Support skipping checks based on changed files

.github/actions/changed-files/action.yml

@@ -0,0 +1,53 @@
+name: Get changed files
+description: Outputs a stringified JSON array of changed files for a PR
+inputs:
+  github-token:
+    description: GitHub token
+    required: true
+  pattern:
+    description: "The glob pattern to use to check for changed files"
+    required: true
+    default: "${{ github.workspace }}/**/*"
+  exclude:
+    description: "A stringified JSON array of files to exclude"
+    required: false
+    default: "[]"
+outputs:
+  files:
+    description: Stringified JSON array of changed file paths
+    value: ${{ steps.changed-files.outputs.files }}
+runs:
+  using: "composite"
+  steps:
+    - name: Get changed files
+      id: changed-files
+      uses: actions/github-script@v7
+      env:
+        PATTERN: ${{ inputs.pattern }}
+        EXCLUDE: ${{ inputs.exclude }}
+      with:
+        github-token: ${{ inputs.github-token }}
+        script: |
+          const exclude = JSON.parse(process.env['EXCLUDE']);
+          const path = require('path');
+          const pr = context.payload.pull_request;
+          if (!pr) {
+            core.setOutput('files', JSON.stringify([]));
+            return;
+          }
+          const files = await github.paginate(
+            github.rest.pulls.listFiles,
+            {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              per_page: 100
+            }
+          );
+          const results = files
+            .filter(f => path.matchesGlob(
+              f.filename, process.env['PATTERN']
+            ) && !exclude.includes(f.filename))
+            .map(f => f.filename);
+          console.debug(results);
+          core.setOutput('files', JSON.stringify(results));

.github/workflows/__all-platform-bundle.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-all-platform-bundle:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   all-platform-bundle:
     strategy:
       fail-fast: false
@@ -66,7 +92,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: All-platform bundle
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-all-platform-bundle
+    if: needs.should-run-all-platform-bundle.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,6 +103,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -82,15 +119,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'true'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - id: init
         uses: ./../action/init
         with:
@@ -102,3 +130,23 @@ jobs:
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-all-platform-bundle:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
+    name: All-platform bundle
+    needs:
+      - should-run-all-platform-bundle
+    if: needs.should-run-all-platform-bundle.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__analysis-kinds.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: analysis-kinds-${{github.ref}}
 jobs:
+  should-run-analysis-kinds:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   analysis-kinds:
     strategy:
       fail-fast: false
@@ -64,7 +90,9 @@ jobs:
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-analysis-kinds
+    if: needs.should-run-analysis-kinds.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -150,3 +178,41 @@ jobs:
           core.setFailed(`${ found ? "Found" : "Didn't find" } rule ${targetId}`);
         }
       CODEQL_ACTION_TEST_MODE: true
+  skip-analysis-kinds:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: linked
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: linked
+            analysis-kinds: code-scanning,code-quality
+          - os: ubuntu-latest
+            version: linked
+            analysis-kinds: risk-assessment
+          - os: ubuntu-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: nightly-latest
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
+          - os: ubuntu-latest
+            version: nightly-latest
+            analysis-kinds: risk-assessment
+    name: Analysis kinds
+    needs:
+      - should-run-analysis-kinds
+    if: needs.should-run-analysis-kinds.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__analyze-ref-input.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-analyze-ref-input:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   analyze-ref-input:
     strategy:
       fail-fast: false
@@ -72,7 +98,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-analyze-ref-input
+    if: needs.should-run-analyze-ref-input.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -81,6 +109,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,20 +130,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -115,3 +143,19 @@ jobs:
           sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-analyze-ref-input:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: "Analyze: 'ref' and 'sha' from inputs"
+    needs:
+      - should-run-analyze-ref-input
+    if: needs.should-run-analyze-ref-input.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__autobuild-action.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}
 jobs:
+  should-run-autobuild-action:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   autobuild-action:
     strategy:
       fail-fast: false
@@ -56,7 +82,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: autobuild-action
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-autobuild-action
+    if: needs.should-run-autobuild-action.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -65,6 +93,10 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -72,10 +104,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           languages: csharp
@@ -99,3 +127,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-autobuild-action:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+    name: autobuild-action
+    needs:
+      - should-run-autobuild-action
+    if: needs.should-run-autobuild-action.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: autobuild-direct-tracing-with-working-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
+  should-run-autobuild-direct-tracing-with-working-dir:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   autobuild-direct-tracing-with-working-dir:
     strategy:
       fail-fast: false
@@ -58,7 +84,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-autobuild-direct-tracing-with-working-dir
+    if: needs.should-run-autobuild-direct-tracing-with-working-dir.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -67,6 +95,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -74,11 +107,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
@@ -104,3 +132,25 @@ jobs:
     env:
       CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
       CODEQL_ACTION_TEST_MODE: true
+  skip-autobuild-direct-tracing-with-working-dir:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
+    name: Autobuild direct tracing (custom working directory)
+    needs:
+      - should-run-autobuild-direct-tracing-with-working-dir
+    if: needs.should-run-autobuild-direct-tracing-with-working-dir.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__autobuild-working-dir.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: autobuild-working-dir-${{github.ref}}
 jobs:
+  should-run-autobuild-working-dir:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   autobuild-working-dir:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Autobuild working directory
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-autobuild-working-dir
+    if: needs.should-run-autobuild-working-dir.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -81,3 +109,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-autobuild-working-dir:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Autobuild working directory
+    needs:
+      - should-run-autobuild-working-dir
+    if: needs.should-run-autobuild-working-dir.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__build-mode-autobuild.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: build-mode-autobuild-${{github.ref}}-${{inputs.java-version}}
 jobs:
+  should-run-build-mode-autobuild:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   build-mode-autobuild:
     strategy:
       fail-fast: false
@@ -58,7 +84,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Build mode autobuild
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-build-mode-autobuild
+    if: needs.should-run-build-mode-autobuild.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -67,13 +95,6 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
       - name: Install Java
         uses: actions/setup-java@v5
         with:
@@ -87,6 +108,13 @@ jobs:
         run: |-
           gh release download --repo mikefarah/yq --pattern "yq_windows_amd64.exe" "$YQ_VERSION" -O "$YQ_PATH/yq.exe"
           echo "$YQ_PATH" >> "$GITHUB_PATH"
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -121,3 +149,25 @@ jobs:
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-build-mode-autobuild:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
+    name: Build mode autobuild
+    needs:
+      - should-run-build-mode-autobuild
+    if: needs.should-run-build-mode-autobuild.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__build-mode-manual.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-build-mode-manual:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   build-mode-manual:
     strategy:
       fail-fast: false
@@ -62,7 +88,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode manual
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-build-mode-manual
+    if: needs.should-run-build-mode-manual.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -71,6 +99,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -78,15 +115,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         id: init
         with:
@@ -110,3 +138,19 @@ jobs:
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-build-mode-manual:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Build mode manual
+    needs:
+      - should-run-build-mode-manual
+    if: needs.should-run-build-mode-manual.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__build-mode-none.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: build-mode-none-${{github.ref}}
 jobs:
+  should-run-build-mode-none:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   build-mode-none:
     strategy:
       fail-fast: false
@@ -44,7 +70,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode none
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-build-mode-none
+    if: needs.should-run-build-mode-none.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -84,3 +112,21 @@ jobs:
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-build-mode-none:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Build mode none
+    needs:
+      - should-run-build-mode-none
+    if: needs.should-run-build-mode-none.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__build-mode-rollback.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: build-mode-rollback-${{github.ref}}
 jobs:
+  should-run-build-mode-rollback:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   build-mode-rollback:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode rollback
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-build-mode-rollback
+    if: needs.should-run-build-mode-rollback.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -85,3 +113,19 @@ jobs:
     env:
       CODEQL_ACTION_DISABLE_JAVA_BUILDLESS: true
       CODEQL_ACTION_TEST_MODE: true
+  skip-build-mode-rollback:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Build mode rollback
+    needs:
+      - should-run-build-mode-rollback
+    if: needs.should-run-build-mode-rollback.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__bundle-from-nightly.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: bundle-from-nightly-${{github.ref}}
 jobs:
+  should-run-bundle-from-nightly:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   bundle-from-nightly:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: 'Bundle: From nightly'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-bundle-from-nightly
+    if: needs.should-run-bundle-from-nightly.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -70,3 +98,19 @@ jobs:
         run: exit 1
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-bundle-from-nightly:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: 'Bundle: From nightly'
+    needs:
+      - should-run-bundle-from-nightly
+    if: needs.should-run-bundle-from-nightly.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__bundle-from-toolcache.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: bundle-from-toolcache-${{github.ref}}
 jobs:
+  should-run-bundle-from-toolcache:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   bundle-from-toolcache:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: toolcache
     name: 'Bundle: From toolcache'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-bundle-from-toolcache
+    if: needs.should-run-bundle-from-toolcache.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -86,3 +114,19 @@ jobs:
             }
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-bundle-from-toolcache:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: toolcache
+    name: 'Bundle: From toolcache'
+    needs:
+      - should-run-bundle-from-toolcache
+    if: needs.should-run-bundle-from-toolcache.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__bundle-toolcache.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: bundle-toolcache-${{github.ref}}
 jobs:
+  should-run-bundle-toolcache:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   bundle-toolcache:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: 'Bundle: Caching checks'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-bundle-toolcache
+    if: needs.should-run-bundle-toolcache.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -106,3 +134,23 @@ jobs:
             }
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-bundle-toolcache:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+    name: 'Bundle: Caching checks'
+    needs:
+      - should-run-bundle-toolcache
+    if: needs.should-run-bundle-toolcache.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__bundle-zstd.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: bundle-zstd-${{github.ref}}
 jobs:
+  should-run-bundle-zstd:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   bundle-zstd:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: 'Bundle: Zstandard checks'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-bundle-zstd
+    if: needs.should-run-bundle-zstd.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -123,3 +151,23 @@ jobs:
             }
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-bundle-zstd:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+    name: 'Bundle: Zstandard checks'
+    needs:
+      - should-run-bundle-zstd
+    if: needs.should-run-bundle-zstd.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: cleanup-db-cluster-dir-${{github.ref}}
 jobs:
+  should-run-cleanup-db-cluster-dir:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   cleanup-db-cluster-dir:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Clean up database cluster directory
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-cleanup-db-cluster-dir
+    if: needs.should-run-cleanup-db-cluster-dir.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -80,3 +108,19 @@ jobs:
           echo "File was cleaned up"
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-cleanup-db-cluster-dir:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Clean up database cluster directory
+    needs:
+      - should-run-cleanup-db-cluster-dir
+    if: needs.should-run-cleanup-db-cluster-dir.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__config-export.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: config-export-${{github.ref}}
 jobs:
