.	2025-10-24 17:11:05 +00:00
Henry Mercer	42213152a8	Merge pull request #3216 from github/backport-v3.30.9-16140ae1a Merge releases/v4 into releases/v3	2025-10-17 17:09:13 +01:00
Henry Mercer	e677e67801	Run `setup-codeql` on Node 20 for v3	2025-10-17 16:53:18 +01:00
github-actions[bot]	5f3f3164ad	Rebuild	2025-10-17 15:34:40 +00:00
github-actions[bot]	ba42101490	Update version and changelog for v3.30.9	2025-10-17 15:24:34 +00:00
github-actions[bot]	f11af5849b	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.30.9-16140ae1a	2025-10-17 15:24:33 +00:00
github-actions[bot]	ba5430dc86	Revert "Rebuild" This reverts commit `948223fe01`.	2025-10-17 15:24:33 +00:00
github-actions[bot]	13e883e119	Revert "Update version and changelog for v3.30.8" This reverts commit `a37add20d4`.	2025-10-17 15:24:32 +00:00
Michael B. Gale	755f44910c	Merge pull request #3201 from github/backport-v3.30.8-2a6736cca Merge releases/v4 into releases/v3	2025-10-10 18:20:36 +01:00
github-actions[bot]	948223fe01	Rebuild	2025-10-10 16:56:34 +00:00
github-actions[bot]	a37add20d4	Update version and changelog for v3.30.8	2025-10-10 16:50:13 +00:00
github-actions[bot]	ab163cf08b	Merge remote-tracking branch 'origin/releases/v4' into backport-v3.30.8-2a6736cca	2025-10-10 16:50:12 +00:00
github-actions[bot]	319796f085	Revert "Rebuild" This reverts commit `c551c50310`.	2025-10-10 16:50:12 +00:00
github-actions[bot]	bd1ac56295	Revert "Update version and changelog for v3.30.7" This reverts commit `b264e15259`.	2025-10-10 16:50:12 +00:00
Mario Campos	a8d1ac45b9	Merge pull request #3187 from github/backport-v3.30.7-e296a9355 Merge releases/v4 into releases/v3	2025-10-07 10:58:53 -05:00
github-actions[bot]	c551c50310	Rebuild	2025-10-07 15:33:29 +00:00
Mario Campos	01f1a24033	Downgrade action.yml to use Node.js 20 instead of Node.js 24 for v3	2025-10-07 10:29:22 -05:00
github-actions[bot]	b264e15259	Update version and changelog for v3.30.7	2025-10-07 15:23:05 +00:00