Fix linitng issues.

Pass changed files in code ratehr than by file-system.
Include diff-edidted files in overlay changes.
2026-08-06 05:07:52 -05:00 · 2025-10-10 14:26:40 +01:00 · 2025-10-09 21:05:00 +01:00 · 2025-10-09 20:47:37 +01:00 · 2025-10-09 20:47:04 +01:00 · 2025-10-09 20:46:30 +01:00
74 changed files with 50888 additions and 3117 deletions
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node20
+  using: node24
  main: index.js
@@ -2,7 +2,7 @@ name: "Prepare test"
 description: Performs some preparation to run tests
 inputs:
  version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
+    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'toolcache', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
    required: true
  use-all-platform-bundle:
    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
@@ -41,6 +41,9 @@ runs:
        elif [[ "$VERSION" == "linked" ]]; then
          echo "tools-url=linked" >> "$GITHUB_OUTPUT"
          exit 0
+        elif [[ "$VERSION" == "toolcache" ]]; then
+          echo "tools-url=toolcache" >> "$GITHUB_OUTPUT"
+          exit 0
        elif [[ "$VERSION" == "default" ]]; then
          echo "tools-url=" >> "$GITHUB_OUTPUT"
          exit 0
@@ -1,4 +1,13 @@
-<!-- For GitHub staff: Remember that this is a public repository. -->
+<!--
+    For GitHub staff: Remember that this is a public repository. Do not link to internal resources.
+                      If necessary, link to this PR from an internal issue and include further details there.
+
+    Everyone: Include a summary of the context of this change, what it aims to accomplish, and why you
+              chose the approach you did if applicable. Indicate any open questions you want to answer
+              during the review process and anything you want reviewers to pay particular attention to.
+
+    See https://github.com/github/codeql-action/blob/main/CONTRIBUTING.md for additional information.
+-->

 ### Risk assessment

@@ -7,6 +16,44 @@ For internal use only. Please select the risk level of this change:
 - **Low risk:** Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
 - **High risk:** Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

+#### Which use cases does this change impact?
+
+<!-- Delete options that don't apply. -->
+
+- **Advanced setup** - Impacts users who have custom workflows.
+- **Default setup** - Impacts users who use default setup.
+- **Code Scanning** - Impacts Code Scanning (i.e. `analysis-kinds: code-scanning`).
+- **Code Quality** - Impacts Code Quality (i.e. `analysis-kinds: code-quality`).
+- **Third-party analyses** - Impacts third-party analyses (i.e. `upload-sarif`).
+- **GHES** - Impacts GitHub Enterprise Server.
+
+#### How did/will you validate this change?
+
+<!-- Delete options that don't apply. -->
+
+- **Test repository** - This change will be tested on a test repository before merging.
+- **Unit tests** - I am depending on unit test coverage (i.e. tests in `.test.ts` files).
+- **End-to-end tests** - I am depending on PR checks (i.e. tests in `pr-checks`).
+- **Other** - Please provide details.
+- **None** - I am not validating these changes.
+
+#### If something goes wrong after this change is released, what are the mitigation and rollback strategies?
+
+<!-- Delete strategies that don't apply. -->
+
+- **Feature flags** - All new or changed code paths can be fully disabled with corresponding feature flags.
+- **Rollback** - Change can only be disabled by rolling back the release or releasing a new version with a fix.
+- **Other** - Please provide details.
+
+#### How will you know if something goes wrong after this change is released?
+
+<!-- Delete options that don't apply. -->
+
+- **Telemetry** - I rely on existing telemetry or have made changes to the telemetry.
+    - **Dashboards** - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
+    - **Alerts** - New or existing monitors will trip if something goes wrong with this change.
+- **Other** - Please provide details.
+
 ### Merge / deployment checklist

 - Confirm this change is backwards compatible with existing workflows.
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.

-name: 'PR Check - Upload-sarif: code quality endpoint'
+name: 'PR Check - Bundle: From toolcache'
 env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GO111MODULE: auto
@@ -21,19 +21,9 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
+    inputs: {}
  workflow_call:
-    inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
+    inputs: {}
 defaults:
  run:
    shell: bash
@@ -41,14 +31,14 @@ concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  upload-quality-sarif:
+  bundle-from-toolcache:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
-            version: default
-    name: 'Upload-sarif: code quality endpoint'
+            version: toolcache
+    name: 'Bundle: From toolcache'
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
@@ -65,31 +55,32 @@ jobs:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
+      - name: Install @actions/tool-cache
+        run: npm install @actions/tool-cache
+      - name: Check toolcache contains CodeQL
+        continue-on-error: true
+        uses: actions/github-script@v8
        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - uses: ./../action/init
+          script: |
+            const toolcache = require('@actions/tool-cache');
+            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
+            if (allCodeqlVersions.length === 0) {
+              throw new Error(`CodeQL could not be found in the toolcache`);
+            }
+      - id: init
+        uses: ./../action/init
        with:
+          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          languages: csharp,java,javascript,python
-          analysis-kinds: code-quality
-      - name: Build code
-        run: ./build.sh
-  # Generate some SARIF we can upload with the upload-sarif step
-      - uses: ./../action/analyze
+      - name: Check CodeQL is installed within the toolcache
+        uses: actions/github-script@v8
        with:
-          ref: refs/heads/main
-          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
-          upload: never
-      - uses: ./../action/upload-sarif
-        id: upload-sarif
-        with:
-          ref: refs/heads/main
-          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
-      - name: Check output from `upload-sarif` step
-        if: '!(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)'
-        run: exit 1
+          script: |
+            const toolcache = require('@actions/tool-cache');
+            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
+            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
+            if (allCodeqlVersions.length === 0) {
+              throw new Error('CodeQL not found in toolcache');
+            }
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -0,0 +1,158 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Test different uses of `upload-sarif`
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+  workflow_call:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  upload-sarif:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-scanning,code-quality
+    name: Test different uses of `upload-sarif`
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - uses: ./../action/init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: csharp,java,javascript,python
+          analysis-kinds: ${{ matrix.analysis-kinds }}
+      - name: Build code
+        run: ./build.sh
+  # Generate some SARIF we can upload with the upload-sarif step
+      - uses: ./../action/analyze
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          upload: never
+          output: ${{ runner.temp }}/results
+
+      - name: |
+          Upload all SARIF files for `analysis-kinds: ${{ matrix.analysis-kinds }}`
+        uses: ./../action/upload-sarif
+        id: upload-sarif
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
+      - name: Fail for missing output from `upload-sarif` step for `code-scanning`
+        if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
+        run: exit 1
+      - name: Fail for missing output from `upload-sarif` step for `code-quality`
+        if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
+        run: exit 1
+
+      - name: Upload single SARIF file for Code Scanning
+        uses: ./../action/upload-sarif
+        id: upload-single-sarif-code-scanning
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results/javascript.sarif
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
+      - name: Fail for missing output from `upload-single-sarif-code-scanning` step
+        if: contains(matrix.analysis-kinds, 'code-scanning') &&
+          !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
+        run: exit 1
+      - name: Upload single SARIF file for Code Quality
+        uses: ./../action/upload-sarif
+        id: upload-single-sarif-code-quality
+        if: contains(matrix.analysis-kinds, 'code-quality')
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
+      - name: Fail for missing output from `upload-single-sarif-code-quality` step
+        if: contains(matrix.analysis-kinds, 'code-quality') &&
+          !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
+        run: exit 1
+
+      - name: Change SARIF file extension
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        run: mv ${{ runner.temp }}/results/javascript.sarif ${{ runner.temp }}/results/javascript.sarif.json
+      - name: Upload single non-`.sarif` file
+        uses: ./../action/upload-sarif
+        id: upload-single-non-sarif
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
+      - name: Fail for missing output from `upload-single-non-sarif` step
+        if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
+        run: exit 1
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -103,29 +103,30 @@ jobs:

      - name: Verify SARIF after upload
        run: |
+          PAYLOAD_FILE="$RUNNER_TEMP/payload-code-scanning.json"
          EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
          EXPECTED_REF="v1.1.0"
          EXPECTED_CHECKOUT_URI_SUFFIX="/x/y/z/some-path/tests/multi-language-repo"

-          ACTUAL_COMMIT_OID="$(cat "$RUNNER_TEMP/payload.json" | jq -r .commit_oid)"
-          ACTUAL_REF="$(cat "$RUNNER_TEMP/payload.json" | jq -r .ref)"
-          ACTUAL_CHECKOUT_URI="$(cat "$RUNNER_TEMP/payload.json" | jq -r .checkout_uri)"
+          ACTUAL_COMMIT_OID="$(cat "$PAYLOAD_FILE" | jq -r .commit_oid)"
+          ACTUAL_REF="$(cat "$PAYLOAD_FILE" | jq -r .ref)"
+          ACTUAL_CHECKOUT_URI="$(cat "$PAYLOAD_FILE" | jq -r .checkout_uri)"

          if [[ "$EXPECTED_COMMIT_OID" != "$ACTUAL_COMMIT_OID" ]]; then
            echo "::error Invalid commit oid. Expected: $EXPECTED_COMMIT_OID Actual: $ACTUAL_COMMIT_OID"
-            echo "$RUNNER_TEMP/payload.json"
+            echo "$PAYLOAD_FILE"
            exit 1
          fi

          if [[ "$EXPECTED_REF" != "$ACTUAL_REF" ]]; then
            echo "::error Invalid ref. Expected: '$EXPECTED_REF' Actual: '$ACTUAL_REF'"
-            echo "$RUNNER_TEMP/payload.json"
+            echo "$PAYLOAD_FILE"
            exit 1
          fi

          if [[ "$ACTUAL_CHECKOUT_URI" != *$EXPECTED_CHECKOUT_URI_SUFFIX ]]; then
            echo "::error Invalid checkout URI suffix. Expected suffix: $EXPECTED_CHECKOUT_URI_SUFFIX Actual uri: $ACTUAL_CHECKOUT_URI"
-            echo "$RUNNER_TEMP/payload.json"
+            echo "$PAYLOAD_FILE"
            exit 1
          fi
    env:
@@ -58,7 +58,7 @@ jobs:
    - name: Set up Node.js
      uses: actions/setup-node@v5
      with:
-        node-version: '20'
+        node-version: 24
        cache: 'npm'

    - name: Install dependencies
@@ -20,6 +20,7 @@ jobs:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
+        node-version: [20, 24]
    permissions:
      contents: read
      security-events: write # needed to upload ESLint results
@@ -36,7 +37,7 @@ jobs:
      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
-          node-version: '20.x'
+          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Set up Python
@@ -73,7 +74,7 @@ jobs:

      - name: Upload sarif
        uses: github/codeql-action/upload-sarif@v3
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
        with:
          sarif_file: eslint.sarif
          category: eslint
@@ -34,7 +34,7 @@ jobs:
    - name: Install Node.js
      uses: actions/setup-node@v5
      with:
-        node-version: 20.x
+        node-version: 24
        cache: npm

    - name: Install dependencies
@@ -43,7 +43,7 @@ jobs:
      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
-          node-version: '20.x'
+          node-version: 24
          cache: 'npm'

      - name: Install dependencies
@@ -1,99 +0,0 @@
-name: Update dependency proxy release assets
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag of CodeQL Bundle release that contains the proxy binaries as release assets"
-        type: string
-        required: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  update:
-    name: Update code and create PR
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # needed to push the updated files
-      pull-requests: write # needed to create the PR
-    env:
-      RELEASE_TAG: ${{ inputs.tag }}
-    steps:
-      - name: Check release tag format
-        id: checks
-        run: |
-          if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
-            exit 1
-          fi
-
-          echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
-
-      - name: Check that the release exists
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        run: |
-          (gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
-
-      - name: Install Node
-        uses: actions/setup-node@v5
-
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
-          ref: main
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Update release tag and version
-        run: |
-          NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
-          sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
-          sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
-
-      - name: Compile TypeScript and commit changes
-        env:
-          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
-        run: |
-          set -exu
-          git checkout -b "$TARGET_BRANCH"
-
-          npm run build
-          git add ./src/start-proxy-action.ts
-          git add ./lib
-          git commit -m "Update release used by \`start-proxy\` action"
-
-      - name: Push changes and open PR
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
-          PR_FLAG: ${{ (github.event_name == 'workflow_dispatch' && '--draft') || '--dry-run' }}
-        run: |
-          set -exu
-          pr_title="Update release used by \`start-proxy\` to \`$RELEASE_TAG\`"
-          pr_body=$(cat << EOF
-            This PR updates the \`start-proxy\` action to use the private registry proxy binaries that
-            are attached as release assets to the \`$RELEASE_TAG\` release.
-
-
-            Please do the following before merging:
-
-            - [ ] Verify that the changes to the code are correct.
-            - [ ] Mark the PR as ready for review to trigger the CI.
-          EOF
-          )
-
-          git push origin "$TARGET_BRANCH"
-          gh pr create \
-            --head "$TARGET_BRANCH" \
-            --base "main" \
-            --title "${pr_title}" \
-            --body "${pr_body}" \
-            $PR_FLAG
@@ -6,6 +6,14 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

 No user facing changes.

+## 4.30.7 - 06 Oct 2025
+
+- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
+
+## 3.30.6 - 02 Oct 2025
+
+- Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
+
 ## 3.30.5 - 26 Sep 2025

 - We fixed a bug that was introduced in `3.30.4` with `upload-sarif` which resulted in files without a `.sarif` extension not getting uploaded. [#3160](https://github.com/github/codeql-action/pull/3160)
@@ -13,7 +13,7 @@ Please note that this project is released with a [Contributor Code of Conduct][c

 ## Development and Testing

-Before you start, ensure that you have a recent version of node (16 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.

 ### Common tasks

@@ -62,7 +62,8 @@ For compiled languages:

 The following versions of the CodeQL Action are currently supported:

- v3 (latest)
+- v4 (latest)
+- v3

 ## Supported versions of the CodeQL Bundle on GitHub Enterprise Server

@@ -92,6 +92,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node20
+  using: node24
  main: "../lib/analyze-action.js"
  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node20
+  using: node24
  main: '../lib/autobuild-action.js'
@@ -146,6 +146,12 @@ export default [
      "@typescript-eslint/prefer-regexp-exec": "off",
      "@typescript-eslint/require-await": "off",
      "@typescript-eslint/restrict-template-expressions": "off",
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        {
+          "argsIgnorePattern": "^_",
+        }
+      ],
      "func-style": "off",
    },
  },
@@ -165,6 +165,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node20
+  using: node24
  main: '../lib/init-action.js'
  post: '../lib/init-action-post.js'
@@ -25121,8 +25121,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare;
+    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare2;
  }
 });

@@ -25130,8 +25130,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var rcompare = (a, b, loose) => compare(b, a, loose);
+    var compare2 = require_compare();
+    var rcompare = (a, b, loose) => compare2(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -25140,8 +25140,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var compareLoose = (a, b) => compare(a, b, true);
+    var compare2 = require_compare();
+    var compareLoose = (a, b) => compare2(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -25184,8 +25184,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gt = (a, b, loose) => compare(a, b, loose) > 0;
+    var compare2 = require_compare();
+    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -25194,8 +25194,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lt = (a, b, loose) => compare(a, b, loose) < 0;
+    var compare2 = require_compare();
+    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -25204,8 +25204,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var eq = (a, b, loose) => compare(a, b, loose) === 0;
+    var compare2 = require_compare();
+    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -25214,8 +25214,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var neq = (a, b, loose) => compare(a, b, loose) !== 0;
+    var compare2 = require_compare();
+    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -25224,8 +25224,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gte5 = (a, b, loose) => compare(a, b, loose) >= 0;
+    var compare2 = require_compare();
+    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -25234,8 +25234,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lte = (a, b, loose) => compare(a, b, loose) <= 0;
+    var compare2 = require_compare();
+    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -26131,12 +26131,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare(a, b, options));
+      const v = versions.sort((a, b) => compare2(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -26184,7 +26184,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -26244,7 +26244,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare(gt.semver, lt.semver, options);
+        gtltComp = compare2(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -26324,14 +26324,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -26355,7 +26355,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -26393,7 +26393,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare,
+      compare: compare2,
      rcompare,
      compareLoose,
      compareBuild,
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -26473,6 +26473,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -26493,7 +26494,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -26504,7 +26505,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -26517,7 +26518,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -30261,13 +30262,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare;
-    function compare(a, b, loose) {
+    exports2.compare = compare2;
+    function compare2(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare(a, b, true);
+      return compare2(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -30277,7 +30278,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare(b, a, loose);
+      return compare2(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -30293,27 +30294,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare(a, b, loose) > 0;
+      return compare2(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare(a, b, loose) < 0;
+      return compare2(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare(a, b, loose) === 0;
+      return compare2(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare(a, b, loose) !== 0;
+      return compare2(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare(a, b, loose) >= 0;
+      return compare2(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare(a, b, loose) <= 0;
+      return compare2(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -95823,8 +95824,8 @@ var require_commonjs16 = __commonJS({
        if (rootPath === this.root.name) {
          return this.root;
        }
-        for (const [compare, root] of Object.entries(this.roots)) {
-          if (this.sameRoot(rootPath, compare)) {
+        for (const [compare2, root] of Object.entries(this.roots)) {
+          if (this.sameRoot(rootPath, compare2)) {
            return this.roots[rootPath] = root;
          }
        }
@@ -95833,9 +95834,9 @@ var require_commonjs16 = __commonJS({
      /**
       * @internal
       */
-      sameRoot(rootPath, compare = this.root.name) {
+      sameRoot(rootPath, compare2 = this.root.name) {
        rootPath = rootPath.toUpperCase().replace(/\//g, "\\").replace(uncDriveRegexp, "$1\\");
-        return rootPath === compare;
+        return rootPath === compare2;
      }
    };
    exports2.PathWin32 = PathWin32;
@@ -99854,7 +99855,7 @@ var require_b4a = __commonJS({
    function byteLength(string, encoding) {
      return Buffer.byteLength(string, encoding);
    }
-    function compare(a, b) {
+    function compare2(a, b) {
      return Buffer.compare(a, b);
    }
    function concat(buffers, totalLength) {
@@ -99955,7 +99956,7 @@ var require_b4a = __commonJS({
      allocUnsafe,
      allocUnsafeSlow,
      byteLength,
-      compare,
+      compare: compare2,
      concat,
      copy,
      equals,
@@ -117760,12 +117761,41 @@ async function readBaseDatabaseOidsFile(config, logger) {
 function getBaseDatabaseOidsFilePath(config) {
  return path2.join(config.dbLocation, "base-database-oids.json");
 }
-async function writeOverlayChangesFile(config, sourceRoot, logger) {
+async function writeOverlayChangesFile(config, sourceRoot, prDiffChangedFiles, logger) {
  const baseFileOids = await readBaseDatabaseOidsFile(config, logger);
  const overlayFileOids = await getFileOidsUnderPath(sourceRoot);
  const changedFiles = computeChangedFiles(baseFileOids, overlayFileOids);
+  const originalCount = changedFiles.length;
+  let extraAddedCount = 0;
+  try {
+    if (prDiffChangedFiles && prDiffChangedFiles.size > 0) {
+      const existing = new Set(changedFiles);
+      for (const f of prDiffChangedFiles) {
+        if (!existing.has(f)) {
+          if (overlayFileOids[f] !== void 0 || fs2.existsSync(path2.join(sourceRoot, f))) {
+            existing.add(f);
+            changedFiles.push(f);
+            extraAddedCount++;
+          }
+        }
+      }
+      if (extraAddedCount > 0) {
+        logger.debug(
+          `Added ${extraAddedCount} file(s) from PR diff ranges into overlay: ${changedFiles.slice(-extraAddedCount).join(", ")}`
+        );
+      } else {
+        logger.debug(
+          "All diff range files were already present in the diff from the base database."
+        );
+      }
+    }
+  } catch (e) {
+    logger.debug(
+      `Failed while attempting to add diff range files in overlay: ${e.message || e}`
+    );
+  }
  logger.info(
-    `Found ${changedFiles.length} changed file(s) under ${sourceRoot}.`
+    `Found ${originalCount} natural changed file(s); added from diff ${extraAddedCount}; total ${changedFiles.length} under ${sourceRoot}.`
  );
  const changedFilesJson = JSON.stringify({ changes: changedFiles });
  const overlayChangesFile = path2.join(
@@ -118134,7 +118164,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
    async isScannedLanguage(language) {
      return !await this.isTracedLanguage(language);
    },
-    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
+    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, prDiffChangedFiles, logger) {
      const extraArgs = config.languages.map(
        (language) => `--language=${language}`
      );
@@ -118169,6 +118199,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
        const overlayChangesFile = await writeOverlayChangesFile(
          config,
          sourceRoot,
+          prDiffChangedFiles,
          logger
        );
        extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -118671,7 +118702,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion
      if (fs5.existsSync(baseTempDir)) {
        const outputDirs = fs5.readdirSync(baseTempDir);
        for (const outputDir of outputDirs) {
-          const sarifFiles = fs5.readdirSync(path5.resolve(baseTempDir, outputDir)).filter((f) => f.endsWith(".sarif"));
+          const sarifFiles = fs5.readdirSync(path5.resolve(baseTempDir, outputDir)).filter((f) => path5.extname(f) === ".sarif");
          for (const sarifFile of sarifFiles) {
            toUpload.push(path5.resolve(baseTempDir, outputDir, sarifFile));
          }
@@ -25121,8 +25121,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare;
+    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare2;
  }
 });

@@ -25130,8 +25130,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var rcompare = (a, b, loose) => compare(b, a, loose);
+    var compare2 = require_compare();
+    var rcompare = (a, b, loose) => compare2(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -25140,8 +25140,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var compareLoose = (a, b) => compare(a, b, true);
+    var compare2 = require_compare();
+    var compareLoose = (a, b) => compare2(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -25184,8 +25184,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gt = (a, b, loose) => compare(a, b, loose) > 0;
+    var compare2 = require_compare();
+    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -25194,8 +25194,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lt = (a, b, loose) => compare(a, b, loose) < 0;
+    var compare2 = require_compare();
+    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -25204,8 +25204,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var eq = (a, b, loose) => compare(a, b, loose) === 0;
+    var compare2 = require_compare();
+    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -25214,8 +25214,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var neq = (a, b, loose) => compare(a, b, loose) !== 0;
+    var compare2 = require_compare();
+    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -25224,8 +25224,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gte5 = (a, b, loose) => compare(a, b, loose) >= 0;
+    var compare2 = require_compare();
+    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -25234,8 +25234,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lte = (a, b, loose) => compare(a, b, loose) <= 0;
+    var compare2 = require_compare();
+    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -26131,12 +26131,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare(a, b, options));
+      const v = versions.sort((a, b) => compare2(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -26184,7 +26184,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -26244,7 +26244,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare(gt.semver, lt.semver, options);
+        gtltComp = compare2(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -26324,14 +26324,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -26355,7 +26355,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -26393,7 +26393,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare,
+      compare: compare2,
      rcompare,
      compareLoose,
      compareBuild,
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -26473,6 +26473,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -26493,7 +26494,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -26504,7 +26505,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -26517,7 +26518,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -30261,13 +30262,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare;
-    function compare(a, b, loose) {
+    exports2.compare = compare2;
+    function compare2(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare(a, b, true);
+      return compare2(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -30277,7 +30278,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare(b, a, loose);
+      return compare2(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -30293,27 +30294,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare(a, b, loose) > 0;
+      return compare2(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare(a, b, loose) < 0;
+      return compare2(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare(a, b, loose) === 0;
+      return compare2(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare(a, b, loose) !== 0;
+      return compare2(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare(a, b, loose) >= 0;
+      return compare2(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare(a, b, loose) <= 0;
+      return compare2(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -78295,8 +78296,8 @@ var path3 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.1";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));
@@ -78500,12 +78501,41 @@ async function readBaseDatabaseOidsFile(config, logger) {
 function getBaseDatabaseOidsFilePath(config) {
  return path2.join(config.dbLocation, "base-database-oids.json");
 }
-async function writeOverlayChangesFile(config, sourceRoot, logger) {
+async function writeOverlayChangesFile(config, sourceRoot, prDiffChangedFiles, logger) {
  const baseFileOids = await readBaseDatabaseOidsFile(config, logger);
  const overlayFileOids = await getFileOidsUnderPath(sourceRoot);
  const changedFiles = computeChangedFiles(baseFileOids, overlayFileOids);
+  const originalCount = changedFiles.length;
+  let extraAddedCount = 0;
+  try {
+    if (prDiffChangedFiles && prDiffChangedFiles.size > 0) {
+      const existing = new Set(changedFiles);
+      for (const f of prDiffChangedFiles) {
+        if (!existing.has(f)) {
+          if (overlayFileOids[f] !== void 0 || fs2.existsSync(path2.join(sourceRoot, f))) {
+            existing.add(f);
+            changedFiles.push(f);
+            extraAddedCount++;
+          }
+        }
+      }
+      if (extraAddedCount > 0) {
+        logger.debug(
+          `Added ${extraAddedCount} file(s) from PR diff ranges into overlay: ${changedFiles.slice(-extraAddedCount).join(", ")}`
+        );
+      } else {
+        logger.debug(
+          "All diff range files were already present in the diff from the base database."
+        );
+      }
+    }
+  } catch (e) {
+    logger.debug(
+      `Failed while attempting to add diff range files in overlay: ${e.message || e}`
+    );
+  }
  logger.info(
-    `Found ${changedFiles.length} changed file(s) under ${sourceRoot}.`
+    `Found ${originalCount} natural changed file(s); added from diff ${extraAddedCount}; total ${changedFiles.length} under ${sourceRoot}.`
  );
  const changedFilesJson = JSON.stringify({ changes: changedFiles });
  const overlayChangesFile = path2.join(
@@ -79169,7 +79199,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
    async isScannedLanguage(language) {
      return !await this.isTracedLanguage(language);
    },
-    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
+    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, prDiffChangedFiles, logger) {
      const extraArgs = config.languages.map(
        (language) => `--language=${language}`
      );
@@ -79204,6 +79234,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
        const overlayChangesFile = await writeOverlayChangesFile(
          config,
          sourceRoot,
+          prDiffChangedFiles,
          logger
        );
        extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -79812,7 +79843,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
      action_ref: actionRef,
      action_started_at: actionStartedAt.toISOString(),
      action_version: getActionVersion(),
-      analysis_kinds: config?.analysisKinds.join(","),
+      analysis_kinds: config?.analysisKinds?.join(","),
      analysis_key,
      build_mode: config?.buildMode,
      commit_oid: commitOid,
@@ -79835,7 +79866,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
      logger.warning(`Could not determine the workflow event name: ${e}.`);
    }
    if (config) {
-      statusReport.languages = config.languages.join(",");
+      statusReport.languages = config.languages?.join(",");
    }
    if (diskInfo) {
      statusReport.runner_available_disk_space_bytes = diskInfo.numAvailableBytes;
@@ -79872,6 +79903,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.1",
-  "cliVersion": "2.23.1",
-  "priorBundleVersion": "codeql-bundle-v2.23.0",
-  "priorCliVersion": "2.23.0"
+  "bundleVersion": "codeql-bundle-v2.23.2",
+  "cliVersion": "2.23.2",
+  "priorBundleVersion": "codeql-bundle-v2.23.1",
+  "priorCliVersion": "2.23.1"
 }
@@ -20602,14 +20602,14 @@ var require_dist_node4 = __commonJS({
    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
    var dist_src_exports = {};
    __export2(dist_src_exports, {
-      RequestError: () => RequestError
+      RequestError: () => RequestError2
    });
    module2.exports = __toCommonJS2(dist_src_exports);
    var import_deprecation = require_dist_node3();
    var import_once = __toESM2(require_once());
    var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
    var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -20701,7 +20701,7 @@ var require_dist_node5 = __commonJS({
      const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
      return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
    }
-    var import_request_error = require_dist_node4();
+    var import_request_error2 = require_dist_node4();
    function getBufferResponse(response) {
      return response.arrayBuffer();
    }
@@ -20753,7 +20753,7 @@ var require_dist_node5 = __commonJS({
          if (status < 400) {
            return;
          }
-          throw new import_request_error.RequestError(response.statusText, status, {
+          throw new import_request_error2.RequestError(response.statusText, status, {
            response: {
              url: url2,
              status,
@@ -20764,7 +20764,7 @@ var require_dist_node5 = __commonJS({
          });
        }
        if (status === 304) {
-          throw new import_request_error.RequestError("Not modified", status, {
+          throw new import_request_error2.RequestError("Not modified", status, {
            response: {
              url: url2,
              status,
@@ -20776,7 +20776,7 @@ var require_dist_node5 = __commonJS({
        }
        if (status >= 400) {
          const data = await getResponseData(response);
-          const error2 = new import_request_error.RequestError(toErrorMessage(data), status, {
+          const error2 = new import_request_error2.RequestError(toErrorMessage(data), status, {
            response: {
              url: url2,
              status,
@@ -20796,7 +20796,7 @@ var require_dist_node5 = __commonJS({
          data
        };
      }).catch((error2) => {
-        if (error2 instanceof import_request_error.RequestError)
+        if (error2 instanceof import_request_error2.RequestError)
          throw error2;
        else if (error2.name === "AbortError")
          throw error2;
@@ -20808,7 +20808,7 @@ var require_dist_node5 = __commonJS({
            message = error2.cause;
          }
        }
-        throw new import_request_error.RequestError(message, 500, {
+        throw new import_request_error2.RequestError(message, 500, {
          request: requestOptions
        });
      });
@@ -21250,14 +21250,14 @@ var require_dist_node7 = __commonJS({
    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
    var dist_src_exports = {};
    __export2(dist_src_exports, {
-      RequestError: () => RequestError
+      RequestError: () => RequestError2
    });
    module2.exports = __toCommonJS2(dist_src_exports);
    var import_deprecation = require_dist_node3();
    var import_once = __toESM2(require_once());
    var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
    var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -21349,7 +21349,7 @@ var require_dist_node8 = __commonJS({
      const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
      return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
    }
-    var import_request_error = require_dist_node7();
+    var import_request_error2 = require_dist_node7();
    function getBufferResponse(response) {
      return response.arrayBuffer();
    }
@@ -21401,7 +21401,7 @@ var require_dist_node8 = __commonJS({
          if (status < 400) {
            return;
          }
-          throw new import_request_error.RequestError(response.statusText, status, {
+          throw new import_request_error2.RequestError(response.statusText, status, {
            response: {
              url: url2,
              status,
@@ -21412,7 +21412,7 @@ var require_dist_node8 = __commonJS({
          });
        }
        if (status === 304) {
-          throw new import_request_error.RequestError("Not modified", status, {
+          throw new import_request_error2.RequestError("Not modified", status, {
            response: {
              url: url2,
              status,
@@ -21424,7 +21424,7 @@ var require_dist_node8 = __commonJS({
        }
        if (status >= 400) {
          const data = await getResponseData(response);
-          const error2 = new import_request_error.RequestError(toErrorMessage(data), status, {
+          const error2 = new import_request_error2.RequestError(toErrorMessage(data), status, {
            response: {
              url: url2,
              status,
@@ -21444,7 +21444,7 @@ var require_dist_node8 = __commonJS({
          data
        };
      }).catch((error2) => {
-        if (error2 instanceof import_request_error.RequestError)
+        if (error2 instanceof import_request_error2.RequestError)
          throw error2;
        else if (error2.name === "AbortError")
          throw error2;
@@ -21456,7 +21456,7 @@ var require_dist_node8 = __commonJS({
            message = error2.cause;
          }
        }
-        throw new import_request_error.RequestError(message, 500, {
+        throw new import_request_error2.RequestError(message, 500, {
          request: requestOptions
        });
      });
@@ -25039,7 +25039,7 @@ var require_to_regex_range = __commonJS({
        stop = countZeros(max + 1, zeros) - 1;
      }
      stops = [...stops];
-      stops.sort(compare2);
+      stops.sort(compare3);
      return stops;
    }
    function rangeToPattern(start, stop, options) {
@@ -25111,7 +25111,7 @@ var require_to_regex_range = __commonJS({
      for (let i = 0; i < a.length; i++) arr.push([a[i], b[i]]);
      return arr;
    }
-    function compare2(a, b) {
+    function compare3(a, b) {
      return a > b ? 1 : b > a ? -1 : 0;
    }
    function contains(arr, key, val2) {
@@ -28149,11 +28149,11 @@ var require_out = __commonJS({
      async.read(path19, getSettings(optionsOrSettingsOrCallback), callback);
    }
    exports2.stat = stat;
-    function statSync2(path19, optionsOrSettings) {
+    function statSync3(path19, optionsOrSettings) {
      const settings = getSettings(optionsOrSettings);
      return sync.read(path19, settings);
    }
-    exports2.statSync = statSync2;
+    exports2.statSync = statSync3;
    function getSettings(settingsOrOptions = {}) {
      if (settingsOrOptions instanceof settings_1.default) {
        return settingsOrOptions;
@@ -30970,8 +30970,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare2;
+    var compare3 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare3;
  }
 });