+  should-run-config-export:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   config-export:
     strategy:
       fail-fast: false
@@ -44,7 +70,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Config export
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-config-export
+    if: needs.should-run-config-export.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -103,3 +131,21 @@ jobs:
             core.info('Finished config export tests.');
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-config-export:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Config export
+    needs:
+      - should-run-config-export
+    if: needs.should-run-config-export.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__config-input.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: config-input-${{github.ref}}
 jobs:
+  should-run-config-input:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   config-input:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Config input
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-config-input
+    if: needs.should-run-config-input.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -95,3 +123,19 @@ jobs:
           queries-not-run: javascript/codeql-action/default-setup-context-properties
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-config-input:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Config input
+    needs:
+      - should-run-config-input
+    if: needs.should-run-config-input.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__cpp-deptrace-disabled.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: cpp-deptrace-disabled-${{github.ref}}
 jobs:
+  should-run-cpp-deptrace-disabled:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   cpp-deptrace-disabled:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'C/C++: disabling autoinstalling dependencies (Linux)'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-cpp-deptrace-disabled
+    if: needs.should-run-cpp-deptrace-disabled.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -82,3 +110,23 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-cpp-deptrace-disabled:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    needs:
+      - should-run-cpp-deptrace-disabled
+    if: needs.should-run-cpp-deptrace-disabled.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: cpp-deptrace-enabled-on-macos-${{github.ref}}
 jobs:
+  should-run-cpp-deptrace-enabled-on-macos:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   cpp-deptrace-enabled-on-macos:
     strategy:
       fail-fast: false
@@ -44,7 +70,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-cpp-deptrace-enabled-on-macos
+    if: needs.should-run-cpp-deptrace-enabled-on-macos.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -82,3 +110,21 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-cpp-deptrace-enabled-on-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: linked
+          - os: macos-latest
+            version: nightly-latest
+    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    needs:
+      - should-run-cpp-deptrace-enabled-on-macos
+    if: needs.should-run-cpp-deptrace-enabled-on-macos.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__cpp-deptrace-enabled.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: cpp-deptrace-enabled-${{github.ref}}
 jobs:
+  should-run-cpp-deptrace-enabled:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   cpp-deptrace-enabled:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies (Linux)'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-cpp-deptrace-enabled
+    if: needs.should-run-cpp-deptrace-enabled.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -82,3 +110,23 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-cpp-deptrace-enabled:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'C/C++: autoinstalling dependencies (Linux)'
+    needs:
+      - should-run-cpp-deptrace-enabled
+    if: needs.should-run-cpp-deptrace-enabled.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__diagnostics-export.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: diagnostics-export-${{github.ref}}
 jobs:
+  should-run-diagnostics-export:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   diagnostics-export:
     strategy:
       fail-fast: false
@@ -44,7 +70,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Diagnostic export
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-diagnostics-export
+    if: needs.should-run-diagnostics-export.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -139,3 +167,21 @@ jobs:
     env:
       CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
       CODEQL_ACTION_TEST_MODE: true
+  skip-diagnostics-export:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Diagnostic export
+    needs:
+      - should-run-diagnostics-export
+    if: needs.should-run-diagnostics-export.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__export-file-baseline-information.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-export-file-baseline-information:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   export-file-baseline-information:
     strategy:
       fail-fast: false
@@ -66,7 +92,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Export file baseline information
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-export-file-baseline-information
+    if: needs.should-run-export-file-baseline-information.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,6 +103,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -82,15 +119,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         id: init
         with:
@@ -130,3 +158,23 @@ jobs:
       CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
       CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
       CODEQL_ACTION_TEST_MODE: true
+  skip-export-file-baseline-information:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
+    name: Export file baseline information
+    needs:
+      - should-run-export-file-baseline-information
+    if: needs.should-run-export-file-baseline-information.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__extractor-ram-threads.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: extractor-ram-threads-${{github.ref}}
 jobs:
+  should-run-extractor-ram-threads:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   extractor-ram-threads:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Extractor ram and threads options test
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-extractor-ram-threads
+    if: needs.should-run-extractor-ram-threads.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -83,3 +111,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-extractor-ram-threads:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Extractor ram and threads options test
+    needs:
+      - should-run-extractor-ram-threads
+    if: needs.should-run-extractor-ram-threads.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__global-proxy.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: global-proxy-${{github.ref}}
 jobs:
+  should-run-global-proxy:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   global-proxy:
     strategy:
       fail-fast: false
@@ -44,7 +70,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Proxy test
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-global-proxy
+    if: needs.should-run-global-proxy.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -76,3 +104,21 @@ jobs:
         image: ubuntu/squid:latest
         ports:
           - 3128:3128
+  skip-global-proxy:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Proxy test
+    needs:
+      - should-run-global-proxy
+    if: needs.should-run-global-proxy.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-custom-queries.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-go-custom-queries:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-custom-queries:
     strategy:
       fail-fast: false
@@ -64,7 +90,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Go: Custom queries'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-custom-queries
+    if: needs.should-run-go-custom-queries.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -73,6 +101,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -80,15 +117,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           languages: go
@@ -100,3 +128,21 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-custom-queries:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'Go: Custom queries'
+    needs:
+      - should-run-go-custom-queries
+    if: needs.should-run-go-custom-queries.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}
 jobs:
+  should-run-go-indirect-tracing-workaround-diagnostic:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-indirect-tracing-workaround-diagnostic:
     strategy:
       fail-fast: false
@@ -52,7 +78,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: diagnostic when Go is changed after init step'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-indirect-tracing-workaround-diagnostic
+    if: needs.should-run-go-indirect-tracing-workaround-diagnostic.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -61,6 +89,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -68,11 +101,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go
@@ -112,3 +140,19 @@ jobs:
             }
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-indirect-tracing-workaround-diagnostic:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: 'Go: diagnostic when Go is changed after init step'
+    needs:
+      - should-run-go-indirect-tracing-workaround-diagnostic
+    if: needs.should-run-go-indirect-tracing-workaround-diagnostic.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}
 jobs:
+  should-run-go-indirect-tracing-workaround-no-file-program:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-indirect-tracing-workaround-no-file-program:
     strategy:
       fail-fast: false
@@ -52,7 +78,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: diagnostic when `file` is not installed'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-indirect-tracing-workaround-no-file-program
+    if: needs.should-run-go-indirect-tracing-workaround-no-file-program.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -61,6 +89,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -68,11 +101,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - name: Remove `file` program
         run: |
           echo $(which file)
@@ -113,3 +141,19 @@ jobs:
             }
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-indirect-tracing-workaround-no-file-program:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: 'Go: diagnostic when `file` is not installed'
+    needs:
+      - should-run-go-indirect-tracing-workaround-no-file-program
+    if: needs.should-run-go-indirect-tracing-workaround-no-file-program.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}
 jobs:
+  should-run-go-indirect-tracing-workaround:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-indirect-tracing-workaround:
     strategy:
       fail-fast: false
@@ -52,7 +78,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: workaround for indirect tracing'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-indirect-tracing-workaround
+    if: needs.should-run-go-indirect-tracing-workaround.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -61,6 +89,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -68,11 +101,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go
@@ -107,3 +135,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-indirect-tracing-workaround:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: 'Go: workaround for indirect tracing'
+    needs:
+      - should-run-go-indirect-tracing-workaround
+    if: needs.should-run-go-indirect-tracing-workaround.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-tracing-autobuilder.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}
 jobs:
+  should-run-go-tracing-autobuilder:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-tracing-autobuilder:
     strategy:
       fail-fast: false
@@ -86,7 +112,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with autobuilder step'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-tracing-autobuilder
+    if: needs.should-run-go-tracing-autobuilder.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -95,6 +123,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -102,11 +135,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go
@@ -127,3 +155,53 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-tracing-autobuilder:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: macos-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.19.4
+          - os: ubuntu-latest
+            version: stable-v2.20.7
+          - os: macos-latest
+            version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: stable-v2.22.4
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: default
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+    name: 'Go: tracing with autobuilder step'
+    needs:
+      - should-run-go-tracing-autobuilder
+    if: needs.should-run-go-tracing-autobuilder.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}
 jobs:
+  should-run-go-tracing-custom-build-steps:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-tracing-custom-build-steps:
     strategy:
       fail-fast: false
@@ -86,7 +112,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with custom build steps'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-tracing-custom-build-steps
+    if: needs.should-run-go-tracing-custom-build-steps.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -95,6 +123,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -102,11 +135,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go
@@ -130,3 +158,53 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-tracing-custom-build-steps:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: macos-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.19.4
+          - os: ubuntu-latest
+            version: stable-v2.20.7
+          - os: macos-latest
+            version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: stable-v2.22.4
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: default
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+    name: 'Go: tracing with custom build steps'
+    needs:
+      - should-run-go-tracing-custom-build-steps
+    if: needs.should-run-go-tracing-custom-build-steps.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -44,6 +44,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}
 jobs:
+  should-run-go-tracing-legacy-workflow:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   go-tracing-legacy-workflow:
     strategy:
       fail-fast: false
@@ -86,7 +112,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with legacy workflow'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-go-tracing-legacy-workflow
+    if: needs.should-run-go-tracing-legacy-workflow.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -95,6 +123,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -102,11 +135,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
       - uses: ./../action/init
         with:
           languages: go
@@ -121,3 +149,53 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-go-tracing-legacy-workflow:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: macos-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.19.4
+          - os: ubuntu-latest
+            version: stable-v2.20.7
+          - os: macos-latest
+            version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: stable-v2.22.4
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: default
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+    name: 'Go: tracing with legacy workflow'
+    needs:
+      - should-run-go-tracing-legacy-workflow
+    if: needs.should-run-go-tracing-legacy-workflow.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__go.yml

@@ -10,16 +10,16 @@ env:
 on:
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 jobs:
   go-custom-queries:
     name: 'Go: Custom queries'
@@ -28,8 +28,8 @@ jobs:
       security-events: read
     uses: ./.github/workflows/__go-custom-queries.yml
     with:
-      go-version: ${{ inputs.go-version }}
       dotnet-version: ${{ inputs.dotnet-version }}
+      go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-diagnostic:
     name: 'Go: diagnostic when Go is changed after init step'
     permissions:

.github/workflows/__init-with-registries.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: init-with-registries-${{github.ref}}
 jobs:
+  should-run-init-with-registries:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   init-with-registries:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Download using registries'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-init-with-registries
+    if: needs.should-run-init-with-registries.outputs.run-check == 'true'
     permissions:
       contents: read
       packages: read
@@ -122,3 +150,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-init-with-registries:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'Packaging: Download using registries'
+    needs:
+      - should-run-init-with-registries
+    if: needs.should-run-init-with-registries.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__javascript-source-root.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: javascript-source-root-${{github.ref}}
 jobs:
+  should-run-javascript-source-root:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   javascript-source-root:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Custom source root
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-javascript-source-root
+    if: needs.should-run-javascript-source-root.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -83,3 +111,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-javascript-source-root:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Custom source root
+    needs:
+      - should-run-javascript-source-root
+    if: needs.should-run-javascript-source-root.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__job-run-uuid-sarif.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: job-run-uuid-sarif-${{github.ref}}
 jobs:
+  should-run-job-run-uuid-sarif:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   job-run-uuid-sarif:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Job run UUID added to SARIF
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-job-run-uuid-sarif
+    if: needs.should-run-job-run-uuid-sarif.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -84,3 +112,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-job-run-uuid-sarif:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Job run UUID added to SARIF
+    needs:
+      - should-run-job-run-uuid-sarif
+    if: needs.should-run-job-run-uuid-sarif.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__language-aliases.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: language-aliases-${{github.ref}}
 jobs:
+  should-run-language-aliases:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   language-aliases:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Language aliases
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-language-aliases
+    if: needs.should-run-language-aliases.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,3 +103,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-language-aliases:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Language aliases
+    needs:
+      - should-run-language-aliases
+    if: needs.should-run-language-aliases.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__local-bundle.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-local-bundle:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   local-bundle:
     strategy:
       fail-fast: false
@@ -72,7 +98,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Local CodeQL bundle
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-local-bundle
+    if: needs.should-run-local-bundle.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -81,6 +109,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,20 +130,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst
@@ -116,3 +144,19 @@ jobs:
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-local-bundle:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Local CodeQL bundle
+    needs:
+      - should-run-local-bundle
+    if: needs.should-run-local-bundle.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__multi-language-autodetect.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-multi-language-autodetect:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   multi-language-autodetect:
     strategy:
       fail-fast: false
@@ -106,7 +132,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Multi-language repository
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-multi-language-autodetect
+    if: needs.should-run-multi-language-autodetect.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -115,6 +143,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -122,20 +164,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Use Xcode 16
         if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"
@@ -204,3 +232,53 @@ jobs:
     env:
       CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
       CODEQL_ACTION_TEST_MODE: true
+  skip-multi-language-autodetect:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.17.6
+          - os: macos-latest
+            version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.19.4
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-latest
+            version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.20.7
+          - os: macos-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.22.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: default
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: nightly-latest
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Multi-language repository
+    needs:
+      - should-run-multi-language-autodetect
+    if: needs.should-run-multi-language-autodetect.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__overlay-init-fallback.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: overlay-init-fallback-${{github.ref}}
 jobs:
+  should-run-overlay-init-fallback:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   overlay-init-fallback:
     strategy:
       fail-fast: false
@@ -44,7 +70,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Overlay database init fallback
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-overlay-init-fallback
+    if: needs.should-run-overlay-init-fallback.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -79,3 +107,21 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-overlay-init-fallback:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Overlay database init fallback
+    needs:
+      - should-run-overlay-init-fallback
+    if: needs.should-run-overlay-init-fallback.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-packaging-codescanning-config-inputs-js:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   packaging-codescanning-config-inputs-js:
     strategy:
       fail-fast: false
@@ -76,7 +102,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-packaging-codescanning-config-inputs-js
+    if: needs.should-run-packaging-codescanning-config-inputs-js.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -85,6 +113,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -92,6 +129,11 @@ jobs:
           cache: npm
       - name: Install dependencies
         run: npm ci
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -99,20 +141,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging3.yml'
@@ -148,3 +176,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-packaging-codescanning-config-inputs-js:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'Packaging: Config and input passed to the CLI'
+    needs:
+      - should-run-packaging-codescanning-config-inputs-js
+    if: needs.should-run-packaging-codescanning-config-inputs-js.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__packaging-config-inputs-js.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-packaging-config-inputs-js:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   packaging-config-inputs-js:
     strategy:
       fail-fast: false
@@ -66,7 +92,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Config and input'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-packaging-config-inputs-js
+    if: needs.should-run-packaging-config-inputs-js.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,6 +103,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -89,15 +126,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging3.yml'
@@ -133,3 +161,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-packaging-config-inputs-js:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'Packaging: Config and input'
+    needs:
+      - should-run-packaging-config-inputs-js
+    if: needs.should-run-packaging-config-inputs-js.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__packaging-config-js.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-packaging-config-js:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   packaging-config-js:
     strategy:
       fail-fast: false
@@ -66,7 +92,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Config file'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-packaging-config-js
+    if: needs.should-run-packaging-config-js.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,6 +103,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -89,15 +126,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging.yml'
@@ -132,3 +160,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-packaging-config-js:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'Packaging: Config file'
+    needs:
+      - should-run-packaging-config-js
+    if: needs.should-run-packaging-config-js.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__packaging-inputs-js.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-packaging-inputs-js:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   packaging-inputs-js:
     strategy:
       fail-fast: false
@@ -66,7 +92,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Action input'
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-packaging-inputs-js
+    if: needs.should-run-packaging-inputs-js.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,6 +103,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
@@ -89,15 +126,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging2.yml'
@@ -132,3 +160,23 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-packaging-inputs-js:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: 'Packaging: Action input'
+    needs:
+      - should-run-packaging-inputs-js
+    if: needs.should-run-packaging-inputs-js.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__remote-config.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-remote-config:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   remote-config:
     strategy:
       fail-fast: false
@@ -74,7 +100,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Remote config file
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-remote-config
+    if: needs.should-run-remote-config.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -83,6 +111,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -90,20 +132,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -114,3 +142,21 @@ jobs:
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-remote-config:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Remote config file
+    needs:
+      - should-run-remote-config
+    if: needs.should-run-remote-config.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__resolve-environment-action.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: resolve-environment-action-${{github.ref}}
 jobs:
+  should-run-resolve-environment-action:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   resolve-environment-action:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Resolve environment
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-resolve-environment-action
+    if: needs.should-run-resolve-environment-action.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -88,3 +116,23 @@ jobs:
         run: exit 1
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-resolve-environment-action:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Resolve environment
+    needs:
+      - should-run-resolve-environment-action
+    if: needs.should-run-resolve-environment-action.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__rubocop-multi-language.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: rubocop-multi-language-${{github.ref}}
 jobs:
+  should-run-rubocop-multi-language:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   rubocop-multi-language:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-rubocop-multi-language
+    if: needs.should-run-rubocop-multi-language.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -77,3 +105,19 @@ jobs:
           sarif_file: rubocop.sarif
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-rubocop-multi-language:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: RuboCop multi-language
+    needs:
+      - should-run-rubocop-multi-language
+    if: needs.should-run-rubocop-multi-language.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__ruby.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: ruby-${{github.ref}}
 jobs:
+  should-run-ruby:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   ruby:
     strategy:
       fail-fast: false
@@ -52,7 +78,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Ruby analysis
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-ruby
+    if: needs.should-run-ruby.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -85,3 +113,29 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-ruby:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+    name: Ruby analysis
+    needs:
+      - should-run-ruby
+    if: needs.should-run-ruby.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__rust.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: rust-${{github.ref}}
 jobs:
+  should-run-rust:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   rust:
     strategy:
       fail-fast: false
@@ -50,7 +76,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Rust analysis
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-rust
+    if: needs.should-run-rust.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -83,3 +111,27 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-rust:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.3
+          - os: ubuntu-latest
+            version: stable-v2.22.1
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Rust analysis
+    needs:
+      - should-run-rust
+    if: needs.should-run-rust.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__split-workflow.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-split-workflow:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   split-workflow:
     strategy:
       fail-fast: false
@@ -72,7 +98,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Split workflow
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-split-workflow
+    if: needs.should-run-split-workflow.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -81,6 +109,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,15 +125,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           config-file: '.github/codeql/codeql-config-packaging3.yml'
@@ -136,3 +164,29 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-split-workflow:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+    name: Split workflow
+    needs:
+      - should-run-split-workflow
+    if: needs.should-run-split-workflow.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__start-proxy.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: start-proxy-${{github.ref}}
 jobs:
+  should-run-start-proxy:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   start-proxy:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: Start proxy
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-start-proxy
+    if: needs.should-run-start-proxy.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -84,3 +112,23 @@ jobs:
         run: exit 1
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-start-proxy:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+    name: Start proxy
+    needs:
+      - should-run-start-proxy
+    if: needs.should-run-start-proxy.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__submit-sarif-failure.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: submit-sarif-failure-${{github.ref}}
 jobs:
+  should-run-submit-sarif-failure:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   submit-sarif-failure:
     strategy:
       fail-fast: false
@@ -46,7 +72,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Submit SARIF after failure
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-submit-sarif-failure
+    if: needs.should-run-submit-sarif-failure.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: write
@@ -85,3 +113,23 @@ jobs:
       CODEQL_ACTION_UPLOAD_FAILED_SARIF: true
       CODEQL_ACTION_TEST_MODE: false
       CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+  skip-submit-sarif-failure:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: default
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Submit SARIF after failure
+    needs:
+      - should-run-submit-sarif-failure
+    if: needs.should-run-submit-sarif-failure.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__swift-autobuild.yml

@@ -34,6 +34,32 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
   group: swift-autobuild-${{github.ref}}
 jobs:
+  should-run-swift-autobuild:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   swift-autobuild:
     strategy:
       fail-fast: false
@@ -42,7 +68,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Swift analysis using autobuild
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-swift-autobuild
+    if: needs.should-run-swift-autobuild.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -81,3 +109,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-swift-autobuild:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: nightly-latest
+    name: Swift analysis using autobuild
+    needs:
+      - should-run-swift-autobuild
+    if: needs.should-run-swift-autobuild.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__swift-custom-build.yml

@@ -25,35 +25,61 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
   workflow_call:
     inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
       dotnet-version:
         type: string
         description: The version of .NET to install
         required: false
         default: 9.x
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.go-version}}-${{inputs.dotnet-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
 jobs:
+  should-run-swift-custom-build:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   swift-custom-build:
     strategy:
       fail-fast: false
@@ -66,7 +92,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Swift analysis using a custom build command
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-swift-custom-build
+    if: needs.should-run-swift-custom-build.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -75,6 +103,15 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -82,15 +119,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Use Xcode 16
         if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"
@@ -117,3 +145,23 @@ jobs:
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true
+  skip-swift-custom-build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: linked
+          - os: macos-latest
+            version: default
+          - os: macos-latest
+            version: nightly-latest
+    name: Swift analysis using a custom build command
+    needs:
+      - should-run-swift-custom-build
+    if: needs.should-run-swift-custom-build.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__unset-environment.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-unset-environment:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   unset-environment:
     strategy:
       fail-fast: false
@@ -74,7 +100,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Test unsetting environment variables
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-unset-environment
+    if: needs.should-run-unset-environment.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -83,6 +111,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -90,20 +132,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         id: init
         with:
@@ -156,3 +184,21 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-unset-environment:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+    name: Test unsetting environment variables
+    needs:
+      - should-run-unset-environment
+    if: needs.should-run-unset-environment.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__upload-ref-sha-input.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-upload-ref-sha-input:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   upload-ref-sha-input:
     strategy:
       fail-fast: false
@@ -72,7 +98,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-upload-ref-sha-input
+    if: needs.should-run-upload-ref-sha-input.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -81,6 +109,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,20 +130,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -121,3 +149,19 @@ jobs:
           sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-upload-ref-sha-input:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+    name: "Upload-sarif: 'ref' and 'sha' from inputs"
+    needs:
+      - should-run-upload-ref-sha-input
+    if: needs.should-run-upload-ref-sha-input.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__upload-sarif.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-upload-sarif:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   upload-sarif:
     strategy:
       fail-fast: false
@@ -79,7 +105,9 @@ jobs:
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-upload-sarif
+    if: needs.should-run-upload-sarif.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -88,6 +116,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -95,20 +137,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -186,3 +214,26 @@ jobs:
         run: exit 1
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-upload-sarif:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-scanning,code-quality
+    name: Test different uses of `upload-sarif`
+    needs:
+      - should-run-upload-sarif
+    if: needs.should-run-upload-sarif.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