@@ -30979,8 +30979,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
+    var compare3 = require_compare();
+    var rcompare = (a, b, loose) => compare3(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -30989,8 +30989,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var compareLoose = (a, b) => compare2(a, b, true);
+    var compare3 = require_compare();
+    var compareLoose = (a, b) => compare3(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -31033,8 +31033,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
+    var compare3 = require_compare();
+    var gt = (a, b, loose) => compare3(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -31043,8 +31043,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
+    var compare3 = require_compare();
+    var lt = (a, b, loose) => compare3(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -31053,8 +31053,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
+    var compare3 = require_compare();
+    var eq = (a, b, loose) => compare3(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -31063,8 +31063,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
+    var compare3 = require_compare();
+    var neq = (a, b, loose) => compare3(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -31073,8 +31073,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
+    var compare3 = require_compare();
+    var gte5 = (a, b, loose) => compare3(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -31083,8 +31083,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
+    var compare3 = require_compare();
+    var lte = (a, b, loose) => compare3(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -31980,12 +31980,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare2 = require_compare();
+    var compare3 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare2(a, b, options));
+      const v = versions.sort((a, b) => compare3(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -32033,7 +32033,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare2 = require_compare();
+    var compare3 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -32093,7 +32093,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare2(gt.semver, lt.semver, options);
+        gtltComp = compare3(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -32173,14 +32173,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare2(a.semver, b.semver, options);
+      const comp = compare3(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare2(a.semver, b.semver, options);
+      const comp = compare3(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -32204,7 +32204,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare2 = require_compare();
+    var compare3 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -32242,7 +32242,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare: compare2,
+      compare: compare3,
      rcompare,
      compareLoose,
      compareBuild,
@@ -32287,7 +32287,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -32322,6 +32322,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -32342,7 +32343,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -32353,7 +32354,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -32366,7 +32367,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -33745,14 +33746,14 @@ var require_dist_node14 = __commonJS({
    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
    var dist_src_exports = {};
    __export2(dist_src_exports, {
-      RequestError: () => RequestError
+      RequestError: () => RequestError2
    });
    module2.exports = __toCommonJS2(dist_src_exports);
    var import_deprecation = require_dist_node3();
    var import_once = __toESM2(require_once());
    var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
    var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -33854,7 +33855,7 @@ var require_dist_node15 = __commonJS({
      throw error2;
    }
    var import_light = __toESM2(require_light());
-    var import_request_error = require_dist_node14();
+    var import_request_error2 = require_dist_node14();
    async function wrapRequest(state, octokit, request, options) {
      const limiter = new import_light.default();
      limiter.on("failed", function(error2, info5) {
@@ -33875,7 +33876,7 @@ var require_dist_node15 = __commonJS({
      if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
        response.data.errors[0].message
      )) {
-        const error2 = new import_request_error.RequestError(response.data.errors[0].message, 500, {
+        const error2 = new import_request_error2.RequestError(response.data.errors[0].message, 500, {
          request: options,
          response
        });
@@ -36110,13 +36111,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare2;
-    function compare2(a, b, loose) {
+    exports2.compare = compare3;
+    function compare3(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare2(a, b, true);
+      return compare3(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -36126,7 +36127,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare2(b, a, loose);
+      return compare3(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -36142,27 +36143,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare2(a, b, loose) > 0;
+      return compare3(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare2(a, b, loose) < 0;
+      return compare3(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare2(a, b, loose) === 0;
+      return compare3(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare2(a, b, loose) !== 0;
+      return compare3(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare2(a, b, loose) >= 0;
+      return compare3(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare2(a, b, loose) <= 0;
+      return compare3(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -101672,8 +101673,8 @@ var require_commonjs16 = __commonJS({
        if (rootPath === this.root.name) {
          return this.root;
        }
-        for (const [compare2, root] of Object.entries(this.roots)) {
-          if (this.sameRoot(rootPath, compare2)) {
+        for (const [compare3, root] of Object.entries(this.roots)) {
+          if (this.sameRoot(rootPath, compare3)) {
            return this.roots[rootPath] = root;
          }
        }
@@ -101682,9 +101683,9 @@ var require_commonjs16 = __commonJS({
      /**
       * @internal
       */
-      sameRoot(rootPath, compare2 = this.root.name) {
+      sameRoot(rootPath, compare3 = this.root.name) {
        rootPath = rootPath.toUpperCase().replace(/\//g, "\\").replace(uncDriveRegexp, "$1\\");
-        return rootPath === compare2;
+        return rootPath === compare3;
      }
    };
    exports2.PathWin32 = PathWin32;
@@ -105703,7 +105704,7 @@ var require_b4a = __commonJS({
    function byteLength(string, encoding) {
      return Buffer.byteLength(string, encoding);
    }
-    function compare2(a, b) {
+    function compare3(a, b) {
      return Buffer.compare(a, b);
    }
    function concat(buffers, totalLength) {
@@ -105804,7 +105805,7 @@ var require_b4a = __commonJS({
      allocUnsafe,
      allocUnsafeSlow,
      byteLength,
-      compare: compare2,
+      compare: compare3,
      concat,
      copy,
      equals: equals2,
@@ -111944,7 +111945,7 @@ var require_dist_node17 = __commonJS({
    var once2 = _interopDefault(require_once());
    var logOnceCode = once2((deprecation2) => console.warn(deprecation2));
    var logOnceHeaders = once2((deprecation2) => console.warn(deprecation2));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -111982,7 +111983,7 @@ var require_dist_node17 = __commonJS({
        });
      }
    };
-    exports2.RequestError = RequestError;
+    exports2.RequestError = RequestError2;
  }
 });

@@ -128072,6 +128073,9 @@ function isGoodVersion(versionSpec) {
 function isInTestMode() {
  return process.env["CODEQL_ACTION_TEST_MODE" /* TEST_MODE */] === "true";
 }
+function shouldSkipSarifUpload() {
+  return isInTestMode() || process.env["CODEQL_ACTION_SKIP_SARIF_UPLOAD" /* SKIP_SARIF_UPLOAD */] === "true";
+}
 function getTestingEnvironment() {
  const testingEnvironment = process.env["CODEQL_ACTION_TESTING_ENVIRONMENT" /* TESTING_ENVIRONMENT */] || "";
  if (testingEnvironment === "") {
@@ -128337,6 +128341,12 @@ function getWorkflowRunAttempt() {
 function isSelfHostedRunner() {
  return process.env.RUNNER_ENVIRONMENT === "self-hosted";
 }
+function isDynamicWorkflow() {
+  return getWorkflowEventName() === "dynamic";
+}
+function isDefaultSetup() {
+  return isDynamicWorkflow();
+}
 function prettyPrintInvocation(cmd, args) {
  return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
 }
@@ -128402,6 +128412,30 @@ var restoreInputs = function() {
    }
  }
 };
+var qualityCategoryMapping = {
+  "c#": "csharp",
+  cpp: "c-cpp",
+  c: "c-cpp",
+  "c++": "c-cpp",
+  java: "java-kotlin",
+  javascript: "javascript-typescript",
+  typescript: "javascript-typescript",
+  kotlin: "java-kotlin"
+};
+function fixCodeQualityCategory(logger, category) {
+  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
+    const language = category.substring("/language:".length);
+    const mappedLanguage = qualityCategoryMapping[language];
+    if (mappedLanguage) {
+      const newCategory = `/language:${mappedLanguage}`;
+      logger.info(
+        `Adjusted category for Code Quality from '${category}' to '${newCategory}'.`
+      );
+      return newCategory;
+    }
+  }
+  return category;
+}

 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -128568,6 +128602,45 @@ var path13 = __toESM(require("path"));
 var core10 = __toESM(require_core());
 var toolrunner3 = __toESM(require_toolrunner());

+// node_modules/@octokit/request-error/dist-src/index.js
+var RequestError = class extends Error {
+  name;
+  /**
+   * http status code
+   */
+  status;
+  /**
+   * Request options that lead to the error.
+   */
+  request;
+  /**
+   * Response object if a response was received
+   */
+  response;
+  constructor(message, statusCode, options) {
+    super(message);
+    this.name = "HttpError";
+    this.status = Number.parseInt(statusCode);
+    if (Number.isNaN(this.status)) {
+      this.status = 0;
+    }
+    if ("response" in options) {
+      this.response = options.response;
+    }
+    const requestCopy = Object.assign({}, options.request);
+    if (options.request.headers.authorization) {
+      requestCopy.headers = Object.assign({}, options.request.headers, {
+        authorization: options.request.headers.authorization.replace(
+          /(?<! ) .*$/,
+          " [REDACTED]"
+        )
+      });
+    }
+    requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+    this.request = requestCopy;
+  }
+};
+
 // src/cli-errors.ts
 var SUPPORTED_PLATFORMS = [
  ["linux", "x64"],
@@ -128822,6 +128895,7 @@ var CodeScanning = {
  target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
  sarifExtension: ".sarif",
  sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
+  fixCategory: (_2, category) => category,
  sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
 };
 var CodeQuality = {
@@ -128830,6 +128904,7 @@ var CodeQuality = {
  target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
  sarifExtension: ".quality.sarif",
  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
+  fixCategory: fixCodeQualityCategory,
  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
 };

@@ -128852,8 +128927,8 @@ var path8 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.1";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var fs6 = __toESM(require("fs"));
@@ -129110,12 +129185,41 @@ async function readBaseDatabaseOidsFile(config, logger) {
 function getBaseDatabaseOidsFilePath(config) {
  return path7.join(config.dbLocation, "base-database-oids.json");
 }
-async function writeOverlayChangesFile(config, sourceRoot, logger) {
+async function writeOverlayChangesFile(config, sourceRoot, prDiffChangedFiles, logger) {
  const baseFileOids = await readBaseDatabaseOidsFile(config, logger);
  const overlayFileOids = await getFileOidsUnderPath(sourceRoot);
  const changedFiles = computeChangedFiles(baseFileOids, overlayFileOids);
+  const originalCount = changedFiles.length;
+  let extraAddedCount = 0;
+  try {
+    if (prDiffChangedFiles && prDiffChangedFiles.size > 0) {
+      const existing = new Set(changedFiles);
+      for (const f of prDiffChangedFiles) {
+        if (!existing.has(f)) {
+          if (overlayFileOids[f] !== void 0 || fs6.existsSync(path7.join(sourceRoot, f))) {
+            existing.add(f);
+            changedFiles.push(f);
+            extraAddedCount++;
+          }
+        }
+      }
+      if (extraAddedCount > 0) {
+        logger.debug(
+          `Added ${extraAddedCount} file(s) from PR diff ranges into overlay: ${changedFiles.slice(-extraAddedCount).join(", ")}`
+        );
+      } else {
+        logger.debug(
+          "All diff range files were already present in the diff from the base database."
+        );
+      }
+    }
+  } catch (e) {
+    logger.debug(
+      `Failed while attempting to add diff range files in overlay: ${e.message || e}`
+    );
+  }
  logger.info(
-    `Found ${changedFiles.length} changed file(s) under ${sourceRoot}.`
+    `Found ${originalCount} natural changed file(s); added from diff ${extraAddedCount}; total ${changedFiles.length} under ${sourceRoot}.`
  );
  const changedFilesJson = JSON.stringify({ changes: changedFiles });
  const overlayChangesFile = path7.join(
@@ -130064,6 +130168,7 @@ var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
 var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
 var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
 var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
+var CODEQL_TOOLCACHE_INPUT = "toolcache";
 function getCodeQLBundleExtension(compressionMethod) {
  switch (compressionMethod) {
    case "gzip":
@@ -130242,6 +130347,31 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
      );
    }
+  } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) {
+    let latestToolcacheVersion;
+    const allowToolcacheValue = isDynamicWorkflow() || isInTestMode();
+    if (allowToolcacheValue) {
+      logger.info(
+        `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.`
+      );
+      latestToolcacheVersion = getLatestToolcacheVersion(logger);
+      if (latestToolcacheVersion) {
+        cliVersion2 = latestToolcacheVersion;
+      }
+    }
+    if (latestToolcacheVersion === void 0) {
+      if (allowToolcacheValue) {
+        logger.info(
+          `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`
+        );
+      } else {
+        logger.warning(
+          `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`
+        );
+      }
+      cliVersion2 = defaultCliVersion.cliVersion;
+      tagName = defaultCliVersion.tagName;
+    }
  } else if (toolsInput !== void 0) {
    tagName = tryGetTagNameFromUrl(toolsInput, logger);
    url2 = toolsInput;
@@ -130548,8 +130678,24 @@ async function getNightlyToolsUrl(logger) {
    );
  }
 }
+function getLatestToolcacheVersion(logger) {
+  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver7.compare(b, a));
+  logger.debug(
+    `Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
+      allVersions
+    )}.`
+  );
+  if (allVersions.length > 0) {
+    const latestToolcacheVersion = allVersions[0];
+    logger.info(
+      `CLI version ${latestToolcacheVersion} is the latest version in the toolcache.`
+    );
+    return latestToolcacheVersion;
+  }
+  return void 0;
+}
 function isReservedToolsValue(tools) {
-  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
+  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools) || tools === CODEQL_TOOLCACHE_INPUT;
 }

 // src/tracer-config.ts
@@ -130609,7 +130755,8 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
      zstdAvailability
    };
  } catch (e) {
-    const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") ? ConfigurationError : Error;
+    const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") || // out of disk space
+    e instanceof RequestError && e.status === 429 ? ConfigurationError : Error;
    throw new ErrorClass(
      `Unable to download and extract CodeQL CLI: ${getErrorMessage(e)}${e instanceof Error && e.stack ? `

@@ -130663,7 +130810,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
    async isScannedLanguage(language) {
      return !await this.isTracedLanguage(language);
    },
-    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
+    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, prDiffChangedFiles, logger) {
      const extraArgs = config.languages.map(
        (language) => `--language=${language}`
      );
@@ -130698,6 +130845,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
        const overlayChangesFile = await writeOverlayChangesFile(
          config,
          sourceRoot,
+          prDiffChangedFiles,
          logger
        );
        extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -131510,7 +131658,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
      action_ref: actionRef,
      action_started_at: actionStartedAt.toISOString(),
      action_version: getActionVersion(),
-      analysis_kinds: config?.analysisKinds.join(","),
+      analysis_kinds: config?.analysisKinds?.join(","),
      analysis_key,
      build_mode: config?.buildMode,
      commit_oid: commitOid,
@@ -131533,7 +131681,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
      logger.warning(`Could not determine the workflow event name: ${e}.`);
    }
    if (config) {
-      statusReport.languages = config.languages.join(",");
+      statusReport.languages = config.languages?.join(",");
    }
    if (diskInfo) {
      statusReport.runner_available_disk_space_bytes = diskInfo.numAvailableBytes;
@@ -131570,6 +131718,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -132208,7 +132359,7 @@ LongPrototype.greaterThanOrEqual = function greaterThanOrEqual(other) {
 };
 LongPrototype.gte = LongPrototype.greaterThanOrEqual;
 LongPrototype.ge = LongPrototype.greaterThanOrEqual;
-LongPrototype.compare = function compare(other) {
+LongPrototype.compare = function compare2(other) {
  if (!isLong(other)) other = fromValue(other);
  if (this.eq(other)) return 0;
  var thisNeg = this.isNegative(), otherNeg = other.isNegative();
@@ -132974,23 +133125,23 @@ function getAutomationID2(category, analysis_key, environment) {
  }
  return computeAutomationID(analysis_key, environment);
 }
-async function uploadPayload(payload, repositoryNwo, logger, target) {
+async function uploadPayload(payload, repositoryNwo, logger, analysis) {
  logger.info("Uploading results");
-  if (isInTestMode()) {
+  if (shouldSkipSarifUpload()) {
    const payloadSaveFile = path17.join(
      getTemporaryDirectory(),
-      "payload.json"
+      `payload-${analysis.kind}.json`
    );
    logger.info(
-      `In test mode. Results are not uploaded. Saving to ${payloadSaveFile}`
+      `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`
    );
    logger.info(`Payload: ${JSON.stringify(payload, null, 2)}`);
    fs17.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
-    return "test-mode-sarif-id";
+    return "dummy-sarif-id";
  }
  const client = getApiClient();
  try {
-    const response = await client.request(target, {
+    const response = await client.request(analysis.target, {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
      data: payload
@@ -133161,6 +133312,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
  logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
  const gitHubVersion = await getGitHubVersion();
  let sarif;
+  category = uploadTarget.fixCategory(logger, category);
  if (sarifPaths.length > 1) {
    for (const sarifPath of sarifPaths) {
      const parsedSarif = readSarifFile(sarifPath);
@@ -133223,7 +133375,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
    payload,
    getRepositoryNwo(),
    logger,
-    uploadTarget.target
+    uploadTarget
  );
  logger.endGroup();
  return {
@@ -133552,7 +133704,7 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
  const shouldUpload = getUploadInputOrThrow(workflow, jobName, matrix);
  if (!["always", "failure-only"].includes(
    getUploadValue(shouldUpload)
-  ) || isInTestMode()) {
+  ) || shouldSkipSarifUpload()) {
    return { upload_failed_run_skipped_because: "SARIF upload is disabled" };
  }
  const category = getCategoryInputOrThrow(workflow, jobName, matrix);
@@ -25121,8 +25121,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare;
+    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare2;
  }
 });

@@ -25130,8 +25130,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var rcompare = (a, b, loose) => compare(b, a, loose);
+    var compare2 = require_compare();
+    var rcompare = (a, b, loose) => compare2(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -25140,8 +25140,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var compareLoose = (a, b) => compare(a, b, true);
+    var compare2 = require_compare();
+    var compareLoose = (a, b) => compare2(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -25184,8 +25184,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gt = (a, b, loose) => compare(a, b, loose) > 0;
+    var compare2 = require_compare();
+    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -25194,8 +25194,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lt = (a, b, loose) => compare(a, b, loose) < 0;
+    var compare2 = require_compare();
+    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -25204,8 +25204,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var eq = (a, b, loose) => compare(a, b, loose) === 0;
+    var compare2 = require_compare();
+    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -25214,8 +25214,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var neq = (a, b, loose) => compare(a, b, loose) !== 0;
+    var compare2 = require_compare();
+    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -25224,8 +25224,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gte5 = (a, b, loose) => compare(a, b, loose) >= 0;
+    var compare2 = require_compare();
+    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -25234,8 +25234,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lte = (a, b, loose) => compare(a, b, loose) <= 0;
+    var compare2 = require_compare();
+    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -26131,12 +26131,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare(a, b, options));
+      const v = versions.sort((a, b) => compare2(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -26184,7 +26184,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -26244,7 +26244,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare(gt.semver, lt.semver, options);
+        gtltComp = compare2(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -26324,14 +26324,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -26355,7 +26355,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -26393,7 +26393,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare,
+      compare: compare2,
      rcompare,
      compareLoose,
      compareBuild,
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -26473,6 +26473,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -26493,7 +26494,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -26504,7 +26505,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -26517,7 +26518,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -30261,13 +30262,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare;
-    function compare(a, b, loose) {
+    exports2.compare = compare2;
+    function compare2(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare(a, b, true);
+      return compare2(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -30277,7 +30278,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare(b, a, loose);
+      return compare2(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -30293,27 +30294,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare(a, b, loose) > 0;
+      return compare2(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare(a, b, loose) < 0;
+      return compare2(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare(a, b, loose) === 0;
+      return compare2(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare(a, b, loose) !== 0;
+      return compare2(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare(a, b, loose) >= 0;
+      return compare2(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare(a, b, loose) <= 0;
+      return compare2(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -78493,12 +78494,41 @@ async function readBaseDatabaseOidsFile(config, logger) {
 function getBaseDatabaseOidsFilePath(config) {
  return path2.join(config.dbLocation, "base-database-oids.json");
 }
-async function writeOverlayChangesFile(config, sourceRoot, logger) {
+async function writeOverlayChangesFile(config, sourceRoot, prDiffChangedFiles, logger) {
  const baseFileOids = await readBaseDatabaseOidsFile(config, logger);
  const overlayFileOids = await getFileOidsUnderPath(sourceRoot);
  const changedFiles = computeChangedFiles(baseFileOids, overlayFileOids);
+  const originalCount = changedFiles.length;
+  let extraAddedCount = 0;
+  try {
+    if (prDiffChangedFiles && prDiffChangedFiles.size > 0) {
+      const existing = new Set(changedFiles);
+      for (const f of prDiffChangedFiles) {
+        if (!existing.has(f)) {
+          if (overlayFileOids[f] !== void 0 || fs2.existsSync(path2.join(sourceRoot, f))) {
+            existing.add(f);
+            changedFiles.push(f);
+            extraAddedCount++;
+          }
+        }
+      }
+      if (extraAddedCount > 0) {
+        logger.debug(
+          `Added ${extraAddedCount} file(s) from PR diff ranges into overlay: ${changedFiles.slice(-extraAddedCount).join(", ")}`
+        );
+      } else {
+        logger.debug(
+          "All diff range files were already present in the diff from the base database."
+        );
+      }
+    }
+  } catch (e) {
+    logger.debug(
+      `Failed while attempting to add diff range files in overlay: ${e.message || e}`
+    );
+  }
  logger.info(
-    `Found ${changedFiles.length} changed file(s) under ${sourceRoot}.`
+    `Found ${originalCount} natural changed file(s); added from diff ${extraAddedCount}; total ${changedFiles.length} under ${sourceRoot}.`
  );
  const changedFilesJson = JSON.stringify({ changes: changedFiles });
  const overlayChangesFile = path2.join(
@@ -78869,7 +78899,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
    async isScannedLanguage(language) {
      return !await this.isTracedLanguage(language);
    },
-    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
+    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, prDiffChangedFiles, logger) {
      const extraArgs = config.languages.map(
        (language) => `--language=${language}`
      );
@@ -78904,6 +78934,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
        const overlayChangesFile = await writeOverlayChangesFile(
          config,
          sourceRoot,
+          prDiffChangedFiles,
          logger
        );
        extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -79439,7 +79470,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
      action_ref: actionRef,
      action_started_at: actionStartedAt.toISOString(),
      action_version: getActionVersion(),
-      analysis_kinds: config?.analysisKinds.join(","),
+      analysis_kinds: config?.analysisKinds?.join(","),
      analysis_key,
      build_mode: config?.buildMode,
      commit_oid: commitOid,
@@ -79462,7 +79493,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
      logger.warning(`Could not determine the workflow event name: ${e}.`);
    }
    if (config) {
-      statusReport.languages = config.languages.join(",");
+      statusReport.languages = config.languages?.join(",");
    }
    if (diskInfo) {
      statusReport.runner_available_disk_space_bytes = diskInfo.numAvailableBytes;
@@ -79499,6 +79530,9 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
    );
+    if (isInTestMode()) {
+      throw e;
+    }
    return void 0;
  }
 }
@@ -25121,8 +25121,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare;
+    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare2;
  }
 });