.github/workflows/__with-checkout-path.yml

@@ -25,6 +25,11 @@ on:
     - cron: '0 5 * * *'
   workflow_dispatch:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -35,13 +40,13 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
   workflow_call:
     inputs:
+      dotnet-version:
+        type: string
+        description: The version of .NET to install
+        required: false
+        default: 9.x
       go-version:
         type: string
         description: The version of Go to install
@@ -52,18 +57,39 @@ on:
         description: The version of Python to install
         required: false
         default: '3.13'
-      dotnet-version:
-        type: string
-        description: The version of .NET to install
-        required: false
-        default: 9.x
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.go-version}}-${{inputs.python-version}}-${{inputs.dotnet-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.python-version}}
 jobs:
+  should-run-with-checkout-path:
+    name: Decide whether to run this check
+    timeout-minutes: 10
+    runs-on: ubuntu-slim
+    if: github.triggering_actor != 'dependabot[bot]'
+    outputs:
+      run-check: ${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}
+    steps:
+      - name: Run check if this is not a PR
+        id: event-type-check
+        if: github.event_name != 'pull_request'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
+      - name: Check out repository
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v6
+      - name: Determine changed files
+        id: changed-files
+        if: github.event_name == 'pull_request'
+        uses: ./.github/actions/changed-files
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: '["README.md"]'
+      - name: Run check because of changed files
+        id: changed-files-check
+        if: github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'
+        run: echo "run-check=true" >> "$GITHUB_OUTPUT"
   with-checkout-path:
     strategy:
       fail-fast: false
@@ -72,7 +98,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Use a custom `checkout_path`
-    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - should-run-with-checkout-path
+    if: needs.should-run-with-checkout-path.outputs.run-check == 'true'
     permissions:
       contents: read
       security-events: read
@@ -82,6 +110,20 @@ jobs:
       # This ensures we don't accidentally use the original checkout for any part of the test.
       - name: Check out repository
         uses: actions/checkout@v6
+      - name: Install .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Install Python
+        if: matrix.version != 'nightly-latest' || !matrix.version
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python-version || '3.13' }}
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -89,20 +131,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - name: Install Python
-        if: matrix.version != 'nightly-latest'
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ inputs.python-version || '3.13' }}
-      - name: Install .NET
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.
@@ -164,3 +192,19 @@ jobs:
           fi
     env:
       CODEQL_ACTION_TEST_MODE: true
+  skip-with-checkout-path:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Use a custom `checkout_path`
+    needs:
+      - should-run-with-checkout-path
+    if: needs.should-run-with-checkout-path.outputs.run-check != 'true'
+    timeout-minutes: 5
+    runs-on: ubuntu-slim
+    steps:
+      - name: Success
+        run: exit 0

lib/analyze-action-post.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/analyze-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/autobuild-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/init-action-post.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/init-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {
@@ -106393,9 +106393,9 @@ var OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
   rust: "overlay_analysis_code_scanning_rust" /* OverlayAnalysisCodeScanningRust */,
   swift: "overlay_analysis_code_scanning_swift" /* OverlayAnalysisCodeScanningSwift */
 };
-async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, codeScanningConfig) {
+async function isOverlayAnalysisFeatureEnabled(features, codeql, languages, codeScanningConfig) {
   if (!await features.getValue("overlay_analysis" /* OverlayAnalysis */, codeql)) {
-    return new Failure("overall-feature-not-enabled" /* OverallFeatureNotEnabled */);
+    return false;
   }
   let enableForCodeScanningOnly = false;
   for (const language of languages) {
@@ -106408,20 +106408,17 @@ async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, c
       enableForCodeScanningOnly = true;
       continue;
     }
-    return new Failure("language-not-enabled" /* LanguageNotEnabled */);
+    return false;
   }
   if (enableForCodeScanningOnly) {
-    const usesDefaultQueriesOnly = codeScanningConfig["disable-default-queries"] !== true && codeScanningConfig.packs === void 0 && codeScanningConfig.queries === void 0 && codeScanningConfig["query-filters"] === void 0;
-    if (!usesDefaultQueriesOnly) {
-      return new Failure("non-default-queries" /* NonDefaultQueries */);
-    }
+    return codeScanningConfig["disable-default-queries"] !== true && codeScanningConfig.packs === void 0 && codeScanningConfig.queries === void 0 && codeScanningConfig["query-filters"] === void 0;
   }
-  return new Success(void 0);
+  return true;
 }
 function runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks) {
   const minimumDiskSpaceBytes = useV2ResourceChecks ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES;
-  if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) {
-    const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6);
+  if (diskUsage === void 0 || diskUsage.numAvailableBytes < minimumDiskSpaceBytes) {
+    const diskSpaceMb = diskUsage === void 0 ? 0 : Math.round(diskUsage.numAvailableBytes / 1e6);
     const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1e6);
     logger.info(
       `Setting overlay database mode to ${"none" /* None */} due to insufficient disk space (${diskSpaceMb} MB, needed ${minimumDiskSpaceMb} MB).`
@@ -106452,110 +106449,93 @@ async function runnerHasSufficientMemory(codeql, ramInput, logger) {
   );
   return true;
 }
-async function checkRunnerResources(codeql, diskUsage, ramInput, logger, useV2ResourceChecks) {
+async function runnerSupportsOverlayAnalysis(codeql, diskUsage, ramInput, logger, useV2ResourceChecks) {
   if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) {
-    return new Failure("insufficient-disk-space" /* InsufficientDiskSpace */);
+    return false;
   }
   if (!await runnerHasSufficientMemory(codeql, ramInput, logger)) {
-    return new Failure("insufficient-memory" /* InsufficientMemory */);
+    return false;
   }
-  return new Success(void 0);
+  return true;
 }
-async function checkOverlayEnablement(codeql, features, languages, sourceRoot, buildMode, ramInput, codeScanningConfig, repositoryProperties, gitVersion, logger) {
+async function getOverlayDatabaseMode(codeql, features, languages, sourceRoot, buildMode, ramInput, codeScanningConfig, repositoryProperties, gitVersion, logger) {
+  let overlayDatabaseMode = "none" /* None */;
+  let useOverlayDatabaseCaching = false;
+  let disabledReason;
   const modeEnv = process.env.CODEQL_OVERLAY_DATABASE_MODE;
   if (modeEnv === "overlay" /* Overlay */ || modeEnv === "overlay-base" /* OverlayBase */ || modeEnv === "none" /* None */) {
+    overlayDatabaseMode = modeEnv;
     logger.info(
-      `Setting overlay database mode to ${modeEnv} from the CODEQL_OVERLAY_DATABASE_MODE environment variable.`
+      `Setting overlay database mode to ${overlayDatabaseMode} from the CODEQL_OVERLAY_DATABASE_MODE environment variable.`
     );
-    if (modeEnv === "none" /* None */) {
-      return new Failure("disabled-by-environment-variable" /* DisabledByEnvironmentVariable */);
-    }
-    return validateOverlayDatabaseMode(
-      modeEnv,
-      false,
-      codeql,
-      languages,
-      sourceRoot,
-      buildMode,
-      gitVersion,
-      logger
-    );
-  }
-  if (repositoryProperties["github-codeql-disable-overlay" /* DISABLE_OVERLAY */] === true) {
+  } else if (repositoryProperties["github-codeql-disable-overlay" /* DISABLE_OVERLAY */] === true) {
     logger.info(
       `Setting overlay database mode to ${"none" /* None */} because the ${"github-codeql-disable-overlay" /* DISABLE_OVERLAY */} repository property is set to true.`
     );
-    return new Failure("disabled-by-repository-property" /* DisabledByRepositoryProperty */);
-  }
-  const featureResult = await checkOverlayAnalysisFeatureEnabled(
+    overlayDatabaseMode = "none" /* None */;
+    disabledReason = "disabled-by-repository-property" /* DisabledByRepositoryProperty */;
+  } else if (await isOverlayAnalysisFeatureEnabled(
     features,
     codeql,
     languages,
     codeScanningConfig
-  );
-  if (featureResult.isFailure()) {
-    return featureResult;
-  }
-  const performResourceChecks = !await features.getValue(
-    "overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */,
-    codeql
-  );
-  const useV2ResourceChecks = await features.getValue(
-    "overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */
-  );
-  const checkOverlayStatus = await features.getValue(
-    "overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */
-  );
-  const needDiskUsage = performResourceChecks || checkOverlayStatus;
-  const diskUsage = needDiskUsage ? await checkDiskUsage(logger) : void 0;
-  if (needDiskUsage && diskUsage === void 0) {
-    logger.warning(
-      `Unable to determine disk usage, therefore setting overlay database mode to ${"none" /* None */}.`
+  )) {
+    const performResourceChecks = !await features.getValue(
+      "overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */,
+      codeql
     );
-    return new Failure("unable-to-determine-disk-usage" /* UnableToDetermineDiskUsage */);
-  }
-  const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources(
-    codeql,
-    diskUsage,
-    ramInput,
-    logger,
-    useV2ResourceChecks
-  ) : new Success(void 0);
-  if (resourceResult.isFailure()) {
-    return resourceResult;
-  }
-  if (checkOverlayStatus && diskUsage !== void 0 && await shouldSkipOverlayAnalysis(codeql, languages, diskUsage, logger)) {
-    logger.info(
-      `Setting overlay database mode to ${"none" /* None */} because overlay analysis previously failed with this combination of languages, disk space, and CodeQL version.`
+    const useV2ResourceChecks = await features.getValue(
+      "overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */
     );
-    return new Failure("skipped-due-to-cached-status" /* SkippedDueToCachedStatus */);
-  }
-  let overlayDatabaseMode;
-  if (isAnalyzingPullRequest()) {
-    overlayDatabaseMode = "overlay" /* Overlay */;
-    logger.info(
-      `Setting overlay database mode to ${overlayDatabaseMode} with caching because we are analyzing a pull request.`
-    );
-  } else if (await isAnalyzingDefaultBranch()) {
-    overlayDatabaseMode = "overlay-base" /* OverlayBase */;
-    logger.info(
-      `Setting overlay database mode to ${overlayDatabaseMode} with caching because we are analyzing the default branch.`
+    const checkOverlayStatus = await features.getValue(
+      "overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */
     );
+    const diskUsage = performResourceChecks || checkOverlayStatus ? await checkDiskUsage(logger) : void 0;
+    if (performResourceChecks && !await runnerSupportsOverlayAnalysis(
+      codeql,
+      diskUsage,
+      ramInput,
+      logger,
+      useV2ResourceChecks
+    )) {
+      overlayDatabaseMode = "none" /* None */;
+      disabledReason = "insufficient-resources" /* InsufficientResources */;
+    } else if (checkOverlayStatus && diskUsage === void 0) {
+      logger.warning(
+        `Unable to determine disk usage, therefore setting overlay database mode to ${"none" /* None */}.`
+      );
+      overlayDatabaseMode = "none" /* None */;
+      disabledReason = "unable-to-determine-disk-usage" /* UnableToDetermineDiskUsage */;
+    } else if (checkOverlayStatus && diskUsage && await shouldSkipOverlayAnalysis(codeql, languages, diskUsage, logger)) {
+      logger.info(
+        `Setting overlay database mode to ${"none" /* None */} because overlay analysis previously failed with this combination of languages, disk space, and CodeQL version.`
+      );
+      overlayDatabaseMode = "none" /* None */;
+      disabledReason = "skipped-due-to-cached-status" /* SkippedDueToCachedStatus */;
+    } else if (isAnalyzingPullRequest()) {
+      overlayDatabaseMode = "overlay" /* Overlay */;
+      useOverlayDatabaseCaching = true;
+      logger.info(
+        `Setting overlay database mode to ${overlayDatabaseMode} with caching because we are analyzing a pull request.`
+      );
+    } else if (await isAnalyzingDefaultBranch()) {
+      overlayDatabaseMode = "overlay-base" /* OverlayBase */;
+      useOverlayDatabaseCaching = true;
+      logger.info(
+        `Setting overlay database mode to ${overlayDatabaseMode} with caching because we are analyzing the default branch.`
+      );
+    }
   } else {
-    return new Failure("not-pull-request-or-default-branch" /* NotPullRequestOrDefaultBranch */);
+    disabledReason = "feature-not-enabled" /* FeatureNotEnabled */;
+  }
+  const disabledResult = (reason) => ({
+    overlayDatabaseMode: "none" /* None */,
+    useOverlayDatabaseCaching: false,
+    disabledReason: reason
+  });
+  if (overlayDatabaseMode === "none" /* None */) {
+    return disabledResult(disabledReason);
   }
-  return validateOverlayDatabaseMode(
-    overlayDatabaseMode,
-    true,
-    codeql,
-    languages,
-    sourceRoot,
-    buildMode,
-    gitVersion,
-    logger
-  );
-}
-async function validateOverlayDatabaseMode(overlayDatabaseMode, useOverlayDatabaseCaching, codeql, languages, sourceRoot, buildMode, gitVersion, logger) {
   if (buildMode !== "none" /* None */ && (await Promise.all(
     languages.map(
       async (l) => l !== "go" /* go */ && // Workaround to allow overlay analysis for Go with any build
@@ -106568,36 +106548,37 @@ async function validateOverlayDatabaseMode(overlayDatabaseMode, useOverlayDataba
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because build-mode is set to "${buildMode}" instead of "none". Falling back to creating a normal full database instead.`
     );
-    return new Failure("incompatible-build-mode" /* IncompatibleBuildMode */);
+    return disabledResult("incompatible-build-mode" /* IncompatibleBuildMode */);
   }
   if (!await codeQlVersionAtLeast(codeql, CODEQL_OVERLAY_MINIMUM_VERSION)) {
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because the CodeQL CLI is older than ${CODEQL_OVERLAY_MINIMUM_VERSION}. Falling back to creating a normal full database instead.`
     );
-    return new Failure("incompatible-codeql" /* IncompatibleCodeQl */);
+    return disabledResult("incompatible-codeql" /* IncompatibleCodeQl */);
   }
   if (await getGitRoot(sourceRoot) === void 0) {
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because the source root "${sourceRoot}" is not inside a git repository. Falling back to creating a normal full database instead.`
     );
-    return new Failure("no-git-root" /* NoGitRoot */);
+    return disabledResult("no-git-root" /* NoGitRoot */);
   }
   if (gitVersion === void 0) {
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because the Git version could not be determined. Falling back to creating a normal full database instead.`
     );
-    return new Failure("incompatible-git" /* IncompatibleGit */);
+    return disabledResult("incompatible-git" /* IncompatibleGit */);
   }
   if (!gitVersion.isAtLeast(GIT_MINIMUM_VERSION_FOR_OVERLAY)) {
     logger.warning(
       `Cannot build an ${overlayDatabaseMode} database because the installed Git version is older than ${GIT_MINIMUM_VERSION_FOR_OVERLAY}. Falling back to creating a normal full database instead.`
     );
-    return new Failure("incompatible-git" /* IncompatibleGit */);
+    return disabledResult("incompatible-git" /* IncompatibleGit */);
   }
-  return new Success({
+  return {
     overlayDatabaseMode,
-    useOverlayDatabaseCaching
-  });
+    useOverlayDatabaseCaching,
+    disabledReason
+  };
 }
 function dbLocationOrDefault(dbLocation, tempDir) {
   return dbLocation || path9.resolve(tempDir, "codeql_databases");
@@ -106685,7 +106666,11 @@ async function initConfig(features, inputs) {
   } else {
     logger.debug(`Skipping check for generated files.`);
   }
-  const overlayDatabaseModeResult = await checkOverlayEnablement(
+  const {
+    overlayDatabaseMode,
+    useOverlayDatabaseCaching,
+    disabledReason: overlayDisabledReason
+  } = await getOverlayDatabaseMode(
     inputs.codeql,
     inputs.features,
     config.languages,
@@ -106697,27 +106682,19 @@ async function initConfig(features, inputs) {
     gitVersion,
     logger
   );
-  if (overlayDatabaseModeResult.isSuccess()) {
-    const { overlayDatabaseMode, useOverlayDatabaseCaching } = overlayDatabaseModeResult.value;
-    logger.info(
-      `Using overlay database mode: ${overlayDatabaseMode} ${useOverlayDatabaseCaching ? "with" : "without"} caching.`
-    );
-    config.overlayDatabaseMode = overlayDatabaseMode;
-    config.useOverlayDatabaseCaching = useOverlayDatabaseCaching;
-  } else {
-    const overlayDisabledReason = overlayDatabaseModeResult.value;
-    logger.info(
-      `Using overlay database mode: ${"none" /* None */} without caching.`
-    );
-    config.overlayDatabaseMode = "none" /* None */;
-    config.useOverlayDatabaseCaching = false;
+  logger.info(
+    `Using overlay database mode: ${overlayDatabaseMode} ${useOverlayDatabaseCaching ? "with" : "without"} caching.`
+  );
+  config.overlayDatabaseMode = overlayDatabaseMode;
+  config.useOverlayDatabaseCaching = useOverlayDatabaseCaching;
+  if (overlayDisabledReason !== void 0) {
     await addOverlayDisablementDiagnostics(
       config,
       inputs.codeql,
       overlayDisabledReason
     );
   }
-  if (config.overlayDatabaseMode === "overlay" /* Overlay */ || await shouldPerformDiffInformedAnalysis(
+  if (overlayDatabaseMode === "overlay" /* Overlay */ || await shouldPerformDiffInformedAnalysis(
     inputs.codeql,
     inputs.features,
     logger