@@ -25130,8 +25130,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var rcompare = (a, b, loose) => compare(b, a, loose);
+    var compare2 = require_compare();
+    var rcompare = (a, b, loose) => compare2(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -25140,8 +25140,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var compareLoose = (a, b) => compare(a, b, true);
+    var compare2 = require_compare();
+    var compareLoose = (a, b) => compare2(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -25184,8 +25184,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gt = (a, b, loose) => compare(a, b, loose) > 0;
+    var compare2 = require_compare();
+    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -25194,8 +25194,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lt = (a, b, loose) => compare(a, b, loose) < 0;
+    var compare2 = require_compare();
+    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -25204,8 +25204,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var eq = (a, b, loose) => compare(a, b, loose) === 0;
+    var compare2 = require_compare();
+    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -25214,8 +25214,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var neq = (a, b, loose) => compare(a, b, loose) !== 0;
+    var compare2 = require_compare();
+    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -25224,8 +25224,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gte5 = (a, b, loose) => compare(a, b, loose) >= 0;
+    var compare2 = require_compare();
+    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -25234,8 +25234,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lte = (a, b, loose) => compare(a, b, loose) <= 0;
+    var compare2 = require_compare();
+    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -26131,12 +26131,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare(a, b, options));
+      const v = versions.sort((a, b) => compare2(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -26184,7 +26184,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -26244,7 +26244,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare(gt.semver, lt.semver, options);
+        gtltComp = compare2(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -26324,14 +26324,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -26355,7 +26355,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -26393,7 +26393,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare,
+      compare: compare2,
      rcompare,
      compareLoose,
      compareBuild,
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -26473,6 +26473,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -26493,7 +26494,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -26504,7 +26505,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -26517,7 +26518,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -30261,13 +30262,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare;
-    function compare(a, b, loose) {
+    exports2.compare = compare2;
+    function compare2(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare(a, b, true);
+      return compare2(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -30277,7 +30278,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare(b, a, loose);
+      return compare2(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -30293,27 +30294,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare(a, b, loose) > 0;
+      return compare2(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare(a, b, loose) < 0;
+      return compare2(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare(a, b, loose) === 0;
+      return compare2(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare(a, b, loose) !== 0;
+      return compare2(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare(a, b, loose) >= 0;
+      return compare2(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare(a, b, loose) <= 0;
+      return compare2(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -94483,8 +94484,8 @@ var require_commonjs16 = __commonJS({
        if (rootPath === this.root.name) {
          return this.root;
        }
-        for (const [compare, root] of Object.entries(this.roots)) {
-          if (this.sameRoot(rootPath, compare)) {
+        for (const [compare2, root] of Object.entries(this.roots)) {
+          if (this.sameRoot(rootPath, compare2)) {
            return this.roots[rootPath] = root;
          }
        }
@@ -94493,9 +94494,9 @@ var require_commonjs16 = __commonJS({
      /**
       * @internal
       */
-      sameRoot(rootPath, compare = this.root.name) {
+      sameRoot(rootPath, compare2 = this.root.name) {
        rootPath = rootPath.toUpperCase().replace(/\//g, "\\").replace(uncDriveRegexp, "$1\\");
-        return rootPath === compare;
+        return rootPath === compare2;
      }
    };
    exports2.PathWin32 = PathWin32;
@@ -98514,7 +98515,7 @@ var require_b4a = __commonJS({
    function byteLength(string, encoding) {
      return Buffer.byteLength(string, encoding);
    }
-    function compare(a, b) {
+    function compare2(a, b) {
      return Buffer.compare(a, b);
    }
    function concat(buffers, totalLength) {
@@ -98615,7 +98616,7 @@ var require_b4a = __commonJS({
      allocUnsafe,
      allocUnsafeSlow,
      byteLength,
-      compare,
+      compare: compare2,
      concat,
      copy,
      equals,
@@ -21899,14 +21899,14 @@ var require_dist_node4 = __commonJS({
    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
    var dist_src_exports = {};
    __export2(dist_src_exports, {
-      RequestError: () => RequestError
+      RequestError: () => RequestError2
    });
    module2.exports = __toCommonJS2(dist_src_exports);
    var import_deprecation = require_dist_node3();
    var import_once = __toESM2(require_once());
    var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
    var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -21998,7 +21998,7 @@ var require_dist_node5 = __commonJS({
      const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
      return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
    }
-    var import_request_error = require_dist_node4();
+    var import_request_error2 = require_dist_node4();
    function getBufferResponse(response) {
      return response.arrayBuffer();
    }
@@ -22050,7 +22050,7 @@ var require_dist_node5 = __commonJS({
          if (status < 400) {
            return;
          }
-          throw new import_request_error.RequestError(response.statusText, status, {
+          throw new import_request_error2.RequestError(response.statusText, status, {
            response: {
              url: url2,
              status,
@@ -22061,7 +22061,7 @@ var require_dist_node5 = __commonJS({
          });
        }
        if (status === 304) {
-          throw new import_request_error.RequestError("Not modified", status, {
+          throw new import_request_error2.RequestError("Not modified", status, {
            response: {
              url: url2,
              status,
@@ -22073,7 +22073,7 @@ var require_dist_node5 = __commonJS({
        }
        if (status >= 400) {
          const data = await getResponseData(response);
-          const error2 = new import_request_error.RequestError(toErrorMessage(data), status, {
+          const error2 = new import_request_error2.RequestError(toErrorMessage(data), status, {
            response: {
              url: url2,
              status,
@@ -22093,7 +22093,7 @@ var require_dist_node5 = __commonJS({
          data
        };
      }).catch((error2) => {
-        if (error2 instanceof import_request_error.RequestError)
+        if (error2 instanceof import_request_error2.RequestError)
          throw error2;
        else if (error2.name === "AbortError")
          throw error2;
@@ -22105,7 +22105,7 @@ var require_dist_node5 = __commonJS({
            message = error2.cause;
          }
        }
-        throw new import_request_error.RequestError(message, 500, {
+        throw new import_request_error2.RequestError(message, 500, {
          request: requestOptions
        });
      });
@@ -22547,14 +22547,14 @@ var require_dist_node7 = __commonJS({
    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
    var dist_src_exports = {};
    __export2(dist_src_exports, {
-      RequestError: () => RequestError
+      RequestError: () => RequestError2
    });
    module2.exports = __toCommonJS2(dist_src_exports);
    var import_deprecation = require_dist_node3();
    var import_once = __toESM2(require_once());
    var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
    var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -22646,7 +22646,7 @@ var require_dist_node8 = __commonJS({
      const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
      return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
    }
-    var import_request_error = require_dist_node7();
+    var import_request_error2 = require_dist_node7();
    function getBufferResponse(response) {
      return response.arrayBuffer();
    }
@@ -22698,7 +22698,7 @@ var require_dist_node8 = __commonJS({
          if (status < 400) {
            return;
          }
-          throw new import_request_error.RequestError(response.statusText, status, {
+          throw new import_request_error2.RequestError(response.statusText, status, {
            response: {
              url: url2,
              status,
@@ -22709,7 +22709,7 @@ var require_dist_node8 = __commonJS({
          });
        }
        if (status === 304) {
-          throw new import_request_error.RequestError("Not modified", status, {
+          throw new import_request_error2.RequestError("Not modified", status, {
            response: {
              url: url2,
              status,
@@ -22721,7 +22721,7 @@ var require_dist_node8 = __commonJS({
        }
        if (status >= 400) {
          const data = await getResponseData(response);
-          const error2 = new import_request_error.RequestError(toErrorMessage(data), status, {
+          const error2 = new import_request_error2.RequestError(toErrorMessage(data), status, {
            response: {
              url: url2,
              status,
@@ -22741,7 +22741,7 @@ var require_dist_node8 = __commonJS({
          data
        };
      }).catch((error2) => {
-        if (error2 instanceof import_request_error.RequestError)
+        if (error2 instanceof import_request_error2.RequestError)
          throw error2;
        else if (error2.name === "AbortError")
          throw error2;
@@ -22753,7 +22753,7 @@ var require_dist_node8 = __commonJS({
            message = error2.cause;
          }
        }
-        throw new import_request_error.RequestError(message, 500, {
+        throw new import_request_error2.RequestError(message, 500, {
          request: requestOptions
        });
      });
@@ -26336,7 +26336,7 @@ var require_to_regex_range = __commonJS({
        stop = countZeros(max + 1, zeros) - 1;
      }
      stops = [...stops];
-      stops.sort(compare2);
+      stops.sort(compare3);
      return stops;
    }
    function rangeToPattern(start, stop, options) {
@@ -26408,7 +26408,7 @@ var require_to_regex_range = __commonJS({
      for (let i = 0; i < a.length; i++) arr.push([a[i], b[i]]);
      return arr;
    }
-    function compare2(a, b) {
+    function compare3(a, b) {
      return a > b ? 1 : b > a ? -1 : 0;
    }
    function contains(arr, key, val2) {
@@ -29446,11 +29446,11 @@ var require_out = __commonJS({
      async.read(path15, getSettings(optionsOrSettingsOrCallback), callback);
    }
    exports2.stat = stat;
-    function statSync2(path15, optionsOrSettings) {
+    function statSync3(path15, optionsOrSettings) {
      const settings = getSettings(optionsOrSettings);
      return sync.read(path15, settings);
    }
-    exports2.statSync = statSync2;
+    exports2.statSync = statSync3;
    function getSettings(settingsOrOptions = {}) {
      if (settingsOrOptions instanceof settings_1.default) {
        return settingsOrOptions;
@@ -32267,8 +32267,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare2;
+    var compare3 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare3;
  }
 });

@@ -32276,8 +32276,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var rcompare = (a, b, loose) => compare2(b, a, loose);
+    var compare3 = require_compare();
+    var rcompare = (a, b, loose) => compare3(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -32286,8 +32286,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var compareLoose = (a, b) => compare2(a, b, true);
+    var compare3 = require_compare();
+    var compareLoose = (a, b) => compare3(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -32330,8 +32330,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
+    var compare3 = require_compare();
+    var gt = (a, b, loose) => compare3(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -32340,8 +32340,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
+    var compare3 = require_compare();
+    var lt = (a, b, loose) => compare3(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -32350,8 +32350,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
+    var compare3 = require_compare();
+    var eq = (a, b, loose) => compare3(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -32360,8 +32360,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
+    var compare3 = require_compare();
+    var neq = (a, b, loose) => compare3(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -32370,8 +32370,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
+    var compare3 = require_compare();
+    var gte5 = (a, b, loose) => compare3(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -32380,8 +32380,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare2 = require_compare();
-    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
+    var compare3 = require_compare();
+    var lte = (a, b, loose) => compare3(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -33277,12 +33277,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare2 = require_compare();
+    var compare3 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare2(a, b, options));
+      const v = versions.sort((a, b) => compare3(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -33330,7 +33330,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare2 = require_compare();
+    var compare3 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -33390,7 +33390,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare2(gt.semver, lt.semver, options);
+        gtltComp = compare3(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -33470,14 +33470,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare2(a.semver, b.semver, options);
+      const comp = compare3(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare2(a.semver, b.semver, options);
+      const comp = compare3(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -33501,7 +33501,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare2 = require_compare();
+    var compare3 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -33539,7 +33539,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare: compare2,
+      compare: compare3,
      rcompare,
      compareLoose,
      compareBuild,
@@ -33584,7 +33584,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -33619,6 +33619,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -33639,7 +33640,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -33650,7 +33651,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -33663,7 +33664,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -35042,14 +35043,14 @@ var require_dist_node14 = __commonJS({
    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
    var dist_src_exports = {};
    __export2(dist_src_exports, {
-      RequestError: () => RequestError
+      RequestError: () => RequestError2
    });
    module2.exports = __toCommonJS2(dist_src_exports);
    var import_deprecation = require_dist_node3();
    var import_once = __toESM2(require_once());
    var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
    var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-    var RequestError = class extends Error {
+    var RequestError2 = class extends Error {
      constructor(message, statusCode, options) {
        super(message);
        if (Error.captureStackTrace) {
@@ -35151,7 +35152,7 @@ var require_dist_node15 = __commonJS({
      throw error2;
    }
    var import_light = __toESM2(require_light());
-    var import_request_error = require_dist_node14();
+    var import_request_error2 = require_dist_node14();
    async function wrapRequest(state, octokit, request, options) {
      const limiter = new import_light.default();
      limiter.on("failed", function(error2, info4) {
@@ -35172,7 +35173,7 @@ var require_dist_node15 = __commonJS({
      if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
        response.data.errors[0].message
      )) {
-        const error2 = new import_request_error.RequestError(response.data.errors[0].message, 500, {
+        const error2 = new import_request_error2.RequestError(response.data.errors[0].message, 500, {
          request: options,
          response
        });
@@ -37407,13 +37408,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare2;
-    function compare2(a, b, loose) {
+    exports2.compare = compare3;
+    function compare3(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare2(a, b, true);
+      return compare3(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -37423,7 +37424,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare2(b, a, loose);
+      return compare3(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -37439,27 +37440,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare2(a, b, loose) > 0;
+      return compare3(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare2(a, b, loose) < 0;
+      return compare3(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare2(a, b, loose) === 0;
+      return compare3(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare2(a, b, loose) !== 0;
+      return compare3(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare2(a, b, loose) >= 0;
+      return compare3(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare2(a, b, loose) <= 0;
+      return compare3(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -84821,6 +84822,7 @@ __export(upload_lib_exports, {
  InvalidSarifUploadError: () => InvalidSarifUploadError,
  buildPayload: () => buildPayload,
  findSarifFilesInDir: () => findSarifFilesInDir,
+  getGroupedSarifFilePaths: () => getGroupedSarifFilePaths,
  getSarifFilePaths: () => getSarifFilePaths,
  populateRunAutomationDetails: () => populateRunAutomationDetails,
  readSarifFile: () => readSarifFile,
@@ -88339,6 +88341,9 @@ function isGoodVersion(versionSpec) {
 function isInTestMode() {
  return process.env["CODEQL_ACTION_TEST_MODE" /* TEST_MODE */] === "true";
 }
+function shouldSkipSarifUpload() {
+  return isInTestMode() || process.env["CODEQL_ACTION_SKIP_SARIF_UPLOAD" /* SKIP_SARIF_UPLOAD */] === "true";
+}
 function getTestingEnvironment() {
  const testingEnvironment = process.env["CODEQL_ACTION_TESTING_ENVIRONMENT" /* TESTING_ENVIRONMENT */] || "";
  if (testingEnvironment === "") {
@@ -88473,6 +88478,12 @@ function getWorkflowRunAttempt() {
  }
  return workflowRunAttempt;
 }
+function isDynamicWorkflow() {
+  return getWorkflowEventName() === "dynamic";
+}
+function isDefaultSetup() {
+  return isDynamicWorkflow();
+}
 function prettyPrintInvocation(cmd, args) {
  return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
 }
@@ -88529,6 +88540,57 @@ async function runTool(cmd, args = [], opts = {}) {
  }
  return stdout;
 }
+var qualityCategoryMapping = {
+  "c#": "csharp",
+  cpp: "c-cpp",
+  c: "c-cpp",
+  "c++": "c-cpp",
+  java: "java-kotlin",
+  javascript: "javascript-typescript",
+  typescript: "javascript-typescript",
+  kotlin: "java-kotlin"
+};
+function fixCodeQualityCategory(logger, category) {
+  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
+    const language = category.substring("/language:".length);
+    const mappedLanguage = qualityCategoryMapping[language];
+    if (mappedLanguage) {
+      const newCategory = `/language:${mappedLanguage}`;
+      logger.info(
+        `Adjusted category for Code Quality from '${category}' to '${newCategory}'.`
+      );
+      return newCategory;
+    }
+  }
+  return category;
+}
+
+// src/analyses.ts
+var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
+  AnalysisKind2["CodeScanning"] = "code-scanning";
+  AnalysisKind2["CodeQuality"] = "code-quality";
+  return AnalysisKind2;
+})(AnalysisKind || {});
+var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
+var CodeScanning = {
+  kind: "code-scanning" /* CodeScanning */,
+  name: "code scanning",
+  target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
+  sarifExtension: ".sarif",
+  sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
+  fixCategory: (_, category) => category,
+  sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
+};
+var CodeQuality = {
+  kind: "code-quality" /* CodeQuality */,
+  name: "code quality",
+  target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
+  sarifExtension: ".quality.sarif",
+  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
+  fixCategory: fixCodeQualityCategory,
+  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
+};
+var SarifScanOrder = [CodeQuality, CodeScanning];

 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -88680,6 +88742,45 @@ var path12 = __toESM(require("path"));
 var core10 = __toESM(require_core());
 var toolrunner3 = __toESM(require_toolrunner());

+// node_modules/@octokit/request-error/dist-src/index.js
+var RequestError = class extends Error {
+  name;
+  /**
+   * http status code
+   */
+  status;
+  /**
+   * Request options that lead to the error.
+   */
+  request;
+  /**
+   * Response object if a response was received
+   */
+  response;
+  constructor(message, statusCode, options) {
+    super(message);
+    this.name = "HttpError";
+    this.status = Number.parseInt(statusCode);
+    if (Number.isNaN(this.status)) {
+      this.status = 0;
+    }
+    if ("response" in options) {
+      this.response = options.response;
+    }
+    const requestCopy = Object.assign({}, options.request);
+    if (options.request.headers.authorization) {
+      requestCopy.headers = Object.assign({}, options.request.headers, {
+        authorization: options.request.headers.authorization.replace(
+          /(?<! ) .*$/,
+          " [REDACTED]"
+        )
+      });
+    }
+    requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+    this.request = requestCopy;
+  }
+};
+
 // src/cli-errors.ts
 var SUPPORTED_PLATFORMS = [
  ["linux", "x64"],
@@ -88921,14 +89022,6 @@ function wrapCliConfigurationError(cliError) {
 var fs7 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));

-// src/analyses.ts
-var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
-  AnalysisKind2["CodeScanning"] = "code-scanning";
-  AnalysisKind2["CodeQuality"] = "code-quality";
-  return AnalysisKind2;
-})(AnalysisKind || {});
-var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
-
 // src/caching-utils.ts
 var core6 = __toESM(require_core());

@@ -88949,8 +89042,8 @@ var path8 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());

 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.1";
-var cliVersion = "2.23.1";
+var bundleVersion = "codeql-bundle-v2.23.2";
+var cliVersion = "2.23.2";

 // src/overlay-database-utils.ts
 var fs5 = __toESM(require("fs"));
@@ -89196,12 +89289,41 @@ async function readBaseDatabaseOidsFile(config, logger) {
 function getBaseDatabaseOidsFilePath(config) {
  return path7.join(config.dbLocation, "base-database-oids.json");
 }
-async function writeOverlayChangesFile(config, sourceRoot, logger) {
+async function writeOverlayChangesFile(config, sourceRoot, prDiffChangedFiles, logger) {
  const baseFileOids = await readBaseDatabaseOidsFile(config, logger);
  const overlayFileOids = await getFileOidsUnderPath(sourceRoot);
  const changedFiles = computeChangedFiles(baseFileOids, overlayFileOids);
+  const originalCount = changedFiles.length;
+  let extraAddedCount = 0;
+  try {
+    if (prDiffChangedFiles && prDiffChangedFiles.size > 0) {
+      const existing = new Set(changedFiles);
+      for (const f of prDiffChangedFiles) {
+        if (!existing.has(f)) {
+          if (overlayFileOids[f] !== void 0 || fs5.existsSync(path7.join(sourceRoot, f))) {
+            existing.add(f);
+            changedFiles.push(f);
+            extraAddedCount++;
+          }
+        }
+      }
+      if (extraAddedCount > 0) {
+        logger.debug(
+          `Added ${extraAddedCount} file(s) from PR diff ranges into overlay: ${changedFiles.slice(-extraAddedCount).join(", ")}`
+        );
+      } else {
+        logger.debug(
+          "All diff range files were already present in the diff from the base database."
+        );
+      }
+    }
+  } catch (e) {
+    logger.debug(
+      `Failed while attempting to add diff range files in overlay: ${e.message || e}`
+    );
+  }
  logger.info(
-    `Found ${changedFiles.length} changed file(s) under ${sourceRoot}.`
+    `Found ${originalCount} natural changed file(s); added from diff ${extraAddedCount}; total ${changedFiles.length} under ${sourceRoot}.`
  );
  const changedFilesJson = JSON.stringify({ changes: changedFiles });
  const overlayChangesFile = path7.join(
@@ -89880,6 +90002,7 @@ var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
 var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
 var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"];
 var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
+var CODEQL_TOOLCACHE_INPUT = "toolcache";
 function getCodeQLBundleExtension(compressionMethod) {
  switch (compressionMethod) {
    case "gzip":
@@ -90058,6 +90181,31 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
      );
    }
+  } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) {
+    let latestToolcacheVersion;
+    const allowToolcacheValue = isDynamicWorkflow() || isInTestMode();
+    if (allowToolcacheValue) {
+      logger.info(
+        `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.`
+      );
+      latestToolcacheVersion = getLatestToolcacheVersion(logger);
+      if (latestToolcacheVersion) {
+        cliVersion2 = latestToolcacheVersion;
+      }
+    }
+    if (latestToolcacheVersion === void 0) {
+      if (allowToolcacheValue) {
+        logger.info(
+          `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`
+        );
+      } else {
+        logger.warning(
+          `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`
+        );
+      }
+      cliVersion2 = defaultCliVersion.cliVersion;
+      tagName = defaultCliVersion.tagName;
+    }
  } else if (toolsInput !== void 0) {
    tagName = tryGetTagNameFromUrl(toolsInput, logger);
    url2 = toolsInput;
@@ -90364,8 +90512,24 @@ async function getNightlyToolsUrl(logger) {
    );
  }
 }
+function getLatestToolcacheVersion(logger) {
+  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver7.compare(b, a));
+  logger.debug(
+    `Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
+      allVersions
+    )}.`
+  );
+  if (allVersions.length > 0) {
+    const latestToolcacheVersion = allVersions[0];
+    logger.info(
+      `CLI version ${latestToolcacheVersion} is the latest version in the toolcache.`
+    );
+    return latestToolcacheVersion;
+  }
+  return void 0;
+}
 function isReservedToolsValue(tools) {
-  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools);
+  return CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) || CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools) || tools === CODEQL_TOOLCACHE_INPUT;
 }

 // src/tracer-config.ts
@@ -90425,7 +90589,8 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
      zstdAvailability
    };
  } catch (e) {
-    const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") ? ConfigurationError : Error;
+    const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") || // out of disk space
+    e instanceof RequestError && e.status === 429 ? ConfigurationError : Error;
    throw new ErrorClass(
      `Unable to download and extract CodeQL CLI: ${getErrorMessage(e)}${e instanceof Error && e.stack ? `

@@ -90479,7 +90644,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
    async isScannedLanguage(language) {
      return !await this.isTracedLanguage(language);
    },
-    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
+    async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, prDiffChangedFiles, logger) {
      const extraArgs = config.languages.map(
        (language) => `--language=${language}`
      );
@@ -90514,6 +90679,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
        const overlayChangesFile = await writeOverlayChangesFile(
          config,
          sourceRoot,
+          prDiffChangedFiles,
          logger
        );
        extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -91552,7 +91718,7 @@ LongPrototype.greaterThanOrEqual = function greaterThanOrEqual(other) {
 };
 LongPrototype.gte = LongPrototype.greaterThanOrEqual;
 LongPrototype.ge = LongPrototype.greaterThanOrEqual;
-LongPrototype.compare = function compare(other) {
+LongPrototype.compare = function compare2(other) {
  if (!isLong(other)) other = fromValue(other);
  if (this.eq(other)) return 0;
  var thisNeg = this.isNegative(), otherNeg = other.isNegative();
@@ -92318,23 +92484,23 @@ function getAutomationID2(category, analysis_key, environment) {
  }
  return computeAutomationID(analysis_key, environment);
 }
-async function uploadPayload(payload, repositoryNwo, logger, target) {
+async function uploadPayload(payload, repositoryNwo, logger, analysis) {
  logger.info("Uploading results");
-  if (isInTestMode()) {
+  if (shouldSkipSarifUpload()) {
    const payloadSaveFile = path14.join(
      getTemporaryDirectory(),
-      "payload.json"
+      `payload-${analysis.kind}.json`
    );
    logger.info(
-      `In test mode. Results are not uploaded. Saving to ${payloadSaveFile}`
+      `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`
    );
    logger.info(`Payload: ${JSON.stringify(payload, null, 2)}`);
    fs13.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
-    return "test-mode-sarif-id";
+    return "dummy-sarif-id";
  }
  const client = getApiClient();
  try {
-    const response = await client.request(target, {
+    const response = await client.request(analysis.target, {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
      data: payload
@@ -92391,6 +92557,54 @@ function getSarifFilePaths(sarifPath, isSarif) {
  }
  return sarifFiles;
 }
+async function getGroupedSarifFilePaths(logger, sarifPath) {
+  const stats = fs13.statSync(sarifPath, { throwIfNoEntry: false });
+  if (stats === void 0) {
+    throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
+  }
+  const results = {};
+  if (stats.isDirectory()) {
+    let unassignedSarifFiles = findSarifFilesInDir(
+      sarifPath,
+      (name) => path14.extname(name) === ".sarif"
+    );
+    logger.debug(
+      `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}`
+    );
+    for (const analysisConfig of SarifScanOrder) {
+      const filesForCurrentAnalysis = unassignedSarifFiles.filter(
+        analysisConfig.sarifPredicate
+      );
+      if (filesForCurrentAnalysis.length > 0) {
+        logger.debug(
+          `The following SARIF files are for ${analysisConfig.name}: ${filesForCurrentAnalysis.join(", ")}`
+        );
+        unassignedSarifFiles = unassignedSarifFiles.filter(
+          (name) => !analysisConfig.sarifPredicate(name)
+        );
+        results[analysisConfig.kind] = filesForCurrentAnalysis;
+      } else {
+        logger.debug(`Found no SARIF files for ${analysisConfig.name}`);
+      }
+    }
+    if (unassignedSarifFiles.length !== 0) {
+      logger.warning(
+        `Found files in ${sarifPath} which do not belong to any analysis: ${unassignedSarifFiles.join(", ")}`
+      );
+    }
+  } else {
+    for (const analysisConfig of SarifScanOrder) {
+      if (analysisConfig.kind === "code-scanning" /* CodeScanning */ || analysisConfig.sarifPredicate(sarifPath)) {
+        logger.debug(
+          `Using '${sarifPath}' as a SARIF file for ${analysisConfig.name}.`
+        );
+        results[analysisConfig.kind] = [sarifPath];
+        break;
+      }
+    }
+  }
+  return results;
+}
 function countResultsInSarif(sarif) {
  let numResults = 0;
  const parsedSarif = JSON.parse(sarif);
@@ -92505,6 +92719,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
  logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
  const gitHubVersion = await getGitHubVersion();
  let sarif;
+  category = uploadTarget.fixCategory(logger, category);
  if (sarifPaths.length > 1) {
    for (const sarifPath of sarifPaths) {
      const parsedSarif = readSarifFile(sarifPath);
@@ -92567,7 +92782,7 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
    payload,
    getRepositoryNwo(),
    logger,
-    uploadTarget.target
+    uploadTarget
  );
  logger.endGroup();
  return {
@@ -92750,6 +92965,7 @@ function filterAlertsByDiffRange(logger, sarif) {
  InvalidSarifUploadError,
  buildPayload,
  findSarifFilesInDir,
+  getGroupedSarifFilePaths,
  getSarifFilePaths,
  populateRunAutomationDetails,
  readSarifFile,
@@ -25121,8 +25121,8 @@ var require_compare = __commonJS({
  "node_modules/semver/functions/compare.js"(exports2, module2) {
    "use strict";
    var SemVer = require_semver();
-    var compare = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
-    module2.exports = compare;
+    var compare2 = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+    module2.exports = compare2;
  }
 });