lib/resolve-environment-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/setup-codeql-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/start-proxy-action-post.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/start-proxy-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/upload-lib.js

@@ -47350,14 +47350,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/upload-sarif-action-post.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

lib/upload-sarif-action.js

@@ -46053,14 +46053,14 @@ var require_package = __commonJS({
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         glob: "^11.1.0",
         globals: "^17.3.0",
         nock: "^14.0.11",
         sinon: "^21.0.1",
         typescript: "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       },
       overrides: {
         "@actions/tool-cache": {

package-lock.json

@@ -52,14 +52,14 @@
         "eslint-import-resolver-typescript": "^3.8.7",
         "eslint-plugin-github": "^6.0.0",
         "eslint-plugin-import-x": "^4.16.1",
-        "eslint-plugin-jsdoc": "^62.7.1",
+        "eslint-plugin-jsdoc": "^62.6.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^11.1.0",
         "globals": "^17.3.0",
         "nock": "^14.0.11",
         "sinon": "^21.0.1",
         "typescript": "^5.9.3",
-        "typescript-eslint": "^8.56.1"
+        "typescript-eslint": "^8.56.0"
       }
     },
     "node_modules/@aashutoshrathi/word-wrap": {
@@ -2553,17 +2553,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.56.1.tgz",
-      "integrity": "sha512-Jz9ZztpB37dNC+HU2HI28Bs9QXpzCz+y/twHOwhyrIRdbuVDxSytJNDl6z/aAKlaRIwC7y8wJdkBv7FxYGgi0A==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.56.0.tgz",
+      "integrity": "sha512-lRyPDLzNCuae71A3t9NEINBiTn7swyOhvUj3MyUOxb8x6g6vPEFoOU+ZRmGMusNC3X3YMhqMIX7i8ShqhT74Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/type-utils": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
+        "@typescript-eslint/scope-manager": "8.56.0",
+        "@typescript-eslint/type-utils": "8.56.0",
+        "@typescript-eslint/utils": "8.56.0",
+        "@typescript-eslint/visitor-keys": "8.56.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.4.0"
@@ -2576,7 +2576,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.56.1",
+        "@typescript-eslint/parser": "^8.56.0",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.0.0"
       }
@@ -2592,16 +2592,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.56.1.tgz",
-      "integrity": "sha512-klQbnPAAiGYFyI02+znpBRLyjL4/BrBd0nyWkdC0s/6xFLkXYQ8OoRrSkqacS1ddVxf/LDyODIKbQ5TgKAf/Fg==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.56.0.tgz",
+      "integrity": "sha512-IgSWvLobTDOjnaxAfDTIHaECbkNlAlKv2j5SjpB2v7QHKv1FIfjwMy8FsDbVfDX/KjmCmYICcw7uGaXLhtsLNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
+        "@typescript-eslint/scope-manager": "8.56.0",
+        "@typescript-eslint/types": "8.56.0",
+        "@typescript-eslint/typescript-estree": "8.56.0",
+        "@typescript-eslint/visitor-keys": "8.56.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2635,14 +2635,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.1.tgz",
-      "integrity": "sha512-TAdqQTzHNNvlVFfR+hu2PDJrURiwKsUvxFn1M0h95BB8ah5jejas08jUWG4dBA68jDMI988IvtfdAI53JzEHOQ==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.0.tgz",
+      "integrity": "sha512-M3rnyL1vIQOMeWxTWIW096/TtVP+8W3p/XnaFflhmcFp+U4zlxUxWj4XwNs6HbDeTtN4yun0GNTTDBw/SvufKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.56.1",
-        "@typescript-eslint/types": "^8.56.1",
+        "@typescript-eslint/tsconfig-utils": "^8.56.0",
+        "@typescript-eslint/types": "^8.56.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2675,14 +2675,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.56.1.tgz",
-      "integrity": "sha512-YAi4VDKcIZp0O4tz/haYKhmIDZFEUPOreKbfdAN3SzUDMcPhJ8QI99xQXqX+HoUVq8cs85eRKnD+rne2UAnj2w==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.56.0.tgz",
+      "integrity": "sha512-7UiO/XwMHquH+ZzfVCfUNkIXlp/yQjjnlYUyYz7pfvlK3/EyyN6BK+emDmGNyQLBtLGaYrTAI6KOw8tFucWL2w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1"
+        "@typescript-eslint/types": "8.56.0",
+        "@typescript-eslint/visitor-keys": "8.56.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2693,9 +2693,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.56.1.tgz",
-      "integrity": "sha512-qOtCYzKEeyr3aR9f28mPJqBty7+DBqsdd63eO0yyDwc6vgThj2UjWfJIcsFeSucYydqcuudMOprZ+x1SpF3ZuQ==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.56.0.tgz",
+      "integrity": "sha512-bSJoIIt4o3lKXD3xmDh9chZcjCz5Lk8xS7Rxn+6l5/pKrDpkCwtQNQQwZ2qRPk7TkUYhrq3WPIHXOXlbXP0itg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2710,15 +2710,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.56.1.tgz",
-      "integrity": "sha512-yB/7dxi7MgTtGhZdaHCemf7PuwrHMenHjmzgUW1aJpO+bBU43OycnM3Wn+DdvDO/8zzA9HlhaJ0AUGuvri4oGg==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.56.0.tgz",
+      "integrity": "sha512-qX2L3HWOU2nuDs6GzglBeuFXviDODreS58tLY/BALPC7iu3Fa+J7EOTwnX9PdNBxUI7Uh0ntP0YWGnxCkXzmfA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1",
+        "@typescript-eslint/types": "8.56.0",
+        "@typescript-eslint/typescript-estree": "8.56.0",
+        "@typescript-eslint/utils": "8.56.0",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.4.0"
       },
@@ -2753,9 +2753,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.56.1.tgz",
-      "integrity": "sha512-dbMkdIUkIkchgGDIv7KLUpa0Mda4IYjo4IAMJUZ+3xNoUXxMsk9YtKpTHSChRS85o+H9ftm51gsK1dZReY9CVw==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.56.0.tgz",
+      "integrity": "sha512-DBsLPs3GsWhX5HylbP9HNG15U0bnwut55Lx12bHB9MpXxQ+R5GC8MwQe+N1UFXxAeQDvEsEDY6ZYwX03K7Z6HQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2767,18 +2767,18 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.56.1.tgz",
-      "integrity": "sha512-qzUL1qgalIvKWAf9C1HpvBjif+Vm6rcT5wZd4VoMb9+Km3iS3Cv9DY6dMRMDtPnwRAFyAi7YXJpTIEXLvdfPxg==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.56.0.tgz",
+      "integrity": "sha512-ex1nTUMWrseMltXUHmR2GAQ4d+WjkZCT4f+4bVsps8QEdh0vlBsaCokKTPlnqBFqqGaxilDNJG7b8dolW2m43Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.56.1",
-        "@typescript-eslint/tsconfig-utils": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
+        "@typescript-eslint/project-service": "8.56.0",
+        "@typescript-eslint/tsconfig-utils": "8.56.0",
+        "@typescript-eslint/types": "8.56.0",
+        "@typescript-eslint/visitor-keys": "8.56.0",
         "debug": "^4.4.3",
-        "minimatch": "^10.2.2",
+        "minimatch": "^9.0.5",
         "semver": "^7.7.3",
         "tinyglobby": "^0.2.15",
         "ts-api-utils": "^2.4.0"
@@ -2794,27 +2794,14 @@
         "typescript": ">=4.8.4 <6.0.0"
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
-      "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
+        "balanced-match": "^1.0.0"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": {
@@ -2836,32 +2823,32 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": ">=16 || 14 >=14.17"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.56.1.tgz",
-      "integrity": "sha512-HPAVNIME3tABJ61siYlHzSWCGtOoeP2RTIaHXFMPqjrQKCGB9OgUVdiNgH7TJS2JNIQ5qQ4RsAUDuGaGme/KOA==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.56.0.tgz",
+      "integrity": "sha512-RZ3Qsmi2nFGsS+n+kjLAYDPVlrzf7UhTffrDIKr+h2yzAlYP/y5ZulU0yeDEPItos2Ph46JAL5P/On3pe7kDIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1"
+        "@typescript-eslint/scope-manager": "8.56.0",
+        "@typescript-eslint/types": "8.56.0",
+        "@typescript-eslint/typescript-estree": "8.56.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2876,13 +2863,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.56.1.tgz",
-      "integrity": "sha512-KiROIzYdEV85YygXw6BI/Dx4fnBlFQu6Mq4QE4MOH9fFnhohw6wX/OAvDY2/C+ut0I3RSPKenvZJIVYqJNkhEw==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.56.0.tgz",
+      "integrity": "sha512-q+SL+b+05Ud6LbEE35qe4A99P+htKTKVbyiNEe45eCbJFyh/HVK9QXwlrbz+Q4L8SOW4roxSVwXYj4DMBT7Ieg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/types": "8.56.0",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -2894,9 +2881,9 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
-      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.0.tgz",
+      "integrity": "sha512-A0XeIi7CXU7nPlfHS9loMYEKxUaONu/hTEzHTGba9Huu94Cq1hPivf+DE5erJozZOky0LfvXAyrV/tcswpLI0Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5159,9 +5146,9 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "62.7.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-62.7.1.tgz",
-      "integrity": "sha512-4Zvx99Q7d1uggYBUX/AIjvoyqXhluGbbKrRmG8SQTLprPFg6fa293tVJH1o1GQwNe3lUydd8ZHzn37OaSncgSQ==",
+      "version": "62.6.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-62.6.0.tgz",
+      "integrity": "sha512-Z18zZD1Q2m9usqFbAzb30z+lF8bzE4WiUy+dfOXljJlZ1Jm5uhkuAWfGV97FYyh+WlKfrvpDYs+s1z45eZWMfA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -5176,7 +5163,7 @@
         "html-entities": "^2.6.0",
         "object-deep-merge": "^2.0.0",
         "parse-imports-exports": "^0.2.4",
-        "semver": "^7.7.4",
+        "semver": "^7.7.3",
         "spdx-expression-parse": "^4.0.0",
         "to-valid-identifier": "^1.0.0"
       },
@@ -5184,7 +5171,7 @@
         "node": "^20.19.0 || ^22.13.0 || >=24"
       },
       "peerDependencies": {
-        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
+        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0"
       }
     },
     "node_modules/eslint-plugin-jsdoc/node_modules/debug": {
@@ -9202,16 +9189,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.56.1.tgz",
-      "integrity": "sha512-U4lM6pjmBX7J5wk4szltF7I1cGBHXZopnAXCMXb3+fZ3B/0Z3hq3wS/CCUB2NZBNAExK92mCU2tEohWuwVMsDQ==",
+      "version": "8.56.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.56.0.tgz",
+      "integrity": "sha512-c7toRLrotJ9oixgdW7liukZpsnq5CZ7PuKztubGYlNppuTqhIoWfhgHo/7EU0v06gS2l/x0i2NEFK1qMIf0rIg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.56.1",
-        "@typescript-eslint/parser": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1"
+        "@typescript-eslint/eslint-plugin": "8.56.0",
+        "@typescript-eslint/parser": "8.56.0",
+        "@typescript-eslint/typescript-estree": "8.56.0",
+        "@typescript-eslint/utils": "8.56.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"

package.json

@@ -67,14 +67,14 @@
     "eslint-import-resolver-typescript": "^3.8.7",
     "eslint-plugin-github": "^6.0.0",
     "eslint-plugin-import-x": "^4.16.1",
-    "eslint-plugin-jsdoc": "^62.7.1",
+    "eslint-plugin-jsdoc": "^62.6.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^11.1.0",
     "globals": "^17.3.0",
     "nock": "^14.0.11",
     "sinon": "^21.0.1",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.56.1"
+    "typescript-eslint": "^8.56.0"
   },
   "overrides": {
     "@actions/tool-cache": {

pr-checks/sync.ts

@@ -5,6 +5,8 @@ import * as path from "path";
 
 import * as yaml from "yaml";
 
+import { KnownLanguage } from "../src/languages";
+
 /** Known workflow input names. */
 enum KnownInputName {
   GoVersion = "go-version",
@@ -29,11 +31,7 @@ type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;
 /**
  * Represents PR check specifications.
  */
-interface Specification {
-  /** The display name for the check. */
-  name: string;
-  /** The workflow steps specific to this check. */
-  steps: any[];
+interface Specification extends JobSpecification {
   /** Workflow-level input definitions forwarded to `workflow_dispatch`/`workflow_call`. */
   inputs?: Record<string, WorkflowInput>;
   /** CodeQL bundle versions to test against. Defaults to `DEFAULT_TEST_VERSIONS`. */
@@ -45,27 +43,48 @@ interface Specification {
   /** Values for the `analysis-kinds` matrix dimension. */
   analysisKinds?: string[];
 
+  /** Container image configuration for the job. */
+  container?: any;
+  /** Service containers for the job. */
+  services?: any;
+
+  /** Additional jobs to run after the main PR check job. */
+  validationJobs?: Record<string, JobSpecification>;
+
+  /** If set, this check is part of a named collection that gets its own caller workflow. */
+  collection?: string;
+}
+
+/** Represents job specifications. */
+interface JobSpecification {
+  /** The display name for the check. */
+  name: string;
+  /** Custom permissions override for the job. */
+  permissions?: Record<string, string>;
+  /** Extra environment variables for the job. */
+  env?: Record<string, any>;
+
+  /** The workflow steps specific to this check. */
+  steps: any[];
+
   installNode?: boolean;
   installGo?: boolean;
   installJava?: boolean;
   installPython?: boolean;
   installDotNet?: boolean;
   installYq?: boolean;
-
-  /** Container image configuration for the job. */
-  container?: any;
-  /** Service containers for the job. */
-  services?: any;
-
-  /** Custom permissions override for the job. */
-  permissions?: Record<string, string>;
-  /** Extra environment variables for the job. */
-  env?: Record<string, any>;
-
-  /** If set, this check is part of a named collection that gets its own caller workflow. */
-  collection?: string;
 }
 
+/** Describes language/framework-specific steps and inputs. */
+interface LanguageSetup {
+  specProperty: keyof JobSpecification;
+  inputs?: WorkflowInputs;
+  steps: any[];
+}
+
+/** Describes partial mappings from known languages to their specific setup information. */
+type LanguageSetups = Partial<Record<KnownLanguage, LanguageSetup>>;
+
 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
   // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
@@ -90,6 +109,136 @@ const defaultTestVersions = [
   "nightly-latest",
 ];
 
+/** The default versions we use for languages / frameworks, if not specified as a workflow input. */
+const defaultLanguageVersions = {
+  javascript: "20.x",
+  go: ">=1.21.0",
+  java: "17",
+  python: "3.13",
+  csharp: "9.x",
+} as const satisfies Partial<Record<KnownLanguage, string>>;
+
+/** A partial mapping from known languages to their specific setup information. */
+const languageSetups: LanguageSetups = {
+  javascript: {
+    specProperty: "installNode",
+    steps: [
+      {
+        name: "Install Node.js",
+        uses: "actions/setup-node@v6",
+        with: {
+          "node-version": defaultLanguageVersions.javascript,
+          cache: "npm",
+        },
+      },
+      {
+        name: "Install dependencies",
+        run: "npm ci",
+      },
+    ],
+  },
+  go: {
+    specProperty: "installGo",
+    inputs: {
+      [KnownInputName.GoVersion]: {
+        type: "string",
+        description: "The version of Go to install",
+        required: false,
+        default: defaultLanguageVersions.go,
+      },
+    },
+    steps: [
+      {
+        name: "Install Go",
+        uses: "actions/setup-go@v6",
+        with: {
+          "go-version":
+            "${{ inputs.go-version || '" + defaultLanguageVersions.go + "' }}",
+          // to avoid potentially misleading autobuilder results where we expect it to download
+          // dependencies successfully, but they actually come from a warm cache
+          cache: false,
+        },
+      },
+    ],
+  },
+  java: {
+    specProperty: "installJava",
+    inputs: {
+      [KnownInputName.JavaVersion]: {
+        type: "string",
+        description: "The version of Java to install",
+        required: false,
+        default: defaultLanguageVersions.java,
+      },
+    },
+    steps: [
+      {
+        name: "Install Java",
+        uses: "actions/setup-java@v5",
+        with: {
+          "java-version":
+            "${{ inputs.java-version || '" +
+            defaultLanguageVersions.java +
+            "' }}",
+          distribution: "temurin",
+        },
+      },
+    ],
+  },
+  python: {
+    specProperty: "installPython",
+    inputs: {
+      [KnownInputName.PythonVersion]: {
+        type: "string",
+        description: "The version of Python to install",
+        required: false,
+        default: defaultLanguageVersions.python,
+      },
+    },
+    steps: [
+      {
+        name: "Install Python",
+        if: "matrix.version != 'nightly-latest' || !matrix.version",
+        uses: "actions/setup-python@v6",
+        with: {
+          "python-version":
+            "${{ inputs.python-version || '" +
+            defaultLanguageVersions.python +
+            "' }}",
+        },
+      },
+    ],
+  },
+  csharp: {
+    specProperty: "installDotNet",
+    inputs: {
+      [KnownInputName.DotnetVersion]: {
+        type: "string",
+        description: "The version of .NET to install",
+        required: false,
+        default: defaultLanguageVersions.csharp,
+      },
+    },
+    steps: [
+      {
+        name: "Install .NET",
+        uses: "actions/setup-dotnet@v5",
+        with: {
+          "dotnet-version":
+            "${{ inputs.dotnet-version || '" +
+            defaultLanguageVersions.csharp +
+            "' }}",
+        },
+      },
+    ],
+  },
+};
+
+// This is essentially an arbitrary version of `yq`, which happened to be the one that
+// `choco` fetched when we moved away from using that here.
+// See https://github.com/github/codeql-action/pull/3423
+const YQ_VERSION = "v4.50.1";
+
 const THIS_DIR = __dirname;
 const CHECKS_DIR = path.join(THIS_DIR, "checks");
 const OUTPUT_DIR = path.join(THIS_DIR, "..", ".github", "workflows");
@@ -134,6 +283,351 @@ function stripTrailingWhitespace(content: string): string {
     .join("\n");
 }
 