@@ -25130,8 +25130,8 @@ var require_compare = __commonJS({
 var require_rcompare = __commonJS({
  "node_modules/semver/functions/rcompare.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var rcompare = (a, b, loose) => compare(b, a, loose);
+    var compare2 = require_compare();
+    var rcompare = (a, b, loose) => compare2(b, a, loose);
    module2.exports = rcompare;
  }
 });
@@ -25140,8 +25140,8 @@ var require_rcompare = __commonJS({
 var require_compare_loose = __commonJS({
  "node_modules/semver/functions/compare-loose.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var compareLoose = (a, b) => compare(a, b, true);
+    var compare2 = require_compare();
+    var compareLoose = (a, b) => compare2(a, b, true);
    module2.exports = compareLoose;
  }
 });
@@ -25184,8 +25184,8 @@ var require_rsort = __commonJS({
 var require_gt = __commonJS({
  "node_modules/semver/functions/gt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gt = (a, b, loose) => compare(a, b, loose) > 0;
+    var compare2 = require_compare();
+    var gt = (a, b, loose) => compare2(a, b, loose) > 0;
    module2.exports = gt;
  }
 });
@@ -25194,8 +25194,8 @@ var require_gt = __commonJS({
 var require_lt = __commonJS({
  "node_modules/semver/functions/lt.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lt = (a, b, loose) => compare(a, b, loose) < 0;
+    var compare2 = require_compare();
+    var lt = (a, b, loose) => compare2(a, b, loose) < 0;
    module2.exports = lt;
  }
 });
@@ -25204,8 +25204,8 @@ var require_lt = __commonJS({
 var require_eq = __commonJS({
  "node_modules/semver/functions/eq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var eq = (a, b, loose) => compare(a, b, loose) === 0;
+    var compare2 = require_compare();
+    var eq = (a, b, loose) => compare2(a, b, loose) === 0;
    module2.exports = eq;
  }
 });
@@ -25214,8 +25214,8 @@ var require_eq = __commonJS({
 var require_neq = __commonJS({
  "node_modules/semver/functions/neq.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var neq = (a, b, loose) => compare(a, b, loose) !== 0;
+    var compare2 = require_compare();
+    var neq = (a, b, loose) => compare2(a, b, loose) !== 0;
    module2.exports = neq;
  }
 });
@@ -25224,8 +25224,8 @@ var require_neq = __commonJS({
 var require_gte = __commonJS({
  "node_modules/semver/functions/gte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var gte5 = (a, b, loose) => compare(a, b, loose) >= 0;
+    var compare2 = require_compare();
+    var gte5 = (a, b, loose) => compare2(a, b, loose) >= 0;
    module2.exports = gte5;
  }
 });
@@ -25234,8 +25234,8 @@ var require_gte = __commonJS({
 var require_lte = __commonJS({
  "node_modules/semver/functions/lte.js"(exports2, module2) {
    "use strict";
-    var compare = require_compare();
-    var lte = (a, b, loose) => compare(a, b, loose) <= 0;
+    var compare2 = require_compare();
+    var lte = (a, b, loose) => compare2(a, b, loose) <= 0;
    module2.exports = lte;
  }
 });
@@ -26131,12 +26131,12 @@ var require_simplify = __commonJS({
  "node_modules/semver/ranges/simplify.js"(exports2, module2) {
    "use strict";
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    module2.exports = (versions, range, options) => {
      const set2 = [];
      let first = null;
      let prev = null;
-      const v = versions.sort((a, b) => compare(a, b, options));
+      const v = versions.sort((a, b) => compare2(a, b, options));
      for (const version of v) {
        const included = satisfies2(version, range, options);
        if (included) {
@@ -26184,7 +26184,7 @@ var require_subset = __commonJS({
    var Comparator = require_comparator();
    var { ANY } = Comparator;
    var satisfies2 = require_satisfies();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var subset = (sub, dom, options = {}) => {
      if (sub === dom) {
        return true;
@@ -26244,7 +26244,7 @@ var require_subset = __commonJS({
      }
      let gtltComp;
      if (gt && lt) {
-        gtltComp = compare(gt.semver, lt.semver, options);
+        gtltComp = compare2(gt.semver, lt.semver, options);
        if (gtltComp > 0) {
          return null;
        } else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) {
@@ -26324,14 +26324,14 @@ var require_subset = __commonJS({
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
    };
    var lowerLT = (a, b, options) => {
      if (!a) {
        return b;
      }
-      const comp = compare(a.semver, b.semver, options);
+      const comp = compare2(a.semver, b.semver, options);
      return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
    };
    module2.exports = subset;
@@ -26355,7 +26355,7 @@ var require_semver2 = __commonJS({
    var minor = require_minor();
    var patch = require_patch();
    var prerelease = require_prerelease();
-    var compare = require_compare();
+    var compare2 = require_compare();
    var rcompare = require_rcompare();
    var compareLoose = require_compare_loose();
    var compareBuild = require_compare_build();
@@ -26393,7 +26393,7 @@ var require_semver2 = __commonJS({
      minor,
      patch,
      prerelease,
-      compare,
+      compare: compare2,
      rcompare,
      compareLoose,
      compareBuild,
@@ -26438,7 +26438,7 @@ var require_package = __commonJS({
  "package.json"(exports2, module2) {
    module2.exports = {
      name: "codeql",
-      version: "3.30.6",
+      version: "4.30.8",
      private: true,
      description: "CodeQL action",
      scripts: {
@@ -26473,6 +26473,7 @@ var require_package = __commonJS({
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        archiver: "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -26493,7 +26494,7 @@ var require_package = __commonJS({
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -26504,7 +26505,7 @@ var require_package = __commonJS({
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        ava: "^6.4.1",
        esbuild: "^0.25.10",
@@ -26517,7 +26518,7 @@ var require_package = __commonJS({
        glob: "^11.0.3",
        nock: "^14.0.10",
        sinon: "^21.0.0",
-        typescript: "^5.9.2"
+        typescript: "^5.9.3"
      },
      overrides: {
        "@actions/tool-cache": {
@@ -88567,8 +88568,8 @@ var require_commonjs16 = __commonJS({
        if (rootPath === this.root.name) {
          return this.root;
        }
-        for (const [compare, root] of Object.entries(this.roots)) {
-          if (this.sameRoot(rootPath, compare)) {
+        for (const [compare2, root] of Object.entries(this.roots)) {
+          if (this.sameRoot(rootPath, compare2)) {
            return this.roots[rootPath] = root;
          }
        }
@@ -88577,9 +88578,9 @@ var require_commonjs16 = __commonJS({
      /**
       * @internal
       */
-      sameRoot(rootPath, compare = this.root.name) {
+      sameRoot(rootPath, compare2 = this.root.name) {
        rootPath = rootPath.toUpperCase().replace(/\//g, "\\").replace(uncDriveRegexp, "$1\\");
-        return rootPath === compare;
+        return rootPath === compare2;
      }
    };
    exports2.PathWin32 = PathWin32;
@@ -92598,7 +92599,7 @@ var require_b4a = __commonJS({
    function byteLength(string, encoding) {
      return Buffer.byteLength(string, encoding);
    }
-    function compare(a, b) {
+    function compare2(a, b) {
      return Buffer.compare(a, b);
    }
    function concat(buffers, totalLength) {
@@ -92699,7 +92700,7 @@ var require_b4a = __commonJS({
      allocUnsafe,
      allocUnsafeSlow,
      byteLength,
-      compare,
+      compare: compare2,
      concat,
      copy,
      equals,
@@ -108085,13 +108086,13 @@ var require_semver3 = __commonJS({
    function patch(a, loose) {
      return new SemVer(a, loose).patch;
    }
-    exports2.compare = compare;
-    function compare(a, b, loose) {
+    exports2.compare = compare2;
+    function compare2(a, b, loose) {
      return new SemVer(a, loose).compare(new SemVer(b, loose));
    }
    exports2.compareLoose = compareLoose;
    function compareLoose(a, b) {
-      return compare(a, b, true);
+      return compare2(a, b, true);
    }
    exports2.compareBuild = compareBuild;
    function compareBuild(a, b, loose) {
@@ -108101,7 +108102,7 @@ var require_semver3 = __commonJS({
    }
    exports2.rcompare = rcompare;
    function rcompare(a, b, loose) {
-      return compare(b, a, loose);
+      return compare2(b, a, loose);
    }
    exports2.sort = sort;
    function sort(list, loose) {
@@ -108117,27 +108118,27 @@ var require_semver3 = __commonJS({
    }
    exports2.gt = gt;
    function gt(a, b, loose) {
-      return compare(a, b, loose) > 0;
+      return compare2(a, b, loose) > 0;
    }
    exports2.lt = lt;
    function lt(a, b, loose) {
-      return compare(a, b, loose) < 0;
+      return compare2(a, b, loose) < 0;
    }
    exports2.eq = eq;
    function eq(a, b, loose) {
-      return compare(a, b, loose) === 0;
+      return compare2(a, b, loose) === 0;
    }
    exports2.neq = neq;
    function neq(a, b, loose) {
-      return compare(a, b, loose) !== 0;
+      return compare2(a, b, loose) !== 0;
    }
    exports2.gte = gte5;
    function gte5(a, b, loose) {
-      return compare(a, b, loose) >= 0;
+      return compare2(a, b, loose) >= 0;
    }
    exports2.lte = lte;
    function lte(a, b, loose) {
-      return compare(a, b, loose) <= 0;
+      return compare2(a, b, loose) <= 0;
    }
    exports2.cmp = cmp;
    function cmp(a, op, b, loose) {
@@ -117619,7 +117620,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion
      if (fs.existsSync(baseTempDir)) {
        const outputDirs = fs.readdirSync(baseTempDir);
        for (const outputDir of outputDirs) {
-          const sarifFiles = fs.readdirSync(path.resolve(baseTempDir, outputDir)).filter((f) => f.endsWith(".sarif"));
+          const sarifFiles = fs.readdirSync(path.resolve(baseTempDir, outputDir)).filter((f) => path.extname(f) === ".sarif");
          for (const sarifFile of sarifFiles) {
            toUpload.push(path.resolve(baseTempDir, outputDir, sarifFile));
          }
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "3.30.6",
+  "version": "4.30.8",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "3.30.6",
+      "version": "4.30.8",
      "license": "MIT",
      "dependencies": {
        "@actions/artifact": "^2.3.1",
@@ -20,6 +20,7 @@
        "@actions/io": "^1.1.3",
        "@actions/tool-cache": "^2.0.2",
        "@octokit/plugin-retry": "^6.0.0",
+        "@octokit/request-error": "^7.0.1",
        "@schemastore/package": "0.0.10",
        "archiver": "^7.0.1",
        "check-disk-space": "^3.4.0",
@@ -40,7 +41,7 @@
        "@ava/typescript": "6.0.0",
        "@eslint/compat": "^1.4.0",
        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "^9.36.0",
+        "@eslint/js": "^9.37.0",
        "@microsoft/eslint-formatter-sarif": "^3.1.0",
        "@octokit/types": "^15.0.0",
        "@types/archiver": "^6.0.3",
@@ -51,7 +52,7 @@
        "@types/node-forge": "^1.3.14",
        "@types/semver": "^7.7.1",
        "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.45.0",
        "@typescript-eslint/parser": "^8.41.0",
        "ava": "^6.4.1",
        "esbuild": "^0.25.10",
@@ -64,7 +65,7 @@
        "glob": "^11.0.3",
        "nock": "^14.0.10",
        "sinon": "^21.0.0",
-        "typescript": "^5.9.2"
+        "typescript": "^5.9.3"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -1346,9 +1347,9 @@
      }
    },
    "node_modules/@eslint/js": {
-      "version": "9.36.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.36.0.tgz",
-      "integrity": "sha512-uhCbYtYynH30iZErszX78U+nR3pJU3RHGQ57NXy5QupD4SBVwDeU8TNBy+MjMngc1UyIW9noKqsRqfjQTBU2dw==",
+      "version": "9.37.0",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.37.0.tgz",
+      "integrity": "sha512-jaS+NJ+hximswBG6pjNX0uEJZkrT0zwpVi3BA3vX22aFGjJjmgSTSmPpZCRKmoBL5VY/M6p0xsSJx7rk7sy5gg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2175,7 +2176,6 @@
      "version": "26.0.0",
      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-26.0.0.tgz",
      "integrity": "sha512-7AtcfKtpo77j7Ts73b4OWhOZHTKo/gGY8bB3bNBQz4H+GRSWqx2yvj8TXRsbdTE0eRmYmXOEY66jM7mJ7LzfsA==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/@octokit/openapi-webhooks-types": {
@@ -2299,31 +2299,17 @@
      }
    },
    "node_modules/@octokit/request-error": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.0.0.tgz",
-      "integrity": "sha512-KRA7VTGdVyJlh0cP5Tf94hTiYVVqmt2f3I6mnimmaVz4UG3gQV/k4mDJlJv3X67iX6rmN7gSHCF8ssqeMnmhZg==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.0.1.tgz",
+      "integrity": "sha512-CZpFwV4+1uBrxu7Cw8E5NCXDWFNf18MSY23TdxCBgjw1tXXHvTrZVsXlW8hgFTOLw8RQR1BBrMvYRtuyaijHMA==",
+      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^14.0.0"
+        "@octokit/types": "^15.0.0"
      },
      "engines": {
        "node": ">= 20"
      }
    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
-      "integrity": "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.1.0.tgz",
-      "integrity": "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^25.1.0"
-      }
-    },
    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
      "version": "25.1.0",
      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
@@ -2348,7 +2334,6 @@
      "version": "15.0.0",
      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-15.0.0.tgz",
      "integrity": "sha512-8o6yDfmoGJUIeR9OfYU0/TUJTnMPG2r68+1yEdUeG2Fdqpj8Qetg0ziKIgcBm0RW/j29H41WP37CYCEhp6GoHQ==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@octokit/openapi-types": "^26.0.0"
@@ -2712,17 +2697,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.44.1.tgz",
-      "integrity": "sha512-molgphGqOBT7t4YKCSkbasmu1tb1MgrZ2szGzHbclF7PNmOkSTQVHy+2jXOSnxvR3+Xe1yySHFZoqMpz3TfQsw==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.45.0.tgz",
+      "integrity": "sha512-HC3y9CVuevvWCl/oyZuI47dOeDF9ztdMEfMH8/DW/Mhwa9cCLnK1oD7JoTVGW/u7kFzNZUKUoyJEqkaJh5y3Wg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/type-utils": "8.44.1",
-        "@typescript-eslint/utils": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/scope-manager": "8.45.0",
+        "@typescript-eslint/type-utils": "8.45.0",
+        "@typescript-eslint/utils": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0",
        "graphemer": "^1.4.0",
        "ignore": "^7.0.0",
        "natural-compare": "^1.4.0",
@@ -2736,20 +2721,20 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.44.1",
+        "@typescript-eslint/parser": "^8.45.0",
        "eslint": "^8.57.0 || ^9.0.0",
        "typescript": ">=4.8.4 <6.0.0"
      }
    },
    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz",
-      "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.45.0.tgz",
+      "integrity": "sha512-clmm8XSNj/1dGvJeO6VGH7EUSeA0FMs+5au/u3lrA3KfG8iJ4u8ym9/j2tTEoacAffdW1TVUzXO30W1JTJS7dA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1"
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2760,9 +2745,9 @@
      }
    },
    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.45.0.tgz",
+      "integrity": "sha512-WugXLuOIq67BMgQInIxxnsSyRLFxdkJEJu8r4ngLR56q/4Q5LrbfkFRH27vMTjxEK8Pyz7QfzuZe/G15qQnVRA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2774,16 +2759,16 @@
      }
    },
    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz",
-      "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.45.0.tgz",
+      "integrity": "sha512-GfE1NfVbLam6XQ0LcERKwdTTPlLvHvXXhOeUGC1OXi4eQBoyy1iVsW+uzJ/J9jtCz6/7GCQ9MtrQ0fml/jWCnA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.44.1",
-        "@typescript-eslint/tsconfig-utils": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/project-service": "8.45.0",
+        "@typescript-eslint/tsconfig-utils": "8.45.0",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0",
        "debug": "^4.3.4",
        "fast-glob": "^3.3.2",
        "is-glob": "^4.0.3",
@@ -2803,16 +2788,16 @@
      }
    },
    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.1.tgz",
-      "integrity": "sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.45.0.tgz",
+      "integrity": "sha512-bxi1ht+tLYg4+XV2knz/F7RVhU0k6VrSMc9sb8DQ6fyCTrGQLHfo7lDtN0QJjZjKkLA2ThrKuCdHEvLReqtIGg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.7.0",
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1"
+        "@typescript-eslint/scope-manager": "8.45.0",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/typescript-estree": "8.45.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2827,13 +2812,13 @@
      }
    },
    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz",
-      "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.45.0.tgz",
+      "integrity": "sha512-qsaFBA3e09MIDAGFUrTk+dzqtfv1XPVz8t8d1f0ybTzrCY7BKiMC5cjrl1O/P7UmHsNyW90EYSkU/ZWpmXelag==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
+        "@typescript-eslint/types": "8.45.0",
        "eslint-visitor-keys": "^4.2.1"
      },
      "engines": {
@@ -2906,16 +2891,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.44.1.tgz",
-      "integrity": "sha512-EHrrEsyhOhxYt8MTg4zTF+DJMuNBzWwgvvOYNj/zm1vnaD/IC5zCXFehZv94Piqa2cRFfXrTFxIvO95L7Qc/cw==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.45.0.tgz",
+      "integrity": "sha512-TGf22kon8KW+DeKaUmOibKWktRY8b2NSAZNdtWh798COm1NWx8+xJ6iFBtk3IvLdv6+LGLJLRlyhrhEDZWargQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/scope-manager": "8.45.0",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/typescript-estree": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0",
        "debug": "^4.3.4"
      },
      "engines": {
@@ -2931,14 +2916,14 @@
      }
    },
    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz",
-      "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.45.0.tgz",
+      "integrity": "sha512-clmm8XSNj/1dGvJeO6VGH7EUSeA0FMs+5au/u3lrA3KfG8iJ4u8ym9/j2tTEoacAffdW1TVUzXO30W1JTJS7dA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1"
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2949,9 +2934,9 @@
      }
    },
    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.45.0.tgz",
+      "integrity": "sha512-WugXLuOIq67BMgQInIxxnsSyRLFxdkJEJu8r4ngLR56q/4Q5LrbfkFRH27vMTjxEK8Pyz7QfzuZe/G15qQnVRA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2963,16 +2948,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz",
-      "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.45.0.tgz",
+      "integrity": "sha512-GfE1NfVbLam6XQ0LcERKwdTTPlLvHvXXhOeUGC1OXi4eQBoyy1iVsW+uzJ/J9jtCz6/7GCQ9MtrQ0fml/jWCnA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.44.1",
-        "@typescript-eslint/tsconfig-utils": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/project-service": "8.45.0",
+        "@typescript-eslint/tsconfig-utils": "8.45.0",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0",
        "debug": "^4.3.4",
        "fast-glob": "^3.3.2",
        "is-glob": "^4.0.3",
@@ -2992,13 +2977,13 @@
      }
    },
    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz",
-      "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.45.0.tgz",
+      "integrity": "sha512-qsaFBA3e09MIDAGFUrTk+dzqtfv1XPVz8t8d1f0ybTzrCY7BKiMC5cjrl1O/P7UmHsNyW90EYSkU/ZWpmXelag==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
+        "@typescript-eslint/types": "8.45.0",
        "eslint-visitor-keys": "^4.2.1"
      },
      "engines": {
@@ -3062,14 +3047,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.44.1.tgz",
-      "integrity": "sha512-ycSa60eGg8GWAkVsKV4E6Nz33h+HjTXbsDT4FILyL8Obk5/mx4tbvCNsLf9zret3ipSumAOG89UcCs/KRaKYrA==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.45.0.tgz",
+      "integrity": "sha512-3pcVHwMG/iA8afdGLMuTibGR7pDsn9RjDev6CCB+naRsSYs2pns5QbinF4Xqw6YC/Sj3lMrm/Im0eMfaa61WUg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.44.1",
-        "@typescript-eslint/types": "^8.44.1",
+        "@typescript-eslint/tsconfig-utils": "^8.45.0",
+        "@typescript-eslint/types": "^8.45.0",
        "debug": "^4.3.4"
      },
      "engines": {
@@ -3084,9 +3069,9 @@
      }
    },
    "node_modules/@typescript-eslint/project-service/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.45.0.tgz",
+      "integrity": "sha512-WugXLuOIq67BMgQInIxxnsSyRLFxdkJEJu8r4ngLR56q/4Q5LrbfkFRH27vMTjxEK8Pyz7QfzuZe/G15qQnVRA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -3116,9 +3101,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.44.1.tgz",
-      "integrity": "sha512-B5OyACouEjuIvof3o86lRMvyDsFwZm+4fBOqFHccIctYgBjqR3qT39FBYGN87khcgf0ExpdCBeGKpKRhSFTjKQ==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.45.0.tgz",
+      "integrity": "sha512-aFdr+c37sc+jqNMGhH+ajxPXwjv9UtFZk79k8pLoJ6p4y0snmYpPA52GuWHgt2ZF4gRRW6odsEj41uZLojDt5w==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -3133,15 +3118,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.44.1.tgz",
-      "integrity": "sha512-KdEerZqHWXsRNKjF9NYswNISnFzXfXNDfPxoTh7tqohU/PRIbwTmsjGK6V9/RTYWau7NZvfo52lgVk+sJh0K3g==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.45.0.tgz",
+      "integrity": "sha512-bpjepLlHceKgyMEPglAeULX1vixJDgaKocp0RVJ5u4wLJIMNuKtUXIczpJCPcn2waII0yuvks/5m5/h3ZQKs0A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1",
-        "@typescript-eslint/utils": "8.44.1",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/typescript-estree": "8.45.0",
+        "@typescript-eslint/utils": "8.45.0",
        "debug": "^4.3.4",
        "ts-api-utils": "^2.1.0"
      },
@@ -3158,14 +3143,14 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz",
-      "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.45.0.tgz",
+      "integrity": "sha512-clmm8XSNj/1dGvJeO6VGH7EUSeA0FMs+5au/u3lrA3KfG8iJ4u8ym9/j2tTEoacAffdW1TVUzXO30W1JTJS7dA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1"
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3176,9 +3161,9 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.45.0.tgz",
+      "integrity": "sha512-WugXLuOIq67BMgQInIxxnsSyRLFxdkJEJu8r4ngLR56q/4Q5LrbfkFRH27vMTjxEK8Pyz7QfzuZe/G15qQnVRA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -3190,16 +3175,16 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz",
-      "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.45.0.tgz",
+      "integrity": "sha512-GfE1NfVbLam6XQ0LcERKwdTTPlLvHvXXhOeUGC1OXi4eQBoyy1iVsW+uzJ/J9jtCz6/7GCQ9MtrQ0fml/jWCnA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.44.1",
-        "@typescript-eslint/tsconfig-utils": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/project-service": "8.45.0",
+        "@typescript-eslint/tsconfig-utils": "8.45.0",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/visitor-keys": "8.45.0",
        "debug": "^4.3.4",
        "fast-glob": "^3.3.2",
        "is-glob": "^4.0.3",
@@ -3219,16 +3204,16 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.1.tgz",
-      "integrity": "sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.45.0.tgz",
+      "integrity": "sha512-bxi1ht+tLYg4+XV2knz/F7RVhU0k6VrSMc9sb8DQ6fyCTrGQLHfo7lDtN0QJjZjKkLA2ThrKuCdHEvLReqtIGg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.7.0",
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1"
+        "@typescript-eslint/scope-manager": "8.45.0",
+        "@typescript-eslint/types": "8.45.0",
+        "@typescript-eslint/typescript-estree": "8.45.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3243,13 +3228,13 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz",
-      "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==",
+      "version": "8.45.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.45.0.tgz",
+      "integrity": "sha512-qsaFBA3e09MIDAGFUrTk+dzqtfv1XPVz8t8d1f0ybTzrCY7BKiMC5cjrl1O/P7UmHsNyW90EYSkU/ZWpmXelag==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
+        "@typescript-eslint/types": "8.45.0",
        "eslint-visitor-keys": "^4.2.1"
      },
      "engines": {
@@ -9043,9 +9028,9 @@
      }
    },
    "node_modules/typescript": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
-      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "license": "Apache-2.0",
      "bin": {
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "3.30.6",
+  "version": "4.30.8",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -35,6 +35,7 @@
    "@actions/io": "^1.1.3",
    "@actions/tool-cache": "^2.0.2",
    "@octokit/plugin-retry": "^6.0.0",
+    "@octokit/request-error": "^7.0.1",
    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
    "check-disk-space": "^3.4.0",
@@ -55,7 +56,7 @@
    "@ava/typescript": "6.0.0",
    "@eslint/compat": "^1.4.0",
    "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.36.0",
+    "@eslint/js": "^9.37.0",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
    "@octokit/types": "^15.0.0",
    "@types/archiver": "^6.0.3",
@@ -66,7 +67,7 @@
    "@types/node-forge": "^1.3.14",
    "@types/semver": "^7.7.1",
    "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.44.1",
+    "@typescript-eslint/eslint-plugin": "^8.45.0",
    "@typescript-eslint/parser": "^8.41.0",
    "ava": "^6.4.1",
    "esbuild": "^0.25.10",
@@ -79,7 +80,7 @@
    "glob": "^11.0.3",
    "nock": "^14.0.10",
    "sinon": "^21.0.0",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.3"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -0,0 +1,32 @@
+name: "Bundle: From toolcache"
+description: "The CodeQL bundle should be cached within the toolcache"
+versions:
+  - toolcache
+steps:
+  - name: Install @actions/tool-cache
+    run: npm install @actions/tool-cache
+  - name: Check toolcache contains CodeQL
+    continue-on-error: true
+    uses: actions/github-script@v8
+    with:
+      script: |
+        const toolcache = require('@actions/tool-cache');
+        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
+        if (allCodeqlVersions.length === 0) {
+          throw new Error(`CodeQL could not be found in the toolcache`);
+        }
+  - id: init
+    uses: ./../action/init
+    with:
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Check CodeQL is installed within the toolcache
+    uses: actions/github-script@v8
+    with:
+      script: |
+        const toolcache = require('@actions/tool-cache');
+        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
+        console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
+        if (allCodeqlVersions.length === 0) {
+          throw new Error('CodeQL not found in toolcache');
+        }
@@ -1,26 +0,0 @@
-name: "Upload-sarif: code quality endpoint"
-description: "Checks that uploading SARIFs to the code quality endpoint works"
-versions: ["default"]
-installGo: true
-steps:
-  - uses: ./../action/init
-    with:
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-      languages: csharp,java,javascript,python
-      analysis-kinds: code-quality
-  - name: Build code
-    run: ./build.sh
-  # Generate some SARIF we can upload with the upload-sarif step
-  - uses: ./../action/analyze
-    with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
-      upload: never
-  - uses: ./../action/upload-sarif
-    id: upload-sarif
-    with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
-  - name: "Check output from `upload-sarif` step"
-    if: '!(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)'
-    run: exit 1
@@ -0,0 +1,81 @@
+name: "Test different uses of `upload-sarif`"
+description: "Checks that uploading SARIFs to the code quality endpoint works"
+versions: ["default"]
+analysisKinds: ["code-scanning", "code-quality", "code-scanning,code-quality"]
+installGo: true
+steps:
+  - uses: ./../action/init
+    with:
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      languages: csharp,java,javascript,python
+      analysis-kinds: ${{ matrix.analysis-kinds }}
+  - name: Build code
+    run: ./build.sh
+  # Generate some SARIF we can upload with the upload-sarif step
+  - uses: ./../action/analyze
+    with:
+      ref: 'refs/heads/main'
+      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      upload: never
+      output: ${{ runner.temp }}/results
+
+  - name: |
+      Upload all SARIF files for `analysis-kinds: ${{ matrix.analysis-kinds }}`
+    uses: ./../action/upload-sarif
+    id: upload-sarif
+    with:
+      ref: 'refs/heads/main'
+      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      sarif_file: ${{ runner.temp }}/results
+      category: |
+        ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
+  - name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
+    if: "contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)"
+    run: exit 1
+  - name: "Fail for missing output from `upload-sarif` step for `code-quality`"
+    if: "contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)"
+    run: exit 1
+
+  - name: Upload single SARIF file for Code Scanning
+    uses: ./../action/upload-sarif
+    id: upload-single-sarif-code-scanning
+    if: "contains(matrix.analysis-kinds, 'code-scanning')"
+    with:
+      ref: 'refs/heads/main'
+      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      sarif_file: ${{ runner.temp }}/results/javascript.sarif
+      category: |
+        ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
+  - name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
+    if: "contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)"
+    run: exit 1
+  - name: Upload single SARIF file for Code Quality
+    uses: ./../action/upload-sarif
+    id: upload-single-sarif-code-quality
+    if: "contains(matrix.analysis-kinds, 'code-quality')"
+    with:
+      ref: 'refs/heads/main'
+      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
+      category: |
+        ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
+  - name: "Fail for missing output from `upload-single-sarif-code-quality` step"
+    if: "contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)"
+    run: exit 1
+
+  - name: Change SARIF file extension
+    if: "contains(matrix.analysis-kinds, 'code-scanning')"
+    run: mv ${{ runner.temp }}/results/javascript.sarif ${{ runner.temp }}/results/javascript.sarif.json
+  - name: Upload single non-`.sarif` file
+    uses: ./../action/upload-sarif
+    id: upload-single-non-sarif
+    if: "contains(matrix.analysis-kinds, 'code-scanning')"
+    with:
+      ref: 'refs/heads/main'
+      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
+      category: |
+        ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
+  - name: "Fail for missing output from `upload-single-non-sarif` step"
+    if: "contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)"
+    run: exit 1
@@ -37,28 +37,29 @@ steps:

  - name: Verify SARIF after upload
    run: |
+      PAYLOAD_FILE="$RUNNER_TEMP/payload-code-scanning.json"
      EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
      EXPECTED_REF="v1.1.0"
      EXPECTED_CHECKOUT_URI_SUFFIX="/x/y/z/some-path/tests/multi-language-repo"

-      ACTUAL_COMMIT_OID="$(cat "$RUNNER_TEMP/payload.json" | jq -r .commit_oid)"
-      ACTUAL_REF="$(cat "$RUNNER_TEMP/payload.json" | jq -r .ref)"
-      ACTUAL_CHECKOUT_URI="$(cat "$RUNNER_TEMP/payload.json" | jq -r .checkout_uri)"
+      ACTUAL_COMMIT_OID="$(cat "$PAYLOAD_FILE" | jq -r .commit_oid)"
+      ACTUAL_REF="$(cat "$PAYLOAD_FILE" | jq -r .ref)"
+      ACTUAL_CHECKOUT_URI="$(cat "$PAYLOAD_FILE" | jq -r .checkout_uri)"

      if [[ "$EXPECTED_COMMIT_OID" != "$ACTUAL_COMMIT_OID" ]]; then
        echo "::error Invalid commit oid. Expected: $EXPECTED_COMMIT_OID Actual: $ACTUAL_COMMIT_OID"
-        echo "$RUNNER_TEMP/payload.json"
+        echo "$PAYLOAD_FILE"
        exit 1
      fi

      if [[ "$EXPECTED_REF" != "$ACTUAL_REF" ]]; then
        echo "::error Invalid ref. Expected: '$EXPECTED_REF' Actual: '$ACTUAL_REF'"
-        echo "$RUNNER_TEMP/payload.json"
+        echo "$PAYLOAD_FILE"
        exit 1
      fi

      if [[ "$ACTUAL_CHECKOUT_URI" != *$EXPECTED_CHECKOUT_URI_SUFFIX ]]; then
        echo "::error Invalid checkout URI suffix. Expected suffix: $EXPECTED_CHECKOUT_URI_SUFFIX Actual uri: $ACTUAL_CHECKOUT_URI"
-        echo "$RUNNER_TEMP/payload.json"
+        echo "$PAYLOAD_FILE"
        exit 1
      fi
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node20
+  using: node24
  main: '../lib/resolve-environment-action.js'
@@ -247,9 +247,14 @@ export function isSelfHostedRunner() {
  return process.env.RUNNER_ENVIRONMENT === "self-hosted";
 }

+/** Determines whether the workflow trigger is `dynamic`. */
+export function isDynamicWorkflow(): boolean {
+  return getWorkflowEventName() === "dynamic";
+}
+
 /** Determines whether we are running in default setup. */
 export function isDefaultSetup(): boolean {
-  return getWorkflowEventName() === "dynamic";
+  return isDynamicWorkflow();
 }

 export function prettyPrintInvocation(cmd: string, args: string[]): string {
@@ -1,3 +1,5 @@
+import { fixCodeQualityCategory } from "./actions-util";
+import { Logger } from "./logging";
 import { ConfigurationError } from "./util";

 export enum AnalysisKind {
@@ -61,6 +63,8 @@ export interface AnalysisConfig {
  /** A predicate on filenames to decide whether a SARIF file
   * belongs to this kind of analysis. */
  sarifPredicate: (name: string) => boolean;
+  /** Analysis-specific adjustment of the category. */
+  fixCategory: (logger: Logger, category?: string) => string | undefined;
  /** A prefix for environment variables used to track the uniqueness of SARIF uploads. */
  sentinelPrefix: string;
 }
@@ -74,6 +78,7 @@ export const CodeScanning: AnalysisConfig = {
  sarifPredicate: (name) =>
    name.endsWith(CodeScanning.sarifExtension) &&
    !CodeQuality.sarifPredicate(name),
+  fixCategory: (_, category) => category,
  sentinelPrefix: "CODEQL_UPLOAD_SARIF_",
 };

@@ -84,5 +89,29 @@ export const CodeQuality: AnalysisConfig = {
  target: SARIF_UPLOAD_ENDPOINT.CODE_QUALITY,
  sarifExtension: ".quality.sarif",
  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
+  fixCategory: fixCodeQualityCategory,
  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_",
 };
+
+/**
+ * Gets the `AnalysisConfig` corresponding to `kind`.
+ * @param kind The analysis kind to get the `AnalysisConfig` for.
+ * @returns The `AnalysisConfig` corresponding to `kind`.
+ */
+export function getAnalysisConfig(kind: AnalysisKind): AnalysisConfig {
+  // Using a switch statement here accomplishes two things:
+  // 1. The type checker believes us that we have a case for every `AnalysisKind`.
+  // 2. If we ever add another member to `AnalysisKind`, the type checker will alert us that we have to add a case.
+  switch (kind) {
+    case AnalysisKind.CodeScanning:
+      return CodeScanning;
+    case AnalysisKind.CodeQuality:
+      return CodeQuality;
+  }
+}
+
+// Since we have overlapping extensions (i.e. ".sarif" includes ".quality.sarif"),
+// we want to scan a folder containing SARIF files in an order that finds the more
+// specific extensions first. This constant defines an array in the order of analyis
+// configurations with more specific extensions to less specific extensions.
+export const SarifScanOrder = [CodeQuality, CodeScanning];
@@ -30,7 +30,6 @@ import {
  DependencyCacheUploadStatusReport,
  uploadDependencyCaches,
 } from "./dependency-caching";
-import { getDiffInformedAnalysisBranches } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { Feature, Features } from "./feature-flags";
 import { KnownLanguage } from "./languages";
@@ -299,14 +298,8 @@ async function run() {
      logger,
    );

-    const branches = await getDiffInformedAnalysisBranches(
-      codeql,
-      features,
-      logger,
-    );
-    const diffRangePackDir = branches
-      ? await setupDiffInformedQueryRun(branches, logger)
-      : undefined;
+    // Setup diff informed analysis if needed (based on whether init created the file)
+    const diffRangePackDir = await setupDiffInformedQueryRun(logger);

    await warnIfGoInstalledAfterInit(config, logger);
    await runAutobuildIfLegacyGoWorkflow(config, logger);
@@ -356,16 +349,14 @@ async function run() {
      }

      if (isCodeQualityEnabled(config)) {
+        const analysis = analyses.CodeQuality;
        const qualityUploadResult = await uploadLib.uploadFiles(
          outputDir,
          actionsUtil.getRequiredInput("checkout_path"),
-          actionsUtil.fixCodeQualityCategory(
-            logger,
-            actionsUtil.getOptionalInput("category"),
-          ),
+          actionsUtil.getOptionalInput("category"),
          features,
          logger,
-          analyses.CodeQuality,
+          analysis,
        );
        core.setOutput("quality-sarif-id", qualityUploadResult.sarifID);
      }
@@ -4,10 +4,8 @@ import * as path from "path";
 import test from "ava";
 import * as sinon from "sinon";

-import * as actionsUtil from "./actions-util";
 import { CodeQuality, CodeScanning } from "./analyses";
 import {
-  exportedForTesting,
  runQueries,
  defaultSuites,
  resolveQuerySuiteAlias,
@@ -131,210 +129,12 @@ test("status report fields", async (t) => {
  });
 });

-function runGetDiffRanges(changes: number, patch: string[] | undefined): any {
-  sinon
-    .stub(actionsUtil, "getRequiredInput")
-    .withArgs("checkout_path")
-    .returns("/checkout/path");
-  return exportedForTesting.getDiffRanges(
-    {
-      filename: "test.txt",
-      changes,
-      patch: patch?.join("\n"),
-    },
-    getRunnerLogger(true),
-  );
-}
-
-test("getDiffRanges: file unchanged", async (t) => {
-  const diffRanges = runGetDiffRanges(0, undefined);
-  t.deepEqual(diffRanges, []);
-});
-
-test("getDiffRanges: file diff too large", async (t) => {
-  const diffRanges = runGetDiffRanges(1000000, undefined);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 0,
-      endLine: 0,
-    },
-  ]);
-});
-
-test("getDiffRanges: diff thunk with single addition range", async (t) => {
-  const diffRanges = runGetDiffRanges(2, [
-    "@@ -30,6 +50,8 @@",
-    " a",
-    " b",
-    " c",
-    "+1",
-    "+2",
-    " d",
-    " e",
-    " f",
-  ]);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 53,
-      endLine: 54,
-    },
-  ]);
-});
-
-test("getDiffRanges: diff thunk with single deletion range", async (t) => {
-  const diffRanges = runGetDiffRanges(2, [
-    "@@ -30,8 +50,6 @@",
-    " a",
-    " b",
-    " c",
-    "-1",
-    "-2",
-    " d",
-    " e",
-    " f",
-  ]);
-  t.deepEqual(diffRanges, []);
-});
-
-test("getDiffRanges: diff thunk with single update range", async (t) => {
-  const diffRanges = runGetDiffRanges(2, [
-    "@@ -30,7 +50,7 @@",
-    " a",
-    " b",
-    " c",
-    "-1",
-    "+2",
-    " d",
-    " e",
-    " f",
-  ]);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 53,
-      endLine: 53,
-    },
-  ]);
-});
-
-test("getDiffRanges: diff thunk with addition ranges", async (t) => {
-  const diffRanges = runGetDiffRanges(2, [
-    "@@ -30,7 +50,9 @@",
-    " a",
-    " b",
-    " c",
-    "+1",
-    " c",
-    "+2",
-    " d",
-    " e",
-    " f",
-  ]);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 53,
-      endLine: 53,
-    },
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 55,
-      endLine: 55,
-    },
-  ]);
-});
-
-test("getDiffRanges: diff thunk with mixed ranges", async (t) => {
-  const diffRanges = runGetDiffRanges(2, [
-    "@@ -30,7 +50,7 @@",
-    " a",
-    " b",
-    " c",
-    "-1",
-    " d",
-    "-2",
-    "+3",
-    " e",
-    " f",
-    "+4",
-    "+5",
-    " g",
-    " h",
-    " i",
-  ]);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 54,
-      endLine: 54,
-    },
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 57,
-      endLine: 58,
-    },
-  ]);
-});
-
-test("getDiffRanges: multiple diff thunks", async (t) => {
-  const diffRanges = runGetDiffRanges(2, [
-    "@@ -30,6 +50,8 @@",
-    " a",
-    " b",
-    " c",
-    "+1",
-    "+2",
-    " d",
-    " e",
-    " f",
-    "@@ -130,6 +150,8 @@",
-    " a",
-    " b",
-    " c",
-    "+1",
-    "+2",
-    " d",
-    " e",
-    " f",
-  ]);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 53,
-      endLine: 54,
-    },
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 153,
-      endLine: 154,
-    },
-  ]);
-});
-
-test("getDiffRanges: no diff context lines", async (t) => {
-  const diffRanges = runGetDiffRanges(2, ["@@ -30 +50,2 @@", "+1", "+2"]);
-  t.deepEqual(diffRanges, [
-    {
-      path: "/checkout/path/test.txt",
-      startLine: 50,
-      endLine: 51,
-    },
-  ]);
-});
-
-test("getDiffRanges: malformed thunk header", async (t) => {
-  const diffRanges = runGetDiffRanges(2, ["@@ 30 +50,2 @@", "+1", "+2"]);
-  t.deepEqual(diffRanges, undefined);
-});
-
 test("resolveQuerySuiteAlias", (t) => {
  // default query suite names should resolve to something language-specific ending in `.qls`.
  for (const suite of defaultSuites) {
    const resolved = resolveQuerySuiteAlias(KnownLanguage.go, suite);
    t.assert(
-      resolved.endsWith(".qls"),
+      path.extname(resolved) === ".qls",
      "Resolved default suite doesn't end in .qls",
    );
    t.assert(
@@ -6,14 +6,9 @@ import * as io from "@actions/io";
 import * as del from "del";
 import * as yaml from "js-yaml";

-import {
-  fixCodeQualityCategory,
-  getRequiredInput,
-  getTemporaryDirectory,
-  PullRequestBranches,
-} from "./actions-util";
+import { getTemporaryDirectory } from "./actions-util";
 import * as analyses from "./analyses";
-import { getApiClient } from "./api-client";
+// (getApiClient import removed; no longer needed after diff refactor)
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
@@ -21,14 +16,14 @@ import { getJavaTempDependencyDir } from "./dependency-caching";
 import { addDiagnostic, makeDiagnostic } from "./diagnostics";
 import {
  DiffThunkRange,
-  writeDiffRangesJsonFile,
+  readDiffRangesJsonFile,
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
 import { KnownLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { OverlayDatabaseMode } from "./overlay-database-utils";
-import { getRepositoryNwoFromEnv } from "./repository";
+// getRepositoryNwoFromEnv no longer needed after extracting diff logic
 import { DatabaseCreationTimings, EventReport } from "./status-report";
 import { endTracingForCluster } from "./tracer-config";
 import * as util from "./util";
@@ -288,16 +283,36 @@ async function finalizeDatabaseCreation(
 * the diff range information, or `undefined` if the feature is disabled.
 */
 export async function setupDiffInformedQueryRun(
-  branches: PullRequestBranches,
  logger: Logger,
 ): Promise<string | undefined> {
  return await withGroupAsync(
    "Generating diff range extension pack",
    async () => {
+      // Only use precomputed diff ranges; never recompute here.
+      let diffRanges: DiffThunkRange[] | undefined;
+      try {
+        diffRanges = readDiffRangesJsonFile(logger);
+      } catch (e) {
+        logger.debug(
+          `Failed to read precomputed diff ranges: ${util.getErrorMessage(e)}`,
+        );
+        diffRanges = undefined;
+      }
+
+      if (diffRanges === undefined) {
+        logger.info(
+          "No precomputed diff ranges found; skipping diff-informed analysis stage.",
+        );
+        return undefined;
+      }
+
+      const fileCount = new Set(
+        diffRanges.filter((r) => r.path).map((r) => r.path),
+      ).size;
      logger.info(
-        `Calculating diff ranges for ${branches.base}...${branches.head}`,
+        `Using precomputed diff ranges (${diffRanges.length} ranges across ${fileCount} files).`,
      );
-      const diffRanges = await getPullRequestEditedDiffRanges(branches, logger);
+
      const packDir = writeDiffRangeDataExtensionPack(logger, diffRanges);
      if (packDir === undefined) {
        logger.warning(
@@ -314,185 +329,6 @@ export async function setupDiffInformedQueryRun(
  );
 }

-/**
- * Return the file line ranges that were added or modified in the pull request.
- *
- * @param branches The base and head branches of the pull request.
- * @param logger
- * @returns An array of tuples, where each tuple contains the absolute path of a
- * file, the start line and the end line (both 1-based and inclusive) of an
- * added or modified range in that file. Returns `undefined` if the action was
- * not triggered by a pull request or if there was an error.
- */
-async function getPullRequestEditedDiffRanges(
-  branches: PullRequestBranches,
-  logger: Logger,
-): Promise<DiffThunkRange[] | undefined> {
-  const fileDiffs = await getFileDiffsWithBasehead(branches, logger);
-  if (fileDiffs === undefined) {
-    return undefined;
-  }
-  if (fileDiffs.length >= 300) {
-    // The "compare two commits" API returns a maximum of 300 changed files. If
-    // we see that many changed files, it is possible that there could be more,
-    // with the rest being truncated. In this case, we should not attempt to
-    // compute the diff ranges, as the result would be incomplete.
-    logger.warning(
-      `Cannot retrieve the full diff because there are too many ` +
-        `(${fileDiffs.length}) changed files in the pull request.`,
-    );
-    return undefined;
-  }
-  const results: DiffThunkRange[] = [];
-  for (const filediff of fileDiffs) {
-    const diffRanges = getDiffRanges(filediff, logger);
-    if (diffRanges === undefined) {
-      return undefined;
-    }
-    results.push(...diffRanges);
-  }
-  return results;
-}
-
-/**
- * This interface is an abbreviated version of the file diff object returned by
- * the GitHub API.
- */
-interface FileDiff {
-  filename: string;
-  changes: number;
-  // A patch may be absent if the file is binary, if the file diff is too large,
-  // or if the file is unchanged.
-  patch?: string | undefined;
-}
-
-async function getFileDiffsWithBasehead(
-  branches: PullRequestBranches,
-  logger: Logger,
-): Promise<FileDiff[] | undefined> {
-  // Check CODE_SCANNING_REPOSITORY first. If it is empty or not set, fall back
-  // to GITHUB_REPOSITORY.
-  const repositoryNwo = getRepositoryNwoFromEnv(
-    "CODE_SCANNING_REPOSITORY",
-    "GITHUB_REPOSITORY",
-  );
-  const basehead = `${branches.base}...${branches.head}`;
-  try {
-    const response = await getApiClient().rest.repos.compareCommitsWithBasehead(
-      {
-        owner: repositoryNwo.owner,
-        repo: repositoryNwo.repo,
-        basehead,
-        per_page: 1,
-      },
-    );
-    logger.debug(
-      `Response from compareCommitsWithBasehead(${basehead}):` +
-        `\n${JSON.stringify(response, null, 2)}`,
-    );
-    return response.data.files;
-  } catch (error: any) {
-    if (error.status) {
-      logger.warning(`Error retrieving diff ${basehead}: ${error.message}`);
-      logger.debug(
-        `Error running compareCommitsWithBasehead(${basehead}):` +
-          `\nRequest: ${JSON.stringify(error.request, null, 2)}` +
-          `\nError Response: ${JSON.stringify(error.response, null, 2)}`,
-      );
-      return undefined;
-    } else {
-      throw error;
-    }
-  }
-}
-
-function getDiffRanges(
-  fileDiff: FileDiff,
-  logger: Logger,
-): DiffThunkRange[] | undefined {
-  // Diff-informed queries expect the file path to be absolute. CodeQL always
-  // uses forward slashes as the path separator, so on Windows we need to
-  // replace any backslashes with forward slashes.
-  const filename = path
-    .join(getRequiredInput("checkout_path"), fileDiff.filename)
-    .replaceAll(path.sep, "/");
-
-  if (fileDiff.patch === undefined) {
-    if (fileDiff.changes === 0) {
-      // There are situations where a changed file legitimately has no diff.
-      // For example, the file may be a binary file, or that the file may have
-      // been renamed with no changes to its contents. In these cases, the
-      // file would be reported as having 0 changes, and we can return an empty
-      // array to indicate no diff range in this file.
-      return [];
-    }
-    // If a file is reported to have nonzero changes but no patch, that may be
-    // due to the file diff being too large. In this case, we should fall back
-    // to a special diff range that covers the entire file.
-    return [
-      {
-        path: filename,
-        startLine: 0,
-        endLine: 0,
-      },
-    ];
-  }
-
-  // The 1-based file line number of the current line
-  let currentLine = 0;
-  // The 1-based file line number that starts the current range of added lines
-  let additionRangeStartLine: number | undefined = undefined;
-  const diffRanges: DiffThunkRange[] = [];
-
-  const diffLines = fileDiff.patch.split("\n");
-  // Adding a fake context line at the end ensures that the following loop will
-  // always terminate the last range of added lines.
-  diffLines.push(" ");
-
-  for (const diffLine of diffLines) {
-    if (diffLine.startsWith("-")) {
-      // Ignore deletions completely -- we do not even want to consider them when
-      // calculating consecutive ranges of added lines.
-      continue;
-    }
-    if (diffLine.startsWith("+")) {
-      if (additionRangeStartLine === undefined) {
-        additionRangeStartLine = currentLine;
-      }
-      currentLine++;
-      continue;
-    }
-    if (additionRangeStartLine !== undefined) {
-      // Any line that does not start with a "+" or "-" terminates the current
-      // range of added lines.
-      diffRanges.push({
-        path: filename,
-        startLine: additionRangeStartLine,
-        endLine: currentLine - 1,
-      });
-      additionRangeStartLine = undefined;
-    }
-    if (diffLine.startsWith("@@ ")) {
-      // A new hunk header line resets the current line number.
-      const match = diffLine.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
-      if (match === null) {
-        logger.warning(
-          `Cannot parse diff hunk header for ${fileDiff.filename}: ${diffLine}`,
-        );
-        return undefined;
-      }
-      currentLine = parseInt(match[1], 10);
-      continue;
-    }
-    if (diffLine.startsWith(" ")) {
-      // An unchanged context line advances the current line number.
-      currentLine++;
-      continue;
-    }
-  }
-  return diffRanges;
-}
-
 /**
 * Create an extension pack in the temporary directory that contains the file
 * line ranges that were added or modified in the pull request.
@@ -573,10 +409,6 @@ extensions:
    `Wrote pr-diff-range extension pack to ${extensionFilePath}:\n${extensionContents}`,
  );

-  // Write the diff ranges to a JSON file, for action-side alert filtering by the
-  // upload-lib module.
-  writeDiffRangesJsonFile(logger, ranges);
-
  return diffRangeDir;
 }

@@ -781,7 +613,7 @@ export async function runQueries(
    // accepted by the Code Quality backend.
    let category = automationDetailsId;
    if (analysis.kind === analyses.AnalysisKind.CodeQuality) {
-      category = fixCodeQualityCategory(logger, automationDetailsId);
+      category = analysis.fixCategory(logger, automationDetailsId);
    }

    const sarifFile = path.join(
@@ -924,6 +756,4 @@ export async function warnIfGoInstalledAfterInit(
  }
 }

-export const exportedForTesting = {
-  getDiffRanges,
-};
+export const exportedForTesting = {};
@@ -52,11 +52,11 @@ export async function determineAutobuildLanguages(
   * For example, consider a user with the following workflow file:
   *
   * ```yml
-   * - uses: github/codeql-action/init@v3
+   * - uses: github/codeql-action/init@v4
   *   with:
   *     languages: go, java
-   * - uses: github/codeql-action/autobuild@v3
-   * - uses: github/codeql-action/analyze@v3
+   * - uses: github/codeql-action/autobuild@v4
+   * - uses: github/codeql-action/analyze@v4
   * ```
   *
   * - With Go extraction disabled, we will run the Java autobuilder in the
@@ -517,6 +517,7 @@ const injectedConfigMacro = test.macro({
        "",
        undefined,
        undefined,
+        undefined,
        getRunnerLogger(true),
      );

@@ -803,6 +804,7 @@ test("passes a code scanning config AND qlconfig to the CLI", async (t: Executio
      "",
      undefined,
      "/path/to/qlconfig.yml",
+      undefined,
      getRunnerLogger(true),
    );

@@ -831,6 +833,7 @@ test("does not pass a qlconfig to the CLI when it is undefined", async (t: Execu
      "",
      undefined,
      undefined, // undefined qlconfigFile
+      undefined,
      getRunnerLogger(true),
    );

@@ -1080,6 +1083,7 @@ test("Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OP
    "sourceRoot",
    undefined,
    undefined,
+    undefined,
    getRunnerLogger(false),
  );

@@ -3,6 +3,7 @@ import * as path from "path";

 import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
+import { RequestError } from "@octokit/request-error";
 import * as yaml from "js-yaml";

 import {
@@ -95,6 +96,7 @@ export interface CodeQL {
    sourceRoot: string,
    processName: string | undefined,
    qlconfigFile: string | undefined,
+    prDiffChangedFiles: Set<string> | undefined,
    logger: Logger,
  ): Promise<void>;
  /**
@@ -370,7 +372,8 @@ export async function setupCodeQL(
  } catch (e) {
    const ErrorClass =
      e instanceof util.ConfigurationError ||
-      (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space
+      (e instanceof Error && e.message.includes("ENOSPC")) || // out of disk space
+      (e instanceof RequestError && e.status === 429) // rate limited
        ? util.ConfigurationError
        : Error;

@@ -558,6 +561,7 @@ export async function getCodeQLForCmd(
      sourceRoot: string,
      processName: string | undefined,
      qlconfigFile: string | undefined,
+      prDiffChangedFiles: Set<string> | undefined,
      logger: Logger,
    ) {
      const extraArgs = config.languages.map(
@@ -600,6 +604,7 @@ export async function getCodeQLForCmd(
        const overlayChangesFile = await writeOverlayChangesFile(
          config,
          sourceRoot,
+          prDiffChangedFiles,
          logger,
        );
        extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -723,7 +723,14 @@ export async function getOverlayDatabaseMode(
    buildMode !== BuildMode.None &&
    (
      await Promise.all(
-        languages.map(async (l) => await codeql.isTracedLanguage(l)),
+        languages.map(
+          async (l) =>
+            l !== KnownLanguage.go && // Workaround to allow overlay analysis for Go with any build
+            // mode, since it does not yet support BMN. The Go autobuilder and/or extractor will
+            // ensure that overlay-base databases are only created for supported Go build setups,
+            // and that we'll fall back to full databases in other cases.
+            (await codeql.isTracedLanguage(l)),
+        ),
      )
    ).some(Boolean)
  ) {
@@ -153,7 +153,6 @@ const packSpecPrettyPrintingMacro = test.macro({
  title: (
    _providedTitle: string | undefined,
    packStr: string,
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
    _packObj: dbConfig.Pack,
  ) => `Prettyprint pack spec: '${packStr}'`,
 });
@@ -59,7 +59,7 @@ export async function uploadCombinedSarifArtifacts(
        for (const outputDir of outputDirs) {
          const sarifFiles = fs
            .readdirSync(path.resolve(baseTempDir, outputDir))
-            .filter((f) => f.endsWith(".sarif"));
+            .filter((f) => path.extname(f) === ".sarif");

          for (const sarifFile of sarifFiles) {
            toUpload.push(path.resolve(baseTempDir, outputDir, sarifFile));
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.1",
-  "cliVersion": "2.23.1",
-  "priorBundleVersion": "codeql-bundle-v2.23.0",
-  "priorCliVersion": "2.23.0"
+  "bundleVersion": "codeql-bundle-v2.23.2",
+  "cliVersion": "2.23.2",
+  "priorBundleVersion": "codeql-bundle-v2.23.1",
+  "priorCliVersion": "2.23.1"
 }
@@ -4,7 +4,10 @@ import * as sinon from "sinon";
 import * as actionsUtil from "./actions-util";
 import type { PullRequestBranches } from "./actions-util";
 import * as apiClient from "./api-client";
-import { shouldPerformDiffInformedAnalysis } from "./diff-informed-analysis-utils";
+import {
+  shouldPerformDiffInformedAnalysis,
+  exportedForTesting as diffExportedForTesting,
+} from "./diff-informed-analysis-utils";
 import { Feature, Features } from "./feature-flags";
 import { getRunnerLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
@@ -183,3 +186,204 @@ test(
  },
  false,
 );
+
+// ---------------------------------------------------------------------------
+// Tests for getDiffRanges (moved from analyze.test.ts after extraction)
+// ---------------------------------------------------------------------------
+function runGetDiffRanges(changes: number, patch: string[] | undefined): any {
+  sinon
+    .stub(actionsUtil, "getRequiredInput")
+    .withArgs("checkout_path")
+    .returns("/checkout/path");
+  return diffExportedForTesting.getDiffRanges(
+    {
+      filename: "test.txt",
+      changes,
+      patch: patch?.join("\n"),
+    },
+    getRunnerLogger(true),
+  );
+}
+
+test("getDiffRanges: file unchanged", async (t) => {
+  const diffRanges = runGetDiffRanges(0, undefined);
+  t.deepEqual(diffRanges, []);
+});
+
+test("getDiffRanges: file diff too large", async (t) => {
+  const diffRanges = runGetDiffRanges(1000000, undefined);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 0,
+      endLine: 0,
+    },
+  ]);
+});
+
+test("getDiffRanges: diff thunk with single addition range", async (t) => {
+  const diffRanges = runGetDiffRanges(2, [
+    "@@ -30,6 +50,8 @@",
+    " a",
+    " b",
+    " c",
+    "+1",
+    "+2",
+    " d",
+    " e",
+    " f",
+  ]);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 53,
+      endLine: 54,
+    },
+  ]);
+});
+
+test("getDiffRanges: diff thunk with single deletion range", async (t) => {
+  const diffRanges = runGetDiffRanges(2, [
+    "@@ -30,8 +50,6 @@",
+    " a",
+    " b",
+    " c",
+    "-1",
+    "-2",
+    " d",
+    " e",
+    " f",
+  ]);
+  t.deepEqual(diffRanges, []);
+});
+
+test("getDiffRanges: diff thunk with single update range", async (t) => {
+  const diffRanges = runGetDiffRanges(2, [
+    "@@ -30,7 +50,7 @@",
+    " a",
+    " b",
+    " c",
+    "-1",
+    "+2",
+    " d",
+    " e",
+    " f",
+  ]);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 53,
+      endLine: 53,
+    },
+  ]);
+});
+
+test("getDiffRanges: diff thunk with addition ranges", async (t) => {
+  const diffRanges = runGetDiffRanges(2, [
+    "@@ -30,7 +50,9 @@",
+    " a",
+    " b",
+    " c",
+    "+1",
+    " c",
+    "+2",
+    " d",
+    " e",
+    " f",
+  ]);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 53,
+      endLine: 53,
+    },
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 55,
+      endLine: 55,
+    },
+  ]);
+});
+
+test("getDiffRanges: diff thunk with mixed ranges", async (t) => {
+  const diffRanges = runGetDiffRanges(2, [
+    "@@ -30,7 +50,7 @@",
+    " a",
+    " b",
+    " c",
+    "-1",
+    " d",
+    "-2",
+    "+3",
+    " e",
+    " f",
+    "+4",
+    "+5",
+    " g",
+    " h",
+    " i",
+  ]);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 54,
+      endLine: 54,
+    },
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 57,
+      endLine: 58,
+    },
+  ]);
+});
+
+test("getDiffRanges: multiple diff thunks", async (t) => {
+  const diffRanges = runGetDiffRanges(2, [
+    "@@ -30,6 +50,8 @@",
+    " a",
+    " b",
+    " c",
+    "+1",
+    "+2",
+    " d",
+    " e",
+    " f",
+    "@@ -130,6 +150,8 @@",
+    " a",
+    " b",
+    " c",
+    "+1",
+    "+2",
+    " d",
+    " e",
+    " f",
+  ]);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 53,
+      endLine: 54,
+    },
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 153,
+      endLine: 154,
+    },
+  ]);
+});
+
+test("getDiffRanges: no diff context lines", async (t) => {
+  const diffRanges = runGetDiffRanges(2, ["@@ -30 +50,2 @@", "+1", "+2"]);
+  t.deepEqual(diffRanges, [
+    {
+      path: "/checkout/path/test.txt",
+      startLine: 50,
+      endLine: 51,
+    },
+  ]);
+});
+
+test("getDiffRanges: malformed thunk header", async (t) => {
+  const diffRanges = runGetDiffRanges(2, ["@@ 30 +50,2 @@", "+1", "+2"]);
+  t.deepEqual(diffRanges, undefined);
+});
@@ -1,14 +1,28 @@
 import * as fs from "fs";
 import * as path from "path";