+/** Generates the matrix for a job. */
+function generateJobMatrix(
+  checkSpecification: Specification,
+): Array<Record<string, any>> {
+  let matrix: Array<Record<string, any>> = [];
+
+  for (const version of checkSpecification.versions ?? defaultTestVersions) {
+    if (version === "latest") {
+      throw new Error(
+        'Did not recognise "version: latest". Did you mean "version: linked"?',
+      );
+    }
+
+    const runnerImages = ["ubuntu-latest", "macos-latest", "windows-latest"];
+    const operatingSystems = checkSpecification.operatingSystems ?? ["ubuntu"];
+
+    for (const operatingSystem of operatingSystems) {
+      const runnerImagesForOs = runnerImages.filter((image) =>
+        image.startsWith(operatingSystem),
+      );
+
+      for (const runnerImage of runnerImagesForOs) {
+        matrix.push({
+          os: runnerImage,
+          version,
+        });
+      }
+    }
+  }
+
+  if (checkSpecification.analysisKinds) {
+    const newMatrix: Array<Record<string, any>> = [];
+    for (const matrixInclude of matrix) {
+      for (const analysisKind of checkSpecification.analysisKinds) {
+        newMatrix.push({
+          ...matrixInclude,
+          "analysis-kinds": analysisKind,
+        });
+      }
+    }
+    matrix = newMatrix;
+  }
+
+  return matrix;
+}
+
+/**
+ * Retrieves setup steps and additional input definitions based on specific languages or frameworks
+ * that are requested by the `checkSpecification`.
+ *
+ * @returns An object containing setup steps and additional input specifications.
+ */
+function getSetupSteps(checkSpecification: JobSpecification): {
+  inputs: WorkflowInputs;
+  steps: any[];
+} {
+  let inputs: WorkflowInputs = {};
+  const steps: any[] = [];
+
+  for (const language of Object.values(KnownLanguage).sort()) {
+    const setupSpec = languageSetups[language];
+
+    if (
+      setupSpec === undefined ||
+      checkSpecification[setupSpec.specProperty] !== true
+    ) {
+      continue;
+    }
+
+    steps.push(...setupSpec.steps);
+    inputs = { ...inputs, ...setupSpec.inputs };
+  }
+
+  const installYq = checkSpecification.installYq;
+
+  if (installYq) {
+    steps.push({
+      name: "Install yq",
+      if: "runner.os == 'Windows'",
+      env: {
+        YQ_PATH: "${{ runner.temp }}/yq",
+        YQ_VERSION,
+      },
+      run:
+        'gh release download --repo mikefarah/yq --pattern "yq_windows_amd64.exe" "$YQ_VERSION" -O "$YQ_PATH/yq.exe"\n' +
+        'echo "$YQ_PATH" >> "$GITHUB_PATH"',
+    });
+  }
+
+  return { inputs, steps };
+}
+
+/**
+ * Generates an Actions job from the `checkSpecification`.
+ *
+ * @param specDocument
+ * The raw YAML document of the PR check specification.
+ * Used to extract `jobs` without losing the original formatting.
+ * @param checkSpecification The PR check specification.
+ * @returns The job and additional workflow inputs.
+ */
+function generateJob(
+  specDocument: yaml.Document,
+  checkSpecification: Specification,
+  checkName: string,
+) {
+  const matrix: Array<Record<string, any>> =
+    generateJobMatrix(checkSpecification);
+
+  const useAllPlatformBundle = checkSpecification.useAllPlatformBundle
+    ? checkSpecification.useAllPlatformBundle
+    : "false";
+
+  // Determine which languages or frameworks have to be installed.
+  const setupInfo = getSetupSteps(checkSpecification);
+  const workflowInputs = setupInfo.inputs;
+
+  // Construct the workflow steps needed for this check.
+  const steps: any[] = [
+    {
+      name: "Check out repository",
+      uses: "actions/checkout@v6",
+    },
+    ...setupInfo.steps,
+    {
+      name: "Prepare test",
+      id: "prepare-test",
+      uses: "./.github/actions/prepare-test",
+      with: {
+        version: "${{ matrix.version }}",
+        "use-all-platform-bundle": useAllPlatformBundle,
+        // If the action is being run from a container, then do not setup kotlin.
+        // This is because the kotlin binaries cannot be downloaded from the container.
+        "setup-kotlin": "container" in checkSpecification ? "false" : "true",
+      },
+    },
+  ];
+
+  // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
+  const specSteps = specDocument.get("steps") as yaml.YAMLSeq;
+
+  // A handful of workflow specifications use double quotes for values, while we generally use single quotes.
+  // This replaces double quotes with single quotes for consistency.
+  yaml.visit(specSteps, {
+    Scalar(_key, node) {
+      if (node.type === "QUOTE_DOUBLE") {
+        node.type = "QUOTE_SINGLE";
+      }
+    },
+  });
+
+  // Add the generated steps in front of the ones from the specification.
+  specSteps.items.unshift(...steps);
+
+  const checkJob: Record<string, any> = {
+    strategy: {
+      "fail-fast": false,
+      matrix: {
+        include: matrix,
+      },
+    },
+    name: checkSpecification.name,
+    needs: [`should-run-${checkName}`],
+    if: `needs.should-run-${checkName}.outputs.run-check == 'true'`,
+    permissions: {
+      contents: "read",
+      "security-events": "read",
+    },
+    "timeout-minutes": 45,
+    "runs-on": "${{ matrix.os }}",
+    steps: specSteps,
+  };
+
+  if (checkSpecification.permissions) {
+    checkJob.permissions = checkSpecification.permissions;
+  }
+
+  for (const key of ["env", "container", "services"] as const) {
+    if (checkSpecification[key] !== undefined) {
+      checkJob[key] = checkSpecification[key];
+    }
+  }
+
+  checkJob.env = checkJob.env ?? {};
+  if (!("CODEQL_ACTION_TEST_MODE" in checkJob.env)) {
+    checkJob.env.CODEQL_ACTION_TEST_MODE = true;
+  }
+
+  return { checkJob, workflowInputs };
+}
+
+function generateChangedFilesJob(checkSpecification: Specification) {
+  const changedFilesJob: Record<string, any> = {
+    name: "Decide whether to run this check",
+    "timeout-minutes": 10,
+    "runs-on": "ubuntu-slim",
+    if: "github.triggering_actor != 'dependabot[bot]'",
+    outputs: {
+      "run-check":
+        "${{ steps.changed-files-check.outputs.run-check || steps.event-type-check.outputs.run-check }}",
+    },
+    steps: [
+      {
+        name: "Run check if this is not a PR",
+        id: "event-type-check",
+        if: "github.event_name != 'pull_request'",
+        run: 'echo "run-check=true" >> "$GITHUB_OUTPUT"',
+      },
+      {
+        name: "Check out repository",
+        if: "github.event_name == 'pull_request'",
+        uses: "actions/checkout@v6",
+      },
+      {
+        name: "Determine changed files",
+        id: "changed-files",
+        if: "github.event_name == 'pull_request'",
+        uses: "./.github/actions/changed-files",
+        with: {
+          "github-token": "${{ secrets.GITHUB_TOKEN }}",
+          exclude: JSON.stringify(["README.md"]),
+        },
+      },
+      {
+        name: "Run check because of changed files",
+        id: "changed-files-check",
+        if: "github.event_name != 'pull_request' && steps.changed-files.outputs.files != '[]'",
+        run: 'echo "run-check=true" >> "$GITHUB_OUTPUT"',
+      },
+    ],
+  };
+
+  return changedFilesJob;
+}
+
+function generateSkipJob(checkSpecification: Specification, checkName: string) {
+  const matrix: Array<Record<string, any>> =
+    generateJobMatrix(checkSpecification);
+
+  const skipJob: Record<string, any> = {
+    strategy: {
+      "fail-fast": false,
+      matrix: {
+        include: matrix,
+      },
+    },
+    // This has to be the same as for the main job.
+    name: checkSpecification.name,
+    needs: [`should-run-${checkName}`],
+    if: `needs.should-run-${checkName}.outputs.run-check != 'true'`,
+    "timeout-minutes": 5,
+    // Since we are not actually doing anything, we don't need to run on `matrix.os`
+    "runs-on": "ubuntu-slim",
+    steps: [{ name: "Success", run: "exit 0" }],
+  };
+
+  return skipJob;
+}
+
+/** Generates a validation job. */
+function generateValidationJob(
+  specDocument: yaml.Document,
+  jobSpecification: JobSpecification,
+  checkName: string,
+  name: string,
+) {
+  // Determine which languages or frameworks have to be installed.
+  const { inputs, steps } = getSetupSteps(jobSpecification);
+
+  // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
+  const specSteps = specDocument.getIn([
+    "validationJobs",
+    name,
+    "steps",
+  ]) as yaml.YAMLSeq;
+
+  // Add the generated steps in front of the ones from the specification.
+  specSteps.items.unshift(...steps);
+
+  const validationJob: Record<string, any> = {
+    name: jobSpecification.name,
+    if: "github.triggering_actor != 'dependabot[bot]'",
+    needs: [checkName],
+    permissions: {
+      contents: "read",
+      "security-events": "read",
+    },
+    "timeout-minutes": 5,
+    "runs-on": "ubuntu-slim",
+    steps: specSteps,
+  };
+
+  if (jobSpecification.permissions) {
+    validationJob.permissions = jobSpecification.permissions;
+  }
+
+  for (const key of ["env"] as const) {
+    if (jobSpecification[key] !== undefined) {
+      validationJob[key] = jobSpecification[key];
+    }
+  }
+
+  validationJob.env = validationJob.env ?? {};
+  if (!("CODEQL_ACTION_TEST_MODE" in validationJob.env)) {
+    validationJob.env.CODEQL_ACTION_TEST_MODE = true;
+  }
+
+  return { validationJob, inputs };
+}
+
+/** Generates additional jobs that run after the main check job, based on the `validationJobs` property. */
+function generateValidationJobs(
+  specDocument: yaml.Document,
+  checkSpecification: Specification,
+  checkName: string,
+) {
+  if (checkSpecification.validationJobs === undefined) {
+    return { validationJobs: {}, workflowInputs: {} };
+  }
+
+  const validationJobs: Record<string, any> = {};
+  let workflowInputs: WorkflowInputs = {};
+
+  for (const [jobName, jobSpec] of Object.entries(
+    checkSpecification.validationJobs,
+  )) {
+    if (checkName === jobName) {
+      throw new Error(
+        `Validation job '${jobName}' cannot have the same name as the main job.`,
+      );
+    }
+
+    const { validationJob, inputs } = generateValidationJob(
+      specDocument,
+      jobSpec,
+      checkName,
+      jobName,
+    );
+    validationJobs[jobName] = validationJob;
+    workflowInputs = { ...workflowInputs, ...inputs };
+  }
+
+  return { validationJobs, workflowInputs };
+}
+
 /**
  * Main entry point for the sync script.
  */
@@ -166,248 +660,14 @@ function main(): void {
 
     console.log(`Processing: ${checkName} — "${checkSpecification.name}"`);
 