-import * as actionsUtil from "./actions-util";
 import type { PullRequestBranches } from "./actions-util";
-import { getGitHubVersion } from "./api-client";
+import * as actionsUtil from "./actions-util";
+import { getRequiredInput } from "./actions-util";
+import { getGitHubVersion, getApiClient } from "./api-client";
 import type { CodeQL } from "./codeql";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
+import { getRepositoryNwoFromEnv } from "./repository";
 import { GitHubVariant, satisfiesGHESVersion } from "./util";

+/**
+ * This interface is an abbreviated version of the file diff object returned by
+ * the GitHub API. (Kept internal to this module.)
+ */
+interface FileDiff {
+  filename: string;
+  changes: number;
+  // A patch may be absent if the file is binary, if the file diff is too large,
+  // or if the file is unchanged.
+  patch?: string | undefined;
+}
+
 /**
 * Check if the action should perform diff-informed analysis.
 */
@@ -93,3 +107,176 @@ export function readDiffRangesJsonFile(
  );
  return JSON.parse(jsonContents) as DiffThunkRange[];
 }
+
+/**
+ * Return the file line ranges that were added or modified in the pull request.
+ *
+ * @param branches The base and head branches of the pull request.
+ * @param logger
+ * @returns An array of objects, where each object contains the absolute path of a
+ * file, the start line and the end line (both 1-based and inclusive) of an
+ * added or modified range in that file. Returns `undefined` if the action was
+ * not triggered by a pull request or if there was an error (including API
+ * truncation conditions).
+ */
+export async function getPullRequestEditedDiffRanges(
+  branches: PullRequestBranches,
+  logger: Logger,
+): Promise<DiffThunkRange[] | undefined> {
+  const fileDiffs = await getFileDiffsWithBasehead(branches, logger);
+  if (fileDiffs === undefined) {
+    return undefined;
+  }
+  if (fileDiffs.length >= 300) {
+    // The "compare two commits" API returns a maximum of 300 changed files. If
+    // we see that many changed files, it is possible that there could be more,
+    // with the rest being truncated. In this case, we should not attempt to
+    // compute the diff ranges, as the result would be incomplete.
+    logger.warning(
+      `Cannot retrieve the full diff because there are too many ` +
+        `(${fileDiffs.length}) changed files in the pull request.`,
+    );
+    return undefined;
+  }
+  const results: DiffThunkRange[] = [];
+  for (const filediff of fileDiffs) {
+    const diffRanges = getDiffRanges(filediff, logger);
+    if (diffRanges === undefined) {
+      return undefined;
+    }
+    results.push(...diffRanges);
+  }
+  return results;
+}
+
+async function getFileDiffsWithBasehead(
+  branches: PullRequestBranches,
+  logger: Logger,
+): Promise<FileDiff[] | undefined> {
+  // Check CODE_SCANNING_REPOSITORY first. If it is empty or not set, fall back
+  // to GITHUB_REPOSITORY.
+  const repositoryNwo = getRepositoryNwoFromEnv(
+    "CODE_SCANNING_REPOSITORY",
+    "GITHUB_REPOSITORY",
+  );
+  const basehead = `${branches.base}...${branches.head}`;
+  try {
+    const response = await getApiClient().rest.repos.compareCommitsWithBasehead(
+      {
+        owner: repositoryNwo.owner,
+        repo: repositoryNwo.repo,
+        basehead,
+        per_page: 1,
+      },
+    );
+    logger.debug(
+      `Response from compareCommitsWithBasehead(${basehead}):` +
+        `\n${JSON.stringify(response, null, 2)}`,
+    );
+    return response.data.files;
+  } catch (error: any) {
+    if (error.status) {
+      logger.warning(`Error retrieving diff ${basehead}: ${error.message}`);
+      logger.debug(
+        `Error running compareCommitsWithBasehead(${basehead}):` +
+          `\nRequest: ${JSON.stringify(error.request, null, 2)}` +
+          `\nError Response: ${JSON.stringify(error.response, null, 2)}`,
+      );
+      return undefined;
+    } else {
+      throw error;
+    }
+  }
+}
+
+function getDiffRanges(
+  fileDiff: FileDiff,
+  logger: Logger,
+): DiffThunkRange[] | undefined {
+  // Diff-informed queries expect the file path to be absolute. CodeQL always
+  // uses forward slashes as the path separator, so on Windows we need to
+  // replace any backslashes with forward slashes.
+  const filename = path
+    .join(getRequiredInput("checkout_path"), fileDiff.filename)
+    .replaceAll(path.sep, "/");
+
+  if (fileDiff.patch === undefined) {
+    if (fileDiff.changes === 0) {
+      // There are situations where a changed file legitimately has no diff.
+      // For example, the file may be a binary file, or that the file may have
+      // been renamed with no changes to its contents. In these cases, the
+      // file would be reported as having 0 changes, and we can return an empty
+      // array to indicate no diff range in this file.
+      return [];
+    }
+    // If a file is reported to have nonzero changes but no patch, that may be
+    // due to the file diff being too large. In this case, we should fall back
+    // to a special diff range that covers the entire file.
+    return [
+      {
+        path: filename,
+        startLine: 0,
+        endLine: 0,
+      },
+    ];
+  }
+
+  // The 1-based file line number of the current line
+  let currentLine = 0;
+  // The 1-based file line number that starts the current range of added lines
+  let additionRangeStartLine: number | undefined = undefined;
+  const diffRanges: DiffThunkRange[] = [];
+
+  const diffLines = fileDiff.patch.split("\n");
+  // Adding a fake context line at the end ensures that the following loop will
+  // always terminate the last range of added lines.
+  diffLines.push(" ");
+
+  for (const diffLine of diffLines) {
+    if (diffLine.startsWith("-")) {
+      // Ignore deletions completely -- we do not even want to consider them when
+      // calculating consecutive ranges of added lines.
+      continue;
+    }
+    if (diffLine.startsWith("+")) {
+      if (additionRangeStartLine === undefined) {
+        additionRangeStartLine = currentLine;
+      }
+      currentLine++;
+      continue;
+    }
+    if (additionRangeStartLine !== undefined) {
+      // Any line that does not start with a "+" or "-" terminates the current
+      // range of added lines.
+      diffRanges.push({
+        path: filename,
+        startLine: additionRangeStartLine,
+        endLine: currentLine - 1,
+      });
+      additionRangeStartLine = undefined;
+    }
+    if (diffLine.startsWith("@@ ")) {
+      // A new hunk header line resets the current line number.
+      const match = diffLine.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+      if (match === null) {
+        logger.warning(
+          `Cannot parse diff hunk header for ${fileDiff.filename}: ${diffLine}`,
+        );
+        return undefined;
+      }
+      currentLine = parseInt(match[1], 10);
+      continue;
+    }
+    if (diffLine.startsWith(" ")) {
+      // An unchanged context line advances the current line number.
+      currentLine++;
+      continue;
+    }
+  }
+  return diffRanges;
+}
+
+// Export internal helpers for unit testing only (kept stable for existing tests)
+export const exportedForTesting = {
+  getDiffRanges,
+};
@@ -128,4 +128,10 @@ export enum EnvVar {
   * whether the upload is disabled. This is intended for testing and debugging purposes.
   */
  SARIF_DUMP_DIR = "CODEQL_ACTION_SARIF_DUMP_DIR",
+
+  /**
+   * Whether to skip uploading SARIF results to GitHub. Intended for testing purposes.
+   * This setting is more specific than `CODEQL_ACTION_TEST_MODE`, which implies this option.
+   */
+  SKIP_SARIF_UPLOAD = "CODEQL_ACTION_SKIP_SARIF_UPLOAD",
 }
@@ -84,14 +84,14 @@ test("uploads failed SARIF run with `diagnostics export` if feature flag is off"
    },
    {
      name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
      with: {
        languages: "javascript",
      },
    },
    {
      name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
      with: {
        category: "my-category",
      },
@@ -108,14 +108,14 @@ test("uploads failed SARIF run with `diagnostics export` if the database doesn't
    },
    {
      name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
      with: {
        languages: "javascript",
      },
    },
    {
      name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
      with: {
        category: "my-category",
      },
@@ -135,14 +135,14 @@ test("uploads failed SARIF run with database export-diagnostics if the database
    },
    {
      name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
      with: {
        languages: "javascript",
      },
    },
    {
      name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
      with: {
        category: "my-category",
      },
@@ -192,14 +192,14 @@ for (const { uploadInput, shouldUpload } of UPLOAD_INPUT_TEST_CASES) {
      },
      {
        name: "Initialize CodeQL",
-        uses: "github/codeql-action/init@v3",
+        uses: "github/codeql-action/init@v4",
        with: {
          languages: "javascript",
        },
      },
      {
        name: "Perform CodeQL Analysis",
-        uses: "github/codeql-action/analyze@v3",
+        uses: "github/codeql-action/analyze@v4",
        with: {
          category: "my-category",
          upload: uploadInput,
@@ -227,14 +227,14 @@ test("uploading failed SARIF run succeeds when workflow uses an input with a mat
    },
    {
      name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
      with: {
        languages: "javascript",
      },
    },
    {
      name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
      with: {
        category: "/language:${{ matrix.language }}",
      },
@@ -254,14 +254,14 @@ test("uploading failed SARIF run fails when workflow uses a complex upload input
    },
    {
      name: "Initialize CodeQL",
-      uses: "github/codeql-action/init@v3",
+      uses: "github/codeql-action/init@v4",
      with: {
        languages: "javascript",
      },
    },
    {
      name: "Perform CodeQL Analysis",
-      uses: "github/codeql-action/analyze@v3",
+      uses: "github/codeql-action/analyze@v4",
      with: {
        upload: "${{ matrix.language != 'csharp' }}",
      },
@@ -19,8 +19,8 @@ import {
  delay,
  getErrorMessage,
  getRequiredEnvParam,
-  isInTestMode,
  parseMatrixInput,
+  shouldSkipSarifUpload,
  wrapError,
 } from "./util";
 import {
@@ -81,7 +81,7 @@ async function maybeUploadFailedSarif(
    !["always", "failure-only"].includes(
      actionsUtil.getUploadValue(shouldUpload),
    ) ||
-    isInTestMode()
+    shouldSkipSarifUpload()
  ) {
    return { upload_failed_run_skipped_because: "SARIF upload is disabled" };
  }
@@ -33,6 +33,11 @@ import {
  logUnwrittenDiagnostics,
  makeDiagnostic,
 } from "./diagnostics";
+import {
+  getPullRequestEditedDiffRanges,
+  writeDiffRangesJsonFile,
+  getDiffInformedAnalysisBranches,
+} from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { Feature, Features } from "./feature-flags";
 import { loadPropertiesFromApi } from "./feature-flags/properties";
@@ -45,7 +50,7 @@ import {
  runDatabaseInitCluster,
 } from "./init";
 import { KnownLanguage } from "./languages";
-import { getActionsLogger, Logger } from "./logging";
+import { getActionsLogger, Logger, withGroupAsync } from "./logging";
 import {
  downloadOverlayBaseDatabaseFromCache,
  OverlayBaseDatabaseDownloadStats,
@@ -175,6 +180,7 @@ async function run() {
  persistInputs();

  let config: configUtils.Config | undefined;
+  let prDiffChangedFiles: Set<string> | undefined;
  let codeql: CodeQL;
  let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined;
  let toolsFeatureFlagsValid: boolean | undefined;
@@ -336,6 +342,12 @@ async function run() {
    });

    await checkInstallPython311(config.languages, codeql);
+
+    prDiffChangedFiles = await computeAndPersistDiffRanges(
+      codeql,
+      features,
+      logger,
+    );
  } catch (unwrappedError) {
    const error = wrapError(unwrappedError);
    core.setFailed(error.message);
@@ -662,6 +674,7 @@ async function run() {
      sourceRoot,
      "Runner.Worker.exe",
      qlconfigFile,
+      prDiffChangedFiles,
      logger,
    );

@@ -691,6 +704,7 @@ async function run() {
        sourceRoot,
        "Runner.Worker.exe",
        qlconfigFile,
+        prDiffChangedFiles,
        logger,
      );
    }
@@ -748,6 +762,45 @@ async function run() {
  );
 }

+/**
+ * Compute and persist diff ranges early during init when diff-informed analysis
+ * is enabled (feature flag + PR context). This writes the standard pr-diff-range.json
+ * file for later reuse in the analyze step. Failures are logged but non-fatal.
+ */
+async function computeAndPersistDiffRanges(
+  codeql: CodeQL,
+  features: Features,
+  logger: Logger,
+): Promise<Set<string> | undefined> {
+  try {
+    return await withGroupAsync("Compute PR diff ranges", async () => {
+      const branches = await getDiffInformedAnalysisBranches(
+        codeql,
+        features,
+        logger,
+      );
+      if (!branches) {
+        return undefined;
+      }
+      const ranges = await getPullRequestEditedDiffRanges(branches, logger);
+      if (ranges === undefined) {
+        return undefined;
+      }
+      writeDiffRangesJsonFile(logger, ranges);
+      const distinctFiles = new Set(ranges.map((r) => r.path));
+      logger.info(
+        `Persisted ${ranges.length} diff range(s) across ${distinctFiles.size} file(s) for reuse during analyze step.`,
+      );
+      return distinctFiles;
+    });
+  } catch (e) {
+    logger.warning(
+      `Failed to compute and persist PR diff ranges early: ${getErrorMessage(e)}`,
+    );
+    return undefined;
+  }
+}
+
 function getTrapCachingEnabled(): boolean {
  // If the workflow specified something always respect that
  const trapCaching = getOptionalInput("trap-caching");
@@ -73,6 +73,7 @@ export async function runDatabaseInitCluster(
  sourceRoot: string,
  processName: string | undefined,
  qlconfigFile: string | undefined,
+  prDiffChangedFiles: Set<string> | undefined,
  logger: Logger,
 ): Promise<void> {
  fs.mkdirSync(config.dbLocation, { recursive: true });
@@ -84,6 +85,7 @@ export async function runDatabaseInitCluster(
        sourceRoot,
        processName,
        qlconfigFile,
+        prDiffChangedFiles,
        logger,
      ),
  );
@@ -69,6 +69,7 @@ test("writeOverlayChangesFile generates correct changes file", async (t) => {
    const changesFilePath = await writeOverlayChangesFile(
      config,
      sourceRoot,
+      new Set([]), // The PR didn't touch any files
      logger,
    );
    getFileOidsStubForOverlay.restore();
@@ -116,13 +116,51 @@ function getBaseDatabaseOidsFilePath(config: Config): string {
 export async function writeOverlayChangesFile(
  config: Config,
  sourceRoot: string,
+  prDiffChangedFiles: Set<string> | undefined,
  logger: Logger,
 ): Promise<string> {
  const baseFileOids = await readBaseDatabaseOidsFile(config, logger);
  const overlayFileOids = await getFileOidsUnderPath(sourceRoot);
  const changedFiles = computeChangedFiles(baseFileOids, overlayFileOids);
+
+  // Augment changed files with any files that appear in the precomputed PR diff ranges.
+  // This ensures overlay analysis always includes every file with at least one edited range.
+  const originalCount = changedFiles.length;
+  let extraAddedCount = 0;
+  try {
+    if (prDiffChangedFiles && prDiffChangedFiles.size > 0) {
+      const existing = new Set(changedFiles);
+      for (const f of prDiffChangedFiles) {
+        if (!existing.has(f)) {
+          // Only include if file still exists (added/modified) — skip deleted files that might appear in diff.
+          if (
+            overlayFileOids[f] !== undefined ||
+            fs.existsSync(path.join(sourceRoot, f))
+          ) {
+            existing.add(f);
+            changedFiles.push(f);
+            extraAddedCount++;
+          }
+        }
+      }
+      if (extraAddedCount > 0) {
+        logger.debug(
+          `Added ${extraAddedCount} file(s) from PR diff ranges into overlay: ${changedFiles.slice(-extraAddedCount).join(", ")}`,
+        );
+      } else {
+        logger.debug(
+          "All diff range files were already present in the diff from the base database.",
+        );
+      }
+    }
+  } catch (e) {
+    logger.debug(
+      `Failed while attempting to add diff range files in overlay: ${(e as any).message || e}`,
+    );
+  }
+
  logger.info(
-    `Found ${changedFiles.length} changed file(s) under ${sourceRoot}.`,
+    `Found ${originalCount} natural changed file(s); added from diff ${extraAddedCount}; total ${changedFiles.length} under ${sourceRoot}.`,
  );

  const changedFilesJson = JSON.stringify({ changes: changedFiles });
@@ -1,5 +1,6 @@
 import * as path from "path";

+import * as toolcache from "@actions/tool-cache";
 import test from "ava";
 import * as sinon from "sinon";

@@ -254,6 +255,117 @@ test("setupCodeQLBundle logs the CodeQL CLI version being used when asked to dow
  });
 });

+test("getCodeQLSource correctly returns latest version from toolcache when tools == toolcache", async (t) => {
+  const loggedMessages: LoggedMessage[] = [];
+  const logger = getRecordingLogger(loggedMessages);
+
+  process.env["GITHUB_EVENT_NAME"] = "dynamic";
+
+  const latestToolcacheVersion = "3.2.1";
+  const latestVersionPath = "/path/to/latest";
+  const testVersions = ["2.3.1", latestToolcacheVersion, "1.2.3"];
+  const findAllVersionsStub = sinon
+    .stub(toolcache, "findAllVersions")
+    .returns(testVersions);
+  const findStub = sinon.stub(toolcache, "find");
+  findStub
+    .withArgs("CodeQL", latestToolcacheVersion)
+    .returns(latestVersionPath);
+
+  await withTmpDir(async (tmpDir) => {
+    setupActionsVars(tmpDir, tmpDir);
+    const source = await setupCodeql.getCodeQLSource(
+      "toolcache",
+      SAMPLE_DEFAULT_CLI_VERSION,
+      SAMPLE_DOTCOM_API_DETAILS,
+      GitHubVariant.DOTCOM,
+      false,
+      logger,
+    );
+
+    // Check that the toolcache functions were called with the expected arguments
+    t.assert(
+      findAllVersionsStub.calledOnceWith("CodeQL"),
+      `toolcache.findAllVersions("CodeQL") wasn't called`,
+    );
+    t.assert(
+      findStub.calledOnceWith("CodeQL", latestToolcacheVersion),
+      `toolcache.find("CodeQL", ${latestToolcacheVersion}) wasn't called`,
+    );
+
+    // Check that `sourceType` and `toolsVersion` match expectations.
+    t.is(source.sourceType, "toolcache");
+    t.is(source.toolsVersion, latestToolcacheVersion);
+
+    // Check that key messages we would expect to find in the log are present.
+    const expectedMessages: string[] = [
+      `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: toolcache'.`,
+      `CLI version ${latestToolcacheVersion} is the latest version in the toolcache.`,
+      `Using CodeQL CLI version ${latestToolcacheVersion} from toolcache at ${latestVersionPath}`,
+    ];
+    for (const expectedMessage of expectedMessages) {
+      t.assert(
+        loggedMessages.some(
+          (msg) =>
+            typeof msg.message === "string" &&
+            msg.message.includes(expectedMessage),
+        ),
+        `Expected '${expectedMessage}' in the logger output, but didn't find it.`,
+      );
+    }
+  });
+});
+
+test("getCodeQLSource falls back to downloading the CLI if the toolcache doesn't have a CodeQL CLI when tools == toolcache", async (t) => {
+  const loggedMessages: LoggedMessage[] = [];
+  const logger = getRecordingLogger(loggedMessages);
+
+  process.env["GITHUB_EVENT_NAME"] = "dynamic";
+
+  const testVersions = [];
+  const findAllVersionsStub = sinon
+    .stub(toolcache, "findAllVersions")
+    .returns(testVersions);
+
+  await withTmpDir(async (tmpDir) => {
+    setupActionsVars(tmpDir, tmpDir);
+    const source = await setupCodeql.getCodeQLSource(
+      "toolcache",
+      SAMPLE_DEFAULT_CLI_VERSION,
+      SAMPLE_DOTCOM_API_DETAILS,
+      GitHubVariant.DOTCOM,
+      false,
+      logger,
+    );
+
+    // Check that the toolcache functions were called with the expected arguments
+    t.assert(
+      findAllVersionsStub.calledWith("CodeQL"),
+      `toolcache.findAllVersions("CodeQL") wasn't called`,
+    );
+
+    // Check that `sourceType` and `toolsVersion` match expectations.
+    t.is(source.sourceType, "download");
+    t.is(source.toolsVersion, SAMPLE_DEFAULT_CLI_VERSION.cliVersion);
+
+    // Check that key messages we would expect to find in the log are present.
+    const expectedMessages: string[] = [
+      `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: toolcache'.`,
+      `Found no CodeQL CLI in the toolcache, ignoring 'tools: toolcache'...`,
+    ];
+    for (const expectedMessage of expectedMessages) {
+      t.assert(
+        loggedMessages.some(
+          (msg) =>
+            typeof msg.message === "string" &&
+            msg.message.includes(expectedMessage),
+        ),
+        `Expected '${expectedMessage}' in the logger output, but didn't find it.`,
+      );
+    }
+  });
+});
+
 test('tryGetTagNameFromUrl extracts the right tag name for a repo name containing "codeql-bundle"', (t) => {
  t.is(
    setupCodeql.tryGetTagNameFromUrl(
@@ -263,3 +375,15 @@ test('tryGetTagNameFromUrl extracts the right tag name for a repo name containin
    "codeql-bundle-v2.19.0",
  );
 });
+
+test("getLatestToolcacheVersion returns undefined if there are no CodeQL CLIs in the toolcache", (t) => {
+  sinon.stub(toolcache, "findAllVersions").returns([]);
+  t.is(setupCodeql.getLatestToolcacheVersion(getRunnerLogger(true)), undefined);
+});
+
+test("getLatestToolcacheVersion returns latest version in the toolcache", (t) => {
+  const testVersions = ["2.3.1", "3.2.1", "1.2.3"];
+  sinon.stub(toolcache, "findAllVersions").returns(testVersions);
+
+  t.is(setupCodeql.getLatestToolcacheVersion(getRunnerLogger(true)), "3.2.1");
+});
@@ -7,7 +7,7 @@ import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";

-import { isRunningLocalAction } from "./actions-util";
+import { isDynamicWorkflow, isRunningLocalAction } from "./actions-util";
 import * as api from "./api-client";
 import * as defaults from "./defaults.json";
 import {
@@ -38,6 +38,7 @@ const CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";

 const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"];
 const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
+const CODEQL_TOOLCACHE_INPUT = "toolcache";

 function getCodeQLBundleExtension(
  compressionMethod: tar.CompressionMethod,
@@ -346,6 +347,44 @@ export async function getCodeQLSource(
        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required.",
      );
    }
+  } else if (
+    toolsInput !== undefined &&
+    toolsInput === CODEQL_TOOLCACHE_INPUT
+  ) {
+    let latestToolcacheVersion: string | undefined;
+
+    // We only allow `toolsInput === "toolcache"` for `dynamic` events. In general, using `toolsInput === "toolcache"`
+    // can lead to alert wobble and so it shouldn't be used for an analysis where results are intended to be uploaded.
+    // We also allow this in test mode.
+    const allowToolcacheValue = isDynamicWorkflow() || util.isInTestMode();
+    if (allowToolcacheValue) {
+      // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache
+      // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to
+      // the linked version.
+      logger.info(
+        `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.`,
+      );
+
+      latestToolcacheVersion = getLatestToolcacheVersion(logger);
+      if (latestToolcacheVersion) {
+        cliVersion = latestToolcacheVersion;
+      }
+    }
+
+    if (latestToolcacheVersion === undefined) {
+      if (allowToolcacheValue) {
+        logger.info(
+          `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`,
+        );
+      } else {
+        logger.warning(
+          `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`,
+        );
+      }
+
+      cliVersion = defaultCliVersion.cliVersion;
+      tagName = defaultCliVersion.tagName;
+    }
  } else if (toolsInput !== undefined) {
    // If a tools URL was provided, then use that.
    tagName = tryGetTagNameFromUrl(toolsInput, logger);
@@ -816,9 +855,38 @@ async function getNightlyToolsUrl(logger: Logger) {
  }
 }

+/**
+ * Gets the latest version of the CodeQL CLI that is available in the toolcache, or `undefined`
+ * if no CodeQL CLI is available in the toolcache.
+ *
+ * @param logger The logger to use.
+ * @returns The latest version of the CodeQL CLI that is available in the toolcache, or `undefined` if there is none.
+ */
+export function getLatestToolcacheVersion(logger: Logger): string | undefined {
+  const allVersions = toolcache
+    .findAllVersions("CodeQL")
+    .sort((a, b) => semver.compare(b, a));
+  logger.debug(
+    `Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
+      allVersions,
+    )}.`,
+  );
+
+  if (allVersions.length > 0) {
+    const latestToolcacheVersion = allVersions[0];
+    logger.info(
+      `CLI version ${latestToolcacheVersion} is the latest version in the toolcache.`,
+    );
+    return latestToolcacheVersion;
+  }
+
+  return undefined;
+}
+
 function isReservedToolsValue(tools: string): boolean {
  return (
    CODEQL_BUNDLE_VERSION_ALIAS.includes(tools) ||
-    CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools)
+    CODEQL_NIGHTLY_TOOLS_INPUTS.includes(tools) ||
+    tools === CODEQL_TOOLCACHE_INPUT
  );
 }
@@ -7,13 +7,23 @@ import { pki } from "node-forge";

 import * as actionsUtil from "./actions-util";
 import { getApiDetails, getAuthorizationHeaderFor } from "./api-client";
+import { Config } from "./config-utils";
+import { KnownLanguage } from "./languages";
 import { getActionsLogger, Logger } from "./logging";
 import {
  Credential,
  getCredentials,
  getDownloadUrl,
+  parseLanguage,
  UPDATEJOB_PROXY,
 } from "./start-proxy";
+import {
+  ActionName,
+  createStatusReportBase,
+  getActionsStatus,
+  sendStatusReport,
+  StatusReportBase,
+} from "./status-report";
 import * as util from "./util";

 const KEY_SIZE = 2048;
@@ -83,46 +93,111 @@ function generateCertificateAuthority(): CertificateAuthority {
  return { cert: pem, key };
 }

+interface StartProxyStatus extends StatusReportBase {
+  // A comma-separated list of registry types which are configured for CodeQL.
+  // This only includes registry types we support, not all that are configured.
+  registry_types: string;
+}
+
+async function sendSuccessStatusReport(
+  startedAt: Date,
+  config: Partial<Config>,
+  registry_types: string[],
+  logger: Logger,
+) {
+  const statusReportBase = await createStatusReportBase(
+    ActionName.StartProxy,
+    "success",
+    startedAt,
+    config,
+    await util.checkDiskUsage(logger),
+    logger,
+  );
+  if (statusReportBase !== undefined) {
+    const statusReport: StartProxyStatus = {
+      ...statusReportBase,
+      registry_types: registry_types.join(","),
+    };
+    await sendStatusReport(statusReport);
+  }
+}
+
 async function runWrapper() {
+  const startedAt = new Date();
+
  // Make inputs accessible in the `post` step.
  actionsUtil.persistInputs();

  const logger = getActionsLogger();
+  let language: KnownLanguage | undefined;

-  // Setup logging for the proxy
-  const tempDir = actionsUtil.getTemporaryDirectory();
-  const proxyLogFilePath = path.resolve(tempDir, "proxy.log");
-  core.saveState("proxy-log-file", proxyLogFilePath);
+  try {
+    // Setup logging for the proxy
+    const tempDir = actionsUtil.getTemporaryDirectory();
+    const proxyLogFilePath = path.resolve(tempDir, "proxy.log");
+    core.saveState("proxy-log-file", proxyLogFilePath);

-  // Get the configuration options
-  const credentials = getCredentials(
-    logger,
-    actionsUtil.getOptionalInput("registry_secrets"),
-    actionsUtil.getOptionalInput("registries_credentials"),
-    actionsUtil.getOptionalInput("language"),
-  );
+    // Get the configuration options
+    const languageInput = actionsUtil.getOptionalInput("language");
+    language = languageInput ? parseLanguage(languageInput) : undefined;
+    const credentials = getCredentials(
+      logger,
+      actionsUtil.getOptionalInput("registry_secrets"),
+      actionsUtil.getOptionalInput("registries_credentials"),
+      language,
+    );

-  if (credentials.length === 0) {
-    logger.info("No credentials found, skipping proxy setup.");
-    return;
+    if (credentials.length === 0) {
+      logger.info("No credentials found, skipping proxy setup.");
+      return;
+    }
+
+    logger.info(
+      `Credentials loaded for the following registries:\n ${credentials
+        .map((c) => credentialToStr(c))
+        .join("\n")}`,
+    );
+
+    const ca = generateCertificateAuthority();
+
+    const proxyConfig: ProxyConfig = {
+      all_credentials: credentials,
+      ca,
+    };
+
+    // Start the Proxy
+    const proxyBin = await getProxyBinaryPath(logger);
+    await startProxy(proxyBin, proxyConfig, proxyLogFilePath, logger);
+
+    // Report success if we have reached this point.
+    await sendSuccessStatusReport(
+      startedAt,
+      {
+        languages: language && [language],
+      },
+      proxyConfig.all_credentials.map((c) => c.type),
+      logger,
+    );
+  } catch (unwrappedError) {
+    const error = util.wrapError(unwrappedError);
+    core.setFailed(`start-proxy action failed: ${error.message}`);
+
+    // We skip sending the error message and stack trace here to avoid the possibility
+    // of leaking any sensitive information into the telemetry.
+    const errorStatusReportBase = await createStatusReportBase(
+      ActionName.StartProxy,
+      getActionsStatus(error),
+      startedAt,
+      {
+        languages: language && [language],
+      },
+      await util.checkDiskUsage(logger),
+      logger,
+    );
+    if (errorStatusReportBase !== undefined) {
+      await sendStatusReport(errorStatusReportBase);
+    }
  }
-
-  logger.info(
-    `Credentials loaded for the following registries:\n ${credentials
-      .map((c) => credentialToStr(c))
-      .join("\n")}`,
-  );
-
-  const ca = generateCertificateAuthority();
-
-  const proxyConfig: ProxyConfig = {
-    all_credentials: credentials,
-    ca,
-  };
-
-  // Start the Proxy
-  const proxyBin = await getProxyBinaryPath(logger);
-  await startProxy(proxyBin, proxyConfig, proxyLogFilePath, logger);
 }

 async function startProxy(
@@ -133,57 +208,53 @@ async function startProxy(
 ) {
  const host = "127.0.0.1";
  let port = 49152;
-  try {
-    let subprocess: ChildProcess | undefined = undefined;
-    let tries = 5;
-    let subprocessError: Error | undefined = undefined;
-    while (tries-- > 0 && !subprocess && !subprocessError) {
-      subprocess = spawn(
-        binPath,
-        ["-addr", `${host}:${port}`, "-config", "-", "-logfile", logFilePath],
-        {
-          detached: true,
-          stdio: ["pipe", "ignore", "ignore"],
-        },
-      );
-      subprocess.unref();
-      if (subprocess.pid) {
-        core.saveState("proxy-process-pid", `${subprocess.pid}`);
+  let subprocess: ChildProcess | undefined = undefined;
+  let tries = 5;
+  let subprocessError: Error | undefined = undefined;
+  while (tries-- > 0 && !subprocess && !subprocessError) {
+    subprocess = spawn(
+      binPath,
+      ["-addr", `${host}:${port}`, "-config", "-", "-logfile", logFilePath],
+      {
+        detached: true,
+        stdio: ["pipe", "ignore", "ignore"],
+      },
+    );
+    subprocess.unref();
+    if (subprocess.pid) {
+      core.saveState("proxy-process-pid", `${subprocess.pid}`);
+    }
+    subprocess.on("error", (error) => {
+      subprocessError = error;
+    });
+    subprocess.on("exit", (code) => {
+      if (code !== 0) {
+        // If the proxy failed to start, try a different port from the ephemeral range [49152, 65535]
+        port = Math.floor(Math.random() * (65535 - 49152) + 49152);
+        subprocess = undefined;
      }
-      subprocess.on("error", (error) => {
-        subprocessError = error;
-      });
-      subprocess.on("exit", (code) => {
-        if (code !== 0) {
-          // If the proxy failed to start, try a different port from the ephemeral range [49152, 65535]
-          port = Math.floor(Math.random() * (65535 - 49152) + 49152);
-          subprocess = undefined;
-        }
-      });
-      subprocess.stdin?.write(JSON.stringify(config));
-      subprocess.stdin?.end();
-      // Wait a little to allow the proxy to start
-      await util.delay(1000);
-    }
-    if (subprocessError) {
-      // eslint-disable-next-line @typescript-eslint/only-throw-error
-      throw subprocessError;
-    }
-    logger.info(`Proxy started on ${host}:${port}`);
-    core.setOutput("proxy_host", host);
-    core.setOutput("proxy_port", port.toString());
-    core.setOutput("proxy_ca_certificate", config.ca.cert);
-
-    const registry_urls = config.all_credentials
-      .filter((credential) => credential.url !== undefined)
-      .map((credential) => ({
-        type: credential.type,
-        url: credential.url,
-      }));
-    core.setOutput("proxy_urls", JSON.stringify(registry_urls));
-  } catch (error) {
-    core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`);
+    });
+    subprocess.stdin?.write(JSON.stringify(config));
+    subprocess.stdin?.end();
+    // Wait a little to allow the proxy to start
+    await util.delay(1000);
  }
+  if (subprocessError) {
+    // eslint-disable-next-line @typescript-eslint/only-throw-error
+    throw subprocessError;
+  }
+  logger.info(`Proxy started on ${host}:${port}`);
+  core.setOutput("proxy_host", host);
+  core.setOutput("proxy_port", port.toString());
+  core.setOutput("proxy_ca_certificate", config.ca.cert);
+
+  const registry_urls = config.all_credentials
+    .filter((credential) => credential.url !== undefined)
+    .map((credential) => ({
+      type: credential.type,
+      url: credential.url,
+    }));
+  core.setOutput("proxy_urls", JSON.stringify(registry_urls));
 }

 async function getProxyBinaryPath(logger: Logger): Promise<string> {
@@ -109,7 +109,7 @@ test("getCredentials filters by language when specified", async (t) => {
    getRunnerLogger(true),
    undefined,
    toEncodedJSON(mixedCredentials),
-    "java",
+    KnownLanguage.java,
  );
  t.is(credentials.length, 1);
  t.is(credentials[0].type, "maven_repository");
@@ -120,7 +120,7 @@ test("getCredentials returns all for a language when specified", async (t) => {
    getRunnerLogger(true),
    undefined,
    toEncodedJSON(mixedCredentials),
-    "go",
+    KnownLanguage.go,
  );
  t.is(credentials.length, 2);

@@ -79,9 +79,8 @@ export function getCredentials(
  logger: Logger,
  registrySecrets: string | undefined,
  registriesCredentials: string | undefined,
-  languageString: string | undefined,
+  language: KnownLanguage | undefined,
 ): Credential[] {
-  const language = languageString ? parseLanguage(languageString) : undefined;
  const registryTypeForLanguage = language
    ? LANGUAGE_TO_REGISTRY_TYPE[language]
    : undefined;
@@ -92,6 +92,49 @@ test("createStatusReportBase", async (t) => {
  });
 });

+test("createStatusReportBase - empty configuration", async (t) => {
+  await withTmpDir(async (tmpDir: string) => {
+    setupEnvironmentAndStub(tmpDir);
+
+    const statusReport = await createStatusReportBase(
+      ActionName.StartProxy,
+      "success",
+      new Date("May 19, 2023 05:19:00"),
+      {},
+      { numAvailableBytes: 100, numTotalBytes: 500 },
+      getRunnerLogger(false),
+    );
+
+    if (t.truthy(statusReport)) {
+      t.is(statusReport.action_name, ActionName.StartProxy);
+      t.is(statusReport.status, "success");
+    }
+  });
+});
+
+test("createStatusReportBase - partial configuration", async (t) => {
+  await withTmpDir(async (tmpDir: string) => {
+    setupEnvironmentAndStub(tmpDir);
+
+    const statusReport = await createStatusReportBase(
+      ActionName.StartProxy,
+      "success",
+      new Date("May 19, 2023 05:19:00"),
+      {
+        languages: ["go"],
+      },
+      { numAvailableBytes: 100, numTotalBytes: 500 },
+      getRunnerLogger(false),
+    );
+
+    if (t.truthy(statusReport)) {
+      t.is(statusReport.action_name, ActionName.StartProxy);
+      t.is(statusReport.status, "success");
+      t.is(statusReport.languages, "go");
+    }
+  });
+});
+
 test("createStatusReportBase_firstParty", async (t) => {
  await withTmpDir(async (tmpDir: string) => {
    setupEnvironmentAndStub(tmpDir);
@@ -36,11 +36,12 @@ import {
 } from "./util";

 export enum ActionName {
-  Autobuild = "autobuild",
  Analyze = "finish",
+  Autobuild = "autobuild",
  Init = "init",
  InitPost = "init-post",
  ResolveEnvironment = "resolve-environment",
+  StartProxy = "start-proxy",
  UploadSarif = "upload-sarif",
 }

@@ -259,7 +260,7 @@ export async function createStatusReportBase(
  actionName: ActionName,
  status: ActionStatus,
  actionStartedAt: Date,
-  config: Config | undefined,
+  config: Partial<Config> | undefined,
  diskInfo: DiskUsage | undefined,
  logger: Logger,
  cause?: string,
@@ -298,7 +299,7 @@ export async function createStatusReportBase(
      action_ref: actionRef,
      action_started_at: actionStartedAt.toISOString(),
      action_version: getActionVersion(),
-      analysis_kinds: config?.analysisKinds.join(","),
+      analysis_kinds: config?.analysisKinds?.join(","),
      analysis_key,
      build_mode: config?.buildMode,
      commit_oid: commitOid,
@@ -323,7 +324,7 @@ export async function createStatusReportBase(
    }

    if (config) {
-      statusReport.languages = config.languages.join(",");
+      statusReport.languages = config.languages?.join(",");
    }

    if (diskInfo) {
@@ -374,6 +375,12 @@ export async function createStatusReportBase(
    logger.warning(
      `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`,
    );
+
+    // Re-throw the exception in test mode. While testing, we want to know if something goes wrong here.
+    if (isInTestMode()) {
+      throw e;
+    }
+
    return undefined;
  }
 }
@@ -3,7 +3,7 @@ import * as path from "path";

 import test from "ava";

-import { CodeQuality, CodeScanning } from "./analyses";
+import { AnalysisKind, CodeQuality, CodeScanning } from "./analyses";
 import { getRunnerLogger, Logger } from "./logging";
 import { setupTests } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
@@ -127,27 +127,97 @@ test("finding SARIF files", async (t) => {
    fs.writeFileSync(path.join(tmpDir, "a.quality.sarif"), "");
    fs.writeFileSync(path.join(tmpDir, "dir1", "b.quality.sarif"), "");

+    const expectedSarifFiles = [
+      path.join(tmpDir, "a.sarif"),
+      path.join(tmpDir, "b.sarif"),
+      path.join(tmpDir, "dir1", "d.sarif"),
+      path.join(tmpDir, "dir1", "dir2", "e.sarif"),
+    ];
    const sarifFiles = uploadLib.findSarifFilesInDir(
      tmpDir,
      CodeScanning.sarifPredicate,
    );

-    t.deepEqual(sarifFiles, [
-      path.join(tmpDir, "a.sarif"),
-      path.join(tmpDir, "b.sarif"),
-      path.join(tmpDir, "dir1", "d.sarif"),
-      path.join(tmpDir, "dir1", "dir2", "e.sarif"),
-    ]);
+    t.deepEqual(sarifFiles, expectedSarifFiles);

+    const expectedQualitySarifFiles = [
+      path.join(tmpDir, "a.quality.sarif"),
+      path.join(tmpDir, "dir1", "b.quality.sarif"),
+    ];
    const qualitySarifFiles = uploadLib.findSarifFilesInDir(
      tmpDir,
      CodeQuality.sarifPredicate,
    );

-    t.deepEqual(qualitySarifFiles, [
-      path.join(tmpDir, "a.quality.sarif"),
-      path.join(tmpDir, "dir1", "b.quality.sarif"),
-    ]);
+    t.deepEqual(qualitySarifFiles, expectedQualitySarifFiles);
+
+    const groupedSarifFiles = await uploadLib.getGroupedSarifFilePaths(
+      getRunnerLogger(true),
+      tmpDir,
+    );
+
+    t.not(groupedSarifFiles, undefined);
+    t.not(groupedSarifFiles[AnalysisKind.CodeScanning], undefined);
+    t.not(groupedSarifFiles[AnalysisKind.CodeQuality], undefined);
+    t.deepEqual(
+      groupedSarifFiles[AnalysisKind.CodeScanning],
+      expectedSarifFiles,
+    );
+    t.deepEqual(
+      groupedSarifFiles[AnalysisKind.CodeQuality],
+      expectedQualitySarifFiles,
+    );
+  });
+});
+
+test("getGroupedSarifFilePaths - Code Quality file", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const sarifPath = path.join(tmpDir, "a.quality.sarif");
+    fs.writeFileSync(sarifPath, "");
+
+    const groupedSarifFiles = await uploadLib.getGroupedSarifFilePaths(
+      getRunnerLogger(true),
+      sarifPath,
+    );
+
+    t.not(groupedSarifFiles, undefined);
+    t.is(groupedSarifFiles[AnalysisKind.CodeScanning], undefined);
+    t.not(groupedSarifFiles[AnalysisKind.CodeQuality], undefined);
+    t.deepEqual(groupedSarifFiles[AnalysisKind.CodeQuality], [sarifPath]);
+  });
+});
+
+test("getGroupedSarifFilePaths - Code Scanning file", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const sarifPath = path.join(tmpDir, "a.sarif");
+    fs.writeFileSync(sarifPath, "");
+
+    const groupedSarifFiles = await uploadLib.getGroupedSarifFilePaths(
+      getRunnerLogger(true),
+      sarifPath,
+    );
+
+    t.not(groupedSarifFiles, undefined);
+    t.not(groupedSarifFiles[AnalysisKind.CodeScanning], undefined);
+    t.is(groupedSarifFiles[AnalysisKind.CodeQuality], undefined);
+    t.deepEqual(groupedSarifFiles[AnalysisKind.CodeScanning], [sarifPath]);
+  });
+});
+
+test("getGroupedSarifFilePaths - Other file", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const sarifPath = path.join(tmpDir, "a.json");
+    fs.writeFileSync(sarifPath, "");
+
+    const groupedSarifFiles = await uploadLib.getGroupedSarifFilePaths(
+      getRunnerLogger(true),
+      sarifPath,
+    );
+
+    t.not(groupedSarifFiles, undefined);
+    t.not(groupedSarifFiles[AnalysisKind.CodeScanning], undefined);
+    t.is(groupedSarifFiles[AnalysisKind.CodeQuality], undefined);
+    t.deepEqual(groupedSarifFiles[AnalysisKind.CodeScanning], [sarifPath]);
  });
 });

@@ -352,28 +352,27 @@ async function uploadPayload(
  payload: any,
  repositoryNwo: RepositoryNwo,
  logger: Logger,
-  target: analyses.SARIF_UPLOAD_ENDPOINT,
+  analysis: analyses.AnalysisConfig,
 ): Promise<string> {
  logger.info("Uploading results");

-  // If in test mode we don't want to upload the results
-  if (util.isInTestMode()) {
+  if (util.shouldSkipSarifUpload()) {
    const payloadSaveFile = path.join(
      actionsUtil.getTemporaryDirectory(),
-      "payload.json",
+      `payload-${analysis.kind}.json`,
    );
    logger.info(
-      `In test mode. Results are not uploaded. Saving to ${payloadSaveFile}`,
+      `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`,
    );
    logger.info(`Payload: ${JSON.stringify(payload, null, 2)}`);
    fs.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
-    return "test-mode-sarif-id";
+    return "dummy-sarif-id";
  }

  const client = api.getApiClient();

  try {
-    const response = await client.request(target, {
+    const response = await client.request(analysis.target, {
      owner: repositoryNwo.owner,
      repo: repositoryNwo.repo,
      data: payload,
@@ -459,6 +458,79 @@ export function getSarifFilePaths(
  return sarifFiles;
 }

+type GroupedSarifFiles = Partial<Record<analyses.AnalysisKind, string[]>>;
+
+/**
+ * Finds SARIF files in `sarifPath`, and groups them by analysis kind, following `SarifScanOrder`.
+ *
+ * @param logger The logger to use.
+ * @param sarifPath The path of a file or directory to recursively scan for SARIF files.
+ * @returns The `.sarif` files found in `sarifPath`, grouped by analysis kind.
+ */
+export async function getGroupedSarifFilePaths(
+  logger: Logger,
+  sarifPath: string,
+): Promise<GroupedSarifFiles> {
+  const stats = fs.statSync(sarifPath, { throwIfNoEntry: false });
+
+  if (stats === undefined) {
+    // This is always a configuration error, even for first-party runs.
+    throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
+  }
+
+  const results: GroupedSarifFiles = {};
+
+  if (stats.isDirectory()) {
+    let unassignedSarifFiles = findSarifFilesInDir(
+      sarifPath,
+      (name) => path.extname(name) === ".sarif",
+    );
+    logger.debug(
+      `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}`,
+    );
+
+    for (const analysisConfig of analyses.SarifScanOrder) {
+      const filesForCurrentAnalysis = unassignedSarifFiles.filter(
+        analysisConfig.sarifPredicate,
+      );
+      if (filesForCurrentAnalysis.length > 0) {
+        logger.debug(
+          `The following SARIF files are for ${analysisConfig.name}: ${filesForCurrentAnalysis.join(", ")}`,
+        );
+        // Looping through the array a second time is not efficient, but more readable.
+        // Change this to one loop for both calls to `filter` if this becomes a bottleneck.
+        unassignedSarifFiles = unassignedSarifFiles.filter(
+          (name) => !analysisConfig.sarifPredicate(name),
+        );
+        results[analysisConfig.kind] = filesForCurrentAnalysis;
+      } else {
+        logger.debug(`Found no SARIF files for ${analysisConfig.name}`);
+      }
+    }
+
+    if (unassignedSarifFiles.length !== 0) {
+      logger.warning(
+        `Found files in ${sarifPath} which do not belong to any analysis: ${unassignedSarifFiles.join(", ")}`,
+      );
+    }
+  } else {
+    for (const analysisConfig of analyses.SarifScanOrder) {
+      if (
+        analysisConfig.kind === analyses.AnalysisKind.CodeScanning ||
+        analysisConfig.sarifPredicate(sarifPath)
+      ) {
+        logger.debug(
+          `Using '${sarifPath}' as a SARIF file for ${analysisConfig.name}.`,
+        );
+        results[analysisConfig.kind] = [sarifPath];
+        break;
+      }
+    }
+  }
+
+  return results;
+}
+
 // Counts the number of results in the given SARIF file
 function countResultsInSarif(sarif: string): number {
  let numResults = 0;
@@ -655,6 +727,7 @@ export async function uploadSpecifiedFiles(
  const gitHubVersion = await getGitHubVersion();

  let sarif: SarifFile;
+  category = uploadTarget.fixCategory(logger, category);

  if (sarifPaths.length > 1) {
    // Validate that the files we were asked to upload are all valid SARIF files
@@ -733,7 +806,7 @@ export async function uploadSpecifiedFiles(
    payload,
    getRepositoryNwo(),
    logger,
-    uploadTarget.target,
+    uploadTarget,
  );

  logger.endGroup();
@@ -23,7 +23,7 @@ import {
  checkDiskUsage,
  getErrorMessage,
  initializeEnvironment,
-  isInTestMode,
+  shouldSkipSarifUpload,
  wrapError,
 } from "./util";

@@ -113,8 +113,10 @@ async function run() {
    core.setOutput("sarif-ids", JSON.stringify(uploadResults));

    // We don't upload results in test mode, so don't wait for processing
-    if (isInTestMode()) {
-      core.debug("In test mode. Waiting for processing is disabled.");
+    if (shouldSkipSarifUpload()) {
+      core.debug(
+        "SARIF upload disabled by an environment variable. Waiting for processing is disabled.",
+      );
    } else if (actionsUtil.getRequiredInput("wait-for-processing") === "true") {
      if (codeScanningResult !== undefined) {
        await upload_lib.waitForProcessing(
@@ -4,87 +4,16 @@ import * as path from "path";
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";

-import {
-  AnalysisConfig,
-  AnalysisKind,
-  CodeQuality,
-  CodeScanning,
-} from "./analyses";
+import { AnalysisKind, getAnalysisConfig } from "./analyses";
 import { getRunnerLogger } from "./logging";
 import { createFeatures, setupTests } from "./testing-utils";
 import { UploadResult } from "./upload-lib";
 import * as uploadLib from "./upload-lib";
-import { findAndUpload, uploadSarif } from "./upload-sarif";
+import { uploadSarif } from "./upload-sarif";
 import * as util from "./util";

 setupTests(test);

-const findAndUploadMacro = test.macro({
-  exec: async (
-    t: ExecutionContext<unknown>,
-    sarifFiles: string[],
-    analysis: AnalysisConfig,
-    sarifPath: (tempDir: string) => string = (tempDir) => tempDir,
-    expectedResult: UploadResult | undefined,
-  ) => {
-    await util.withTmpDir(async (tempDir) => {
-      sinon.stub(uploadLib, "uploadSpecifiedFiles").resolves(expectedResult);
-      const logger = getRunnerLogger(true);
-      const features = createFeatures([]);
-
-      for (const sarifFile of sarifFiles) {
-        fs.writeFileSync(path.join(tempDir, sarifFile), "");
-      }
-
-      const stats = fs.statSync(sarifPath(tempDir));
-      const actual = await findAndUpload(
-        logger,
-        features,
-        sarifPath(tempDir),
-        stats,
-        "",
-        analysis,
-      );
-
-      t.deepEqual(actual, expectedResult);
-    });
-  },
-  title: (providedTitle = "") => `findAndUpload - ${providedTitle}`,
-});
-
-test(
-  "no matching files",
-  findAndUploadMacro,
-  ["test.json"],
-  CodeScanning,
-  undefined,
-  undefined,
-);
-
-test(
-  "matching files for Code Scanning with directory path",
-  findAndUploadMacro,
-  ["test.sarif"],
-  CodeScanning,
-  undefined,
-  {
-    statusReport: {},
-    sarifID: "some-id",
-  },
-);
-
-test(
-  "matching files for Code Scanning with file path",
-  findAndUploadMacro,
-  ["test.sarif"],
-  CodeScanning,
-  (tempDir) => path.join(tempDir, "test.sarif"),
-  {
-    statusReport: {},
-    sarifID: "some-id",
-  },
-);
-
 interface UploadSarifExpectedResult {
  uploadResult?: UploadResult;
  expectedFiles?: string[];
@@ -117,9 +46,7 @@ const uploadSarifMacro = test.macro({
            sinon.match.any,
            features,
            logger,
-            analysisKind === AnalysisKind.CodeScanning
-              ? CodeScanning
-              : CodeQuality,
+            getAnalysisConfig(analysisKind),
          )
          .resolves(expectedResult[analysisKind as AnalysisKind]?.uploadResult);
      }
@@ -146,9 +73,7 @@ const uploadSarifMacro = test.macro({
              sinon.match.any,
              features,
              logger,
-              analysisKind === AnalysisKind.CodeScanning
-                ? CodeScanning
-                : CodeQuality,
+              getAnalysisConfig(analysisKind),
            ),
          );
        } else {
@@ -164,9 +89,7 @@ const uploadSarifMacro = test.macro({
              sinon.match.any,
              features,
              logger,
-              analysisKind === AnalysisKind.CodeScanning
-                ? CodeScanning
-                : CodeQuality,
+              getAnalysisConfig(analysisKind),
            ),
            `uploadSpecifiedFiles was called for ${analysisKind}, but should not have been.`,
          );
@@ -1,65 +1,8 @@
-import * as fs from "fs";
-
-import * as actionsUtil from "./actions-util";
 import * as analyses from "./analyses";
 import { FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
 import * as upload_lib from "./upload-lib";
-import { ConfigurationError } from "./util";
-
-/**
- * Searches for SARIF files for the given `analysis` in the given `sarifPath`.
- * If any are found, then they are uploaded to the appropriate endpoint for the given `analysis`.
- *
- * @param logger The logger to use.
- * @param features Information about FFs.
- * @param sarifPath The path to a SARIF file or directory containing SARIF files.
- * @param pathStats Information about `sarifPath`.
- * @param checkoutPath The checkout path.
- * @param analysis The configuration of the analysis we should upload SARIF files for.
- * @param category The SARIF category to use for the upload.
- * @returns The result of uploading the SARIF file(s) or `undefined` if there are none.
- */
-export async function findAndUpload(
-  logger: Logger,
-  features: FeatureEnablement,
-  sarifPath: string,
-  pathStats: fs.Stats,
-  checkoutPath: string,
-  analysis: analyses.AnalysisConfig,
-  category?: string,
-): Promise<upload_lib.UploadResult | undefined> {
-  let sarifFiles: string[] | undefined;
-
-  if (pathStats.isDirectory()) {
-    sarifFiles = upload_lib.findSarifFilesInDir(
-      sarifPath,
-      analysis.sarifPredicate,
-    );
-  } else if (
-    pathStats.isFile() &&
-    (analysis.sarifPredicate(sarifPath) ||
-      (analysis.kind === analyses.AnalysisKind.CodeScanning &&
-        !analyses.CodeQuality.sarifPredicate(sarifPath)))
-  ) {
-    sarifFiles = [sarifPath];
-  } else {
-    return undefined;
-  }
-
-  if (sarifFiles.length !== 0) {
-    return await upload_lib.uploadSpecifiedFiles(
-      sarifFiles,
-      checkoutPath,
-      category,
-      features,
-      logger,
-      analysis,
-    );
-  }
-
-  return undefined;
-}
+import { unsafeEntriesInvariant } from "./util";

 // Maps analysis kinds to SARIF IDs.
 export type UploadSarifResults = Partial<
@@ -84,38 +27,24 @@ export async function uploadSarif(
  sarifPath: string,
  category?: string,
 ): Promise<UploadSarifResults> {
-  const pathStats = fs.lstatSync(sarifPath, { throwIfNoEntry: false });
-
-  if (pathStats === undefined) {
-    throw new ConfigurationError(`Path does not exist: ${sarifPath}.`);
-  }
+  const sarifGroups = await upload_lib.getGroupedSarifFilePaths(
+    logger,
+    sarifPath,
+  );

  const uploadResults: UploadSarifResults = {};
-  const uploadResult = await findAndUpload(
-    logger,
-    features,
-    sarifPath,
-    pathStats,
-    checkoutPath,
-    analyses.CodeScanning,
-    category,
-  );
-  if (uploadResult !== undefined) {
-    uploadResults[analyses.AnalysisKind.CodeScanning] = uploadResult;
-  }
-
-  // If there are `.quality.sarif` files in `sarifPath`, then upload those to the code quality service.
-  const qualityUploadResult = await findAndUpload(
-    logger,
-    features,
-    sarifPath,
-    pathStats,
-    checkoutPath,
-    analyses.CodeQuality,
-    actionsUtil.fixCodeQualityCategory(logger, category),
-  );
-  if (qualityUploadResult !== undefined) {
-    uploadResults[analyses.AnalysisKind.CodeQuality] = qualityUploadResult;
+  for (const [analysisKind, sarifFiles] of unsafeEntriesInvariant(
+    sarifGroups,
+  )) {
+    const analysisConfig = analyses.getAnalysisConfig(analysisKind);
+    uploadResults[analysisKind] = await upload_lib.uploadSpecifiedFiles(
+      sarifFiles,
+      checkoutPath,
+      category,
+      features,
+      logger,
+      analysisConfig,
+    );
  }

  return uploadResults;
@@ -764,12 +764,19 @@ export function isGoodVersion(versionSpec: string) {
 /**
 * Returns whether we are in test mode. This is used by CodeQL Action PR checks.
 *
- * In test mode, we don't upload SARIF results or status reports to the GitHub API.
+ * In test mode, we skip several uploads (SARIF results, status reports, DBs, ...).
 */
 export function isInTestMode(): boolean {
  return process.env[EnvVar.TEST_MODE] === "true";
 }

+/**
+ * Returns whether we specifically want to skip uploading SARIF files.
+ */
+export function shouldSkipSarifUpload(): boolean {
+  return isInTestMode() || process.env[EnvVar.SKIP_SARIF_UPLOAD] === "true";
+}
+
 /**
 * Get the testing environment.
 *
@@ -1287,3 +1294,27 @@ export async function asyncSome<T>(
 export function isDefined<T>(value: T | null | undefined): value is T {
  return value !== undefined && value !== null;
 }
+
+/** Like `Object.keys`, but typed so that the elements of the resulting array have the
+ * same type as the keys of the input object. Note that this may not be sound if the input
+ * object has been cast to `T` from a subtype of `T` and contains additional keys that
+ * are not represented by `keyof T`.
+ */
+export function unsafeKeysInvariant<T extends Record<string, any>>(
+  object: T,
+): Array<keyof T> {
+  return Object.keys(object) as Array<keyof T>;
+}
+
+/** Like `Object.entries`, but typed so that the key elements of the result have the
+ * same type as the keys of the input object. Note that this may not be sound if the input
+ * object has been cast to `T` from a subtype of `T` and contains additional keys that
+ * are not represented by `keyof T`.
+ */
+export function unsafeEntriesInvariant<T extends Record<string, any>>(
+  object: T,
+): Array<[keyof T, Exclude<T[keyof T], undefined>]> {
+  return Object.entries(object).filter(
+    ([_, val]) => val !== undefined,
+  ) as Array<[keyof T, Exclude<T[keyof T], undefined>]>;
+}
@@ -395,9 +395,9 @@ async function testLanguageAliases(
            },
          },
          steps: [
-            { uses: "actions/checkout@v3" },
-            { uses: "github/codeql-action/init@v3" },
-            { uses: "github/codeql-action/analyze@v3" },
+            { uses: "actions/checkout@v4" },
+            { uses: "github/codeql-action/init@v4" },
+            { uses: "github/codeql-action/analyze@v4" },
          ],
        },
      },
@@ -666,7 +666,7 @@ test("getWorkflowErrors() should report a warning if different versions of the C
        analyze:
          steps:
            - uses: github/codeql-action/init@v2
-            - uses: github/codeql-action/analyze@v3
+            - uses: github/codeql-action/analyze@v4
    `) as Workflow,
    await getCodeQLForTesting(),
  );
@@ -686,8 +686,8 @@ test("getWorkflowErrors() should not report a warning if the same versions of th
      jobs:
        analyze:
          steps:
-            - uses: github/codeql-action/init@v3
-            - uses: github/codeql-action/analyze@v3
+            - uses: github/codeql-action/init@v4
+            - uses: github/codeql-action/analyze@v4
    `) as Workflow,
    await getCodeQLForTesting(),
  );
@@ -706,7 +706,7 @@ test("getWorkflowErrors() should not report a warning involving versions of othe
        analyze:
          steps:
            - uses: actions/checkout@v5
-            - uses: github/codeql-action/init@v3
+            - uses: github/codeql-action/init@v4
    `) as Workflow,
    await getCodeQLForTesting(),
  );
@@ -723,9 +723,9 @@ test("getCategoryInputOrThrow returns category for simple workflow with category
          analysis:
            runs-on: ubuntu-latest
            steps:
-              - uses: actions/checkout@v3
-              - uses: github/codeql-action/init@v3
-              - uses: github/codeql-action/analyze@v3
+              - uses: actions/checkout@v4
+              - uses: github/codeql-action/init@v4
+              - uses: github/codeql-action/analyze@v4
                with:
                  category: some-category
      `) as Workflow,
@@ -745,9 +745,9 @@ test("getCategoryInputOrThrow returns undefined for simple workflow without cate
          analysis:
            runs-on: ubuntu-latest
            steps:
-              - uses: actions/checkout@v3
-              - uses: github/codeql-action/init@v3
-              - uses: github/codeql-action/analyze@v3
+              - uses: actions/checkout@v4
+              - uses: github/codeql-action/init@v4
+              - uses: github/codeql-action/analyze@v4
      `) as Workflow,
      "analysis",
      {},
@@ -765,19 +765,19 @@ test("getCategoryInputOrThrow returns category for workflow with multiple jobs",
          foo:
            runs-on: ubuntu-latest
            steps:
-              - uses: actions/checkout@v3
-              - uses: github/codeql-action/init@v3
+              - uses: actions/checkout@v4
+              - uses: github/codeql-action/init@v4
              - runs: ./build foo
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                with:
                  category: foo-category
          bar:
            runs-on: ubuntu-latest
            steps:
-              - uses: actions/checkout@v3
-              - uses: github/codeql-action/init@v3
+              - uses: actions/checkout@v4
+              - uses: github/codeql-action/init@v4
              - runs: ./build bar
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                with:
                  category: bar-category
      `) as Workflow,
@@ -800,11 +800,11 @@ test("getCategoryInputOrThrow finds category for workflow with language matrix",
              matrix:
                language: [javascript, python]
            steps:
-              - uses: actions/checkout@v3
-              - uses: github/codeql-action/init@v3
+              - uses: actions/checkout@v4
+              - uses: github/codeql-action/init@v4
                with:
                  language: \${{ matrix.language }}
-              - uses: github/codeql-action/analyze@v3
+              - uses: github/codeql-action/analyze@v4
                with:
                  category: "/language:\${{ matrix.language }}"
      `) as Workflow,
@@ -824,9 +824,9 @@ test("getCategoryInputOrThrow throws error for workflow with dynamic category",
          jobs:
            analysis:
              steps:
-                - uses: actions/checkout@v3
-                - uses: github/codeql-action/init@v3
-                - uses: github/codeql-action/analyze@v3
+                - uses: actions/checkout@v4
+                - uses: github/codeql-action/init@v4
+                - uses: github/codeql-action/analyze@v4
                  with:
                    category: "\${{ github.workflow }}"
        `) as Workflow,
@@ -851,12 +851,12 @@ test("getCategoryInputOrThrow throws error for workflow with multiple calls to a
            analysis:
              runs-on: ubuntu-latest
              steps:
-                - uses: actions/checkout@v3
-                - uses: github/codeql-action/init@v3
-                - uses: github/codeql-action/analyze@v3
+                - uses: actions/checkout@v4
+                - uses: github/codeql-action/init@v4
+                - uses: github/codeql-action/analyze@v4
                  with:
                    category: some-category
-                - uses: github/codeql-action/analyze@v3
+                - uses: github/codeql-action/analyze@v4
                  with:
                    category: another-category
        `) as Workflow,
@@ -16,6 +16,9 @@ inputs:
  language:
    description: The programming language to setup the proxy for the correct ecosystem
    required: false
+  matrix:
+    default: ${{ toJson(matrix) }}
+    required: false
 outputs:
  proxy_host:
    description: The IP address of the proxy
@@ -26,6 +29,6 @@ outputs:
  proxy_urls:
    description: A stringified JSON array of objects containing the types and URLs of the configured registries.
 runs:
-  using: node20
+  using: node24
  main: "../lib/start-proxy-action.js"
  post: "../lib/start-proxy-action-post.js"
@@ -41,6 +41,6 @@ outputs:

      { "code-scanning": "some-id", "code-quality": "some-other-id" }
 runs:
-  using: node20
+  using: node24
  main: '../lib/upload-sarif-action.js'
  post: '../lib/upload-sarif-action-post.js'
Author	SHA1	Message	Date
Alex Eyers-Taylor	5a8e345008	Fix linitng issues.	2025-10-10 14:26:40 +01:00
Alex Eyers-Taylor	f030ca35d0	Pass changed files in code ratehr than by file-system.	2025-10-09 21:05:00 +01:00
Alex Eyers-Taylor	6a32dd9374	Include diff-edidted files in overlay changes.	2025-10-09 20:47:37 +01:00
Alex Eyers-Taylor	4c0acfe29e	Consume precomputed diff ranges in analyze and avoid getting them from the API.	2025-10-09 20:47:04 +01:00
Alex Eyers-Taylor	9bb8375aed	Persist PR diff ranges early during init We don't use them yet and will re-save them during analysis.	2025-10-09 20:46:30 +01:00
Alex Eyers-Taylor	56b69c76aa	Extract diff range computation into utils for reuse	2025-10-09 20:46:16 +01:00
Henry Mercer	6fd4ceb7bb	Merge pull request #3189 from github/henrymercer/download-codeql-rate-limit Add configuration error for rate limited CodeQL download	2025-10-08 15:11:29 +01:00
Michael B. Gale	196a3e577b	Merge pull request #3188 from github/mbg/telemetry/partial-config Allow `Partial<Config>` for `createStatusReportBase`	2025-10-08 14:59:05 +01:00
Henry Mercer	98abb870dc	Add configuration error for rate limited CodeQL download	2025-10-08 14:43:54 +01:00
Michael B. Gale	bdd2cdf891	Also include `language` in error status report for `start-proxy`, if available	2025-10-08 13:13:04 +01:00
Michael B. Gale	fb148789ab	Include `languages` in `start-proxy` telemetry	2025-10-08 13:01:35 +01:00
Michael B. Gale	2ff418f28a	Parse `language` before calling `getCredentials`	2025-10-08 13:01:35 +01:00
Michael B. Gale	527501d15d	Allow `createStatusReportBase` to accept a `Partial<Config>`	2025-10-08 13:01:35 +01:00
Paolo Tranquilli	8301b8b096	Merge pull request #3180 from github/redsun82/skip-sarif-upload Introduce `CODEQL_ACTION_SKIP_SARIF_UPLOAD`	2025-10-08 12:09:54 +02:00
Nick Rolfe	7bdfa9736a	Merge pull request #3184 from github/nickrolfe/go-overlay Overlays: allow any build mode for Go	2025-10-08 10:48:40 +01:00
Paolo Tranquilli	1707898e5b	Merge branch 'main' into redsun82/skip-sarif-upload	2025-10-08 09:34:05 +02:00
Paolo Tranquilli	d05f2255a0	Tweak comment	2025-10-08 09:34:01 +02:00
Nick Rolfe	7892cb2362	Overlays: allow any build mode for Go We have a check that a traced language can only run overlay analysis with build-mode: none, but Go does not currently declare support for BMN, even though it has a similar autobuild mode that will work for overlay analysis. This commit adds a hard-coded exception to that check, allowing any build mode for Go. This is intended as a short-term solution until Go declares BMN support. It should be safe, since we can choose not to enable the feature flag for Go repos using traced builds.	2025-10-07 17:45:08 +01:00
Mario Campos	8a6b62bc2d	Merge pull request #3186 from github/mergeback/v4.30.7-to-main-e296a935 Mergeback v4.30.7 refs/heads/releases/v4 into main	2025-10-07 11:20:49 -05:00
github-actions[bot]	d95a3b53f8	Rebuild	2025-10-07 16:01:48 +00:00
github-actions[bot]	257e42ce3d	Merge remote-tracking branch 'origin/main' into mergeback/v4.30.7-to-main-e296a935	2025-10-07 16:01:00 +00:00
github-actions[bot]	074940162c	Update changelog and version after v4.30.7	2025-10-07 15:22:00 +00:00
Mario Campos	e296a93559	Merge pull request #3183 from github/update-v4.30.7-55283843c Merge main into releases/v4	2025-10-07 10:21:14 -05:00
Paolo Tranquilli	df65651d4f	Merge branch 'main' into redsun82/skip-sarif-upload	2025-10-07 17:17:13 +02:00
Paolo Tranquilli	1b09eb4ccc	Address review	2025-10-07 17:17:06 +02:00
Michael B. Gale	2f11c17b09	Merge pull request #3175 from github/mbg/setup/toolcache Support requesting latest version from toolcache with `tools: toolcache`	2025-10-07 10:32:03 +01:00
Michael B. Gale	0ba4970165	Merge branch 'main' into mbg/setup/toolcache	2025-10-07 10:09:12 +01:00
Michael B. Gale	5431b6a308	Merge pull request #3176 from github/mbg/pr-template/tests Add more questions to the PR template	2025-10-07 10:05:07 +01:00
Michael B. Gale	7f5db167b6	Merge branch 'main' into mbg/pr-template/tests	2025-10-07 09:48:29 +01:00
Michael B. Gale	239d7b286f	Merge pull request #3181 from github/mbg/pr-checks/upload-sarif Add more end-to-end tests for `upload-sarif`	2025-10-07 09:48:05 +01:00
Paolo Tranquilli	86b2ad6646	Remove unneeded comment	2025-10-07 10:36:45 +02:00
Paolo Tranquilli	5dfb610e99	Merge branch 'main' into redsun82/skip-sarif-upload	2025-10-07 10:36:12 +02:00
Henry Mercer	1491baa17e	Merge branch 'main' into mbg/pr-checks/upload-sarif	2025-10-07 09:28:42 +01:00
Henry Mercer	db562a696f	Merge pull request #3182 from github/dependabot/npm_and_yarn/npm-b02b6854f6 Bump the npm group with 4 updates	2025-10-07 09:16:58 +01:00
github-actions[bot]	93c16735fa	Update changelog for v4.30.7	2025-10-06 18:19:26 +00:00
Mario Campos	55283843ca	Merge pull request #3169 from github/mario-campos/node24 [v4] Upgrade Node.js runtime from v20 to v24	2025-10-06 12:52:46 -05:00
github-actions[bot]	6877465dc1	Rebuild	2025-10-06 17:03:52 +00:00
dependabot[bot]	ff23a55f4d	Bump the npm group with 4 updates Bumps the npm group with 4 updates: [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin), [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) and [typescript](https://github.com/microsoft/TypeScript). Updates `@eslint/js` from 9.36.0 to 9.37.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.37.0/packages/js) Updates `@typescript-eslint/eslint-plugin` from 8.44.1 to 8.45.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.45.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.44.1 to 8.45.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.45.0/packages/parser) Updates `typescript` from 5.9.2 to 5.9.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml) - [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.2...v5.9.3) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 9.37.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.45.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/parser" dependency-version: 8.45.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: typescript dependency-version: 5.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-06 17:02:21 +00:00
Mario Campos	b66db86c84	Hoist CHANGELOG note back to "UNRELEASED" section.	2025-10-06 11:40:43 -05:00
Paolo Tranquilli	00a6e13cbf	Tweak SARIF skipping logs	2025-10-06 17:03:29 +02:00
Paolo Tranquilli	25c8db918a	Revert "Specify reason for skipping SARIF upload in logs" This reverts commit `680b07003d`.	2025-10-06 16:59:45 +02:00
Michael B. Gale	dabf6fc578	Adjust step names to be clearer	2025-10-06 15:40:35 +01:00
Michael B. Gale	14c5d77032	Fix: Update `payload.json` path in `with-checkout-path` test	2025-10-06 15:28:40 +01:00
Michael B. Gale	380e002752	Add explicit `category` values	2025-10-06 15:15:43 +01:00
Paolo Tranquilli	680b07003d	Specify reason for skipping SARIF upload in logs	2025-10-06 15:39:29 +02:00
Michael B. Gale	22aba57acf	Include analysis kind in `payloadSaveFile` path in `uploadPayload`	2025-10-06 14:30:30 +01:00
Paolo Tranquilli	11e4034414	Clarify comment about SKIP_SARIF_UPLOAD setting	2025-10-06 15:23:18 +02:00
Paolo Tranquilli	882667e383	Update src/util.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-10-06 15:22:34 +02:00
Michael B. Gale	6f964b7776	Cover more cases in `upload-sarif` check	2025-10-06 14:10:49 +01:00
Michael B. Gale	6bdf5d3d00	Run `upload-sarif` check for all `analysis-kinds` values	2025-10-06 13:56:19 +01:00
Michael B. Gale	9b3ade946d	Rename `upload-quality-sarif.yml` workflow	2025-10-06 13:50:21 +01:00
Paolo Tranquilli	e0b9da7b0a	Introduce `CODEQL_ACTION_SKIP_SARIF_UPLOAD` This triggers a subset of the behavior of `CODEQL_ACTION_TEST_MODE`, specifically just skipping the SARIF upload step. This is required for our internal testing where we want the SARIF file (via `CODEQL_ACTION_DUMP_SARIF_DIR`) but don't want to actually upload it, but we don't want the rest of the behaviour of `CODEQL_ACTION_TEST_MODE` that is specific for `codeql-action` own CI checks.	2025-10-06 14:38:32 +02:00
Michael B. Gale	726a341ed4	Restrict when `tools: toolcache` can be used	2025-10-06 13:16:16 +01:00
Michael B. Gale	1cc5eb6636	Use `semver.compare` instead of `semver.lt`	2025-10-06 12:58:00 +01:00
Michael B. Gale	43ce7ef399	Add `isDynamicWorkflow` function	2025-10-06 12:55:54 +01:00
Michael B. Gale	4d0c164f60	Remove `toolcache` option description from `action.yml`	2025-10-06 12:53:17 +01:00
Mario Campos	b2e22323e2	Merge remote-tracking branch 'origin/main' into mario-campos/node24 # Conflicts: # lib/analyze-action-post.js # lib/analyze-action.js # lib/autobuild-action.js # lib/init-action-post.js # lib/init-action.js # lib/resolve-environment-action.js # lib/start-proxy-action-post.js # lib/start-proxy-action.js # lib/upload-lib.js # lib/upload-sarif-action-post.js # lib/upload-sarif-action.js # package-lock.json # package.json	2025-10-03 12:59:21 -05:00
Michael B. Gale	dd9e24a8a4	Add more questions to the PR template	2025-10-03 16:27:36 +01:00
Michael B. Gale	13a3a6890f	Add basic PR check for `tools: toolcache`	2025-10-03 15:49:29 +01:00
Michael B. Gale	7d468c931c	Accept `toolcache` as `version` value for `prepare-test`	2025-10-03 15:48:04 +01:00
Michael B. Gale	425ef85595	Support requesting CLI from toolcache with `tools: toolcache`	2025-10-03 15:40:33 +01:00
Michael B. Gale	297313df79	Add `getLatestToolcacheVersion` with tests	2025-10-03 14:40:34 +01:00
Michael B. Gale	065c6cfb78	Merge pull request #3174 from github/mbg/fix/start-proxy-matrix Make `matrix` available to `start-proxy` action	2025-10-03 12:26:10 +01:00
Michael B. Gale	7fb8378d93	Re-throw exception in `createStatusReportBase` when in test mode	2025-10-03 11:59:36 +01:00
Mario Campos	dddf033776	Revert changes to build.mjs	2025-10-02 14:32:40 -05:00
Mario Campos	54ae8ba5b1	Simplify PR check by reverting changes to `@types/node`.	2025-10-02 14:24:46 -05:00
Michael B. Gale	65e9e640ee	Make `matrix` available to `start-proxy` action	2025-10-02 17:45:22 +01:00
Nick Rolfe	21a7ba37dd	Merge pull request #3173 from github/mergeback/v3.30.6-to-main-64d10c13 Mergeback v3.30.6 refs/heads/releases/v3 into main	2025-10-02 15:15:57 +01:00
github-actions[bot]	70836b1ec4	Rebuild	2025-10-02 13:55:07 +00:00
github-actions[bot]	205744e04f	Update changelog and version after v3.30.6	2025-10-02 13:53:03 +00:00
Nick Rolfe	64d10c1313	Merge pull request #3172 from github/update-v3.30.6-10feb5d2a Merge main into releases/v3	2025-10-02 14:52:21 +01:00
github-actions[bot]	909610e8a8	Update changelog for v3.30.6	2025-10-02 13:28:36 +00:00
Henry Mercer	d899b2ed98	Merge branch 'main' into mario-campos/node24	2025-10-02 12:36:53 +01:00
Michael B. Gale	10feb5d2a2	Merge pull request #3167 from github/mbg/upload-sarif/find-then-filter Find, then filter, SARIF files for `upload-sarif` Action	2025-10-02 11:51:47 +01:00
Nick Rolfe	4182ea3d4e	Merge pull request #3168 from github/update-bundle/codeql-bundle-v2.23.2 Update default bundle to 2.23.2	2025-10-02 11:25:07 +01:00
Michael B. Gale	34afe5b7b1	Merge pull request #3171 from github/mbg/start-proxy/telemetry Add basic telemetry for `start-proxy` Action	2025-10-02 11:23:10 +01:00
Nick Rolfe	096fe67f97	Merge branch 'main' into update-bundle/codeql-bundle-v2.23.2	2025-10-02 11:08:29 +01:00
Michael B. Gale	b4964014ad	Merge pull request #3170 from github/mbg/start-proxy/remove-update-workflow Remove `update-proxy-release` workflow	2025-10-02 11:05:22 +01:00
Michael B. Gale	d573787cca	Report registry types that are configured for CodeQL in `start-proxy` telemetry	2025-10-01 16:00:05 +01:00
Michael B. Gale	15916800df	Send a basic status report in `start-proxy` Action if it succeeds	2025-10-01 15:55:20 +01:00
Michael B. Gale	cb5a2849ac	Send status report when `start-proxy` fails	2025-10-01 15:52:28 +01:00
Michael B. Gale	6de1d741f6	Move error handling from `startProxy` to `runWrapper` in `start-proxy` action	2025-10-01 15:43:43 +01:00
Michael B. Gale	a506145f31	Add `StartProxy` to `ActionName` enum	2025-10-01 15:42:08 +01:00
Michael B. Gale	aac66ec793	Remove `update-proxy-release` workflow	2025-10-01 15:30:18 +01:00
Michael B. Gale	91a63dc72c	Remove `undefined` values from results of `unsafeEntriesInvariant`	2025-10-01 15:28:56 +01:00
Michael B. Gale	d25fa60a90	ESLint: Disable `no-unused-vars` for parameters starting with `_`	2025-10-01 15:28:31 +01:00
Mario Campos	3adb1ff7b8	Reorder supported tags in descending order Co-authored-by: Henry Mercer <henrymercer@github.com>	2025-10-01 09:04:18 -05:00
Mario Campos	d4b5380db4	Document Node.js 24 change in CHANGELOG.md.	2025-09-30 14:11:13 -05:00
Mario Campos	d4bbcb74ca	Implement simultaneous PR checks for Node.js v20, v24. Copied from #2006.	2025-09-30 14:11:13 -05:00
Mario Campos	180438161e	Specify Node.js v24 in actions/setup-node steps.	2025-09-30 14:11:13 -05:00
Mario Campos	d7ada03e02	Downgrade upload-sarif@v4 -> v3 I got ahead of myself; v4 hasn't been tagged yet.	2025-09-30 14:11:13 -05:00
Mario Campos	30445af89f	Rebuild JS after upgrading to Node.js 24.	2025-09-30 14:11:04 -05:00
Mario Campos	7434149006	Upgrade Node.js version to 24. This requires creating a new major-version (v4) of codeql-action.	2025-09-30 13:56:31 -05:00
Michael B. Gale	9a0b46abff	Rename `keys` and `entries` helpers and update docs	2025-09-30 12:52:04 +01:00
Michael B. Gale	b8c496644d	Rename variables in `getGroupedSarifFilePaths`	2025-09-30 12:05:59 +01:00
Michael B. Gale	ad086e4d90	Use `path.extname` for some extension checks	2025-09-30 11:55:04 +01:00
github-actions[bot]	47b5ac77ee	Add changelog note	2025-09-30 08:31:56 +00:00
github-actions[bot]	b5caf1196e	Update default bundle to codeql-bundle-v2.23.2	2025-09-30 08:31:45 +00:00
Michael B. Gale	93711d3d89	Print a warning when there are `sarifFiles` in `getGroupedSarifFilePaths` that don't belong to an analysis kind	2025-09-29 15:07:16 +01:00
Michael B. Gale	056fb86575	Call `fixCategory` in `uploadSpecifiedFiles` Since `fixCategory` is now part of `AnalysisConfig`, we don't have to remember to do it at the call site for `uploadSpecifiedFiles` or `uploadFiles` anymore.	2025-09-29 15:07:16 +01:00
Michael B. Gale	63d1b25e97	Use `getGroupedSarifFilePaths` for `upload-sarif` Action	2025-09-29 15:07:16 +01:00
Michael B. Gale	717d581574	Add `fixCategory` to `AnalysisConfig`	2025-09-29 15:07:15 +01:00
Michael B. Gale	0417531633	Add `keysTyped` and `entriesTyped` helpers	2025-09-29 15:07:15 +01:00
Michael B. Gale	13ae3d4328	Add and use `getAnalysisConfig`	2025-09-29 15:07:14 +01:00
Michael B. Gale	fe0376ed1f	Add `getGroupedSarifFilePaths` with tests	2025-09-29 15:07:13 +01:00