-    const workflowInputs: WorkflowInputs = {};
-    let matrix: Array<Record<string, any>> = [];
-
-    for (const version of checkSpecification.versions ?? defaultTestVersions) {
-      if (version === "latest") {
-        throw new Error(
-          'Did not recognise "version: latest". Did you mean "version: linked"?',
-        );
-      }
-
-      const runnerImages = ["ubuntu-latest", "macos-latest", "windows-latest"];
-      const operatingSystems = checkSpecification.operatingSystems ?? [
-        "ubuntu",
-      ];
-
-      for (const operatingSystem of operatingSystems) {
-        const runnerImagesForOs = runnerImages.filter((image) =>
-          image.startsWith(operatingSystem),
-        );
-
-        for (const runnerImage of runnerImagesForOs) {
-          matrix.push({
-            os: runnerImage,
-            version,
-          });
-        }
-      }
-    }
-
-    const useAllPlatformBundle = checkSpecification.useAllPlatformBundle
-      ? checkSpecification.useAllPlatformBundle
-      : "false";
-
-    if (checkSpecification.analysisKinds) {
-      const newMatrix: Array<Record<string, any>> = [];
-      for (const matrixInclude of matrix) {
-        for (const analysisKind of checkSpecification.analysisKinds) {
-          newMatrix.push({
-            ...matrixInclude,
-            "analysis-kinds": analysisKind,
-          });
-        }
-      }
-      matrix = newMatrix;
-    }
-
-    // Construct the workflow steps needed for this check.
-    const steps: any[] = [
-      {
-        name: "Check out repository",
-        uses: "actions/checkout@v6",
-      },
-    ];
-
-    const installNode = checkSpecification.installNode;
-
-    if (installNode) {
-      steps.push(
-        {
-          name: "Install Node.js",
-          uses: "actions/setup-node@v6",
-          with: {
-            "node-version": "20.x",
-            cache: "npm",
-          },
-        },
-        {
-          name: "Install dependencies",
-          run: "npm ci",
-        },
-      );
-    }
-
-    steps.push({
-      name: "Prepare test",
-      id: "prepare-test",
-      uses: "./.github/actions/prepare-test",
-      with: {
-        version: "${{ matrix.version }}",
-        "use-all-platform-bundle": useAllPlatformBundle,
-        // If the action is being run from a container, then do not setup kotlin.
-        // This is because the kotlin binaries cannot be downloaded from the container.
-        "setup-kotlin": "container" in checkSpecification ? "false" : "true",
-      },
-    });
-
-    const installGo = checkSpecification.installGo;
-
-    if (installGo) {
-      const baseGoVersionExpr = ">=1.21.0";
-      workflowInputs[KnownInputName.GoVersion] = {
-        type: "string",
-        description: "The version of Go to install",
-        required: false,
-        default: baseGoVersionExpr,
-      };
-
-      steps.push({
-        name: "Install Go",
-        uses: "actions/setup-go@v6",
-        with: {
-          "go-version":
-            "${{ inputs.go-version || '" + baseGoVersionExpr + "' }}",
-          // to avoid potentially misleading autobuilder results where we expect it to download
-          // dependencies successfully, but they actually come from a warm cache
-          cache: false,
-        },
-      });
-    }
-
-    const installJava = checkSpecification.installJava;
-
-    if (installJava) {
-      const baseJavaVersionExpr = "17";
-      workflowInputs[KnownInputName.JavaVersion] = {
-        type: "string",
-        description: "The version of Java to install",
-        required: false,
-        default: baseJavaVersionExpr,
-      };
-
-      steps.push({
-        name: "Install Java",
-        uses: "actions/setup-java@v5",
-        with: {
-          "java-version":
-            "${{ inputs.java-version || '" + baseJavaVersionExpr + "' }}",
-          distribution: "temurin",
-        },
-      });
-    }
-
-    const installPython = checkSpecification.installPython;
-
-    if (installPython) {
-      const basePythonVersionExpr = "3.13";
-      workflowInputs[KnownInputName.PythonVersion] = {
-        type: "string",
-        description: "The version of Python to install",
-        required: false,
-        default: basePythonVersionExpr,
-      };
-
-      steps.push({
-        name: "Install Python",
-        if: "matrix.version != 'nightly-latest'",
-        uses: "actions/setup-python@v6",
-        with: {
-          "python-version":
-            "${{ inputs.python-version || '" + basePythonVersionExpr + "' }}",
-        },
-      });
-    }
-
-    const installDotNet = checkSpecification.installDotNet;
-
-    if (installDotNet) {
-      const baseDotNetVersionExpr = "9.x";
-      workflowInputs[KnownInputName.DotnetVersion] = {
-        type: "string",
-        description: "The version of .NET to install",
-        required: false,
-        default: baseDotNetVersionExpr,
-      };
-
-      steps.push({
-        name: "Install .NET",
-        uses: "actions/setup-dotnet@v5",
-        with: {
-          "dotnet-version":
-            "${{ inputs.dotnet-version || '" + baseDotNetVersionExpr + "' }}",
-        },
-      });
-    }
-
-    const installYq = checkSpecification.installYq;
-
-    if (installYq) {
-      steps.push({
-        name: "Install yq",
-        if: "runner.os == 'Windows'",
-        env: {
-          YQ_PATH: "${{ runner.temp }}/yq",
-          // This is essentially an arbitrary version of `yq`, which happened to be the one that
-          // `choco` fetched when we moved away from using that here.
-          // See https://github.com/github/codeql-action/pull/3423
-          YQ_VERSION: "v4.50.1",
-        },
-        run:
-          'gh release download --repo mikefarah/yq --pattern "yq_windows_amd64.exe" "$YQ_VERSION" -O "$YQ_PATH/yq.exe"\n' +
-          'echo "$YQ_PATH" >> "$GITHUB_PATH"',
-      });
-    }
-
-    // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
-    const specSteps = specDocument.get("steps") as yaml.YAMLSeq;
-
-    // A handful of workflow specifications use double quotes for values, while we generally use single quotes.
-    // This replaces double quotes with single quotes for consistency.
-    yaml.visit(specSteps, {
-      Scalar(_key, node) {
-        if (node.type === "QUOTE_DOUBLE") {
-          node.type = "QUOTE_SINGLE";
-        }
-      },
-    });
-
-    // Add the generated steps in front of the ones from the specification.
-    specSteps.items.unshift(...steps);
-
-    const checkJob: Record<string, any> = {
-      strategy: {
-        "fail-fast": false,
-        matrix: {
-          include: matrix,
-        },
-      },
-      name: checkSpecification.name,
-      if: "github.triggering_actor != 'dependabot[bot]'",
-      permissions: {
-        contents: "read",
-        "security-events": "read",
-      },
-      "timeout-minutes": 45,
-      "runs-on": "${{ matrix.os }}",
-      steps: specSteps,
-    };
-
-    if (checkSpecification.permissions) {
-      checkJob.permissions = checkSpecification.permissions;
-    }
-
-    for (const key of ["env", "container", "services"] as const) {
-      if (checkSpecification[key] !== undefined) {
-        checkJob[key] = checkSpecification[key];
-      }
-    }
-
-    checkJob.env = checkJob.env ?? {};
-    if (!("CODEQL_ACTION_TEST_MODE" in checkJob.env)) {
-      checkJob.env.CODEQL_ACTION_TEST_MODE = true;
-    }
+    const { checkJob, workflowInputs } = generateJob(
+      specDocument,
+      checkSpecification,
+      checkName,
+    );
+    const { validationJobs, workflowInputs: validationJobInputs } =
+      generateValidationJobs(specDocument, checkSpecification, checkName);
+    const combinedInputs = { ...workflowInputs, ...validationJobInputs };
 
     // If this check belongs to a named collection, record it.
     if (checkSpecification.collection) {
@@ -418,12 +678,15 @@ function main(): void {
       collections[collectionName].push({
         specification: checkSpecification,
         checkName,
-        inputs: workflowInputs,
+        inputs: combinedInputs,
       });
     }
 
+    const shouldRunJob = generateChangedFilesJob(checkSpecification);
+    const skipJob = generateSkipJob(checkSpecification, checkName);
+
     let extraGroupName = "";
-    for (const inputName of Object.keys(workflowInputs)) {
+    for (const inputName of Object.keys(combinedInputs)) {
       extraGroupName += "-${{inputs." + inputName + "}}";
     }
 
@@ -448,10 +711,10 @@ function main(): void {
         },
         schedule: [{ cron }],
         workflow_dispatch: {
-          inputs: workflowInputs,
+          inputs: combinedInputs,
         },
         workflow_call: {
-          inputs: workflowInputs,
+          inputs: combinedInputs,
         },
       },
       defaults: {
@@ -465,7 +728,10 @@ function main(): void {
         group: checkName + "-${{github.ref}}" + extraGroupName,
       },
       jobs: {
+        ["should-run-" + checkName]: shouldRunJob,
         [checkName]: checkJob,
+        ["skip-" + checkName]: skipJob,
+        ...validationJobs,
       },
     };
 

pr-checks/tsconfig.json

@@ -0,0 +1,33 @@
+{
+  "compilerOptions": {
+    /* Basic Options */
+    "lib": ["ES2022"],
+    "target": "ES2022",
+    "module": "commonjs",
+    "rootDir": "..",
+    "sourceMap": false,
+    "noEmit": true,
+
+    /* Strict Type-Checking Options */
+    "strict": true,                           /* Enable all strict type-checking options. */
+    "noImplicitAny": false,                   /* Raise error on expressions and declarations with an implied 'any' type. */
+    "strictNullChecks": true,                 /* Enable strict null checks. */
+    "strictFunctionTypes": true,              /* Enable strict checking of function types. */
+    "strictBindCallApply": true,              /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
+    "strictPropertyInitialization": true,     /* Enable strict checking of property initialization in classes. */
+    "noImplicitThis": true,                   /* Raise error on 'this' expressions with an implied 'any' type. */
+    "alwaysStrict": true,                     /* Parse in strict mode and emit "use strict" for each source file. */
+
+    /* Additional Checks */
+    "noUnusedLocals": false,                   /* Report errors on unused locals. */
+    "noUnusedParameters": false,               /* Report errors on unused parameters. */
+    "noImplicitReturns": true,                /* Report error when not all code paths in function return a value. */
+    "noFallthroughCasesInSwitch": true,       /* Report errors for fallthrough cases in switch statement. */
+
+    /* Module Resolution Options */
+    "esModuleInterop": true,                  /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    "resolveJsonModule": true,
+  },
+  "include": ["./*.ts", "../src/**/*.ts"],
+  "exclude": ["node_modules"]
+}

src/config-utils.test.ts

@@ -40,8 +40,6 @@ import {
   withTmpDir,
   BuildMode,
   DiskUsage,
-  Success,
-  Failure,
 } from "./util";
 import * as util from "./util";
 
@@ -944,46 +942,55 @@ for (const { displayName, language, feature } of [
     feature: Feature.DisableCsharpBuildless,
   },
 ]) {
-  test(`Build mode not overridden when disable ${displayName} buildless feature flag disabled`, async (t) => {
-    const messages: LoggedMessage[] = [];
-    const buildMode = await configUtils.parseBuildModeInput(
-      "none",
-      [language],
-      createFeatures([]),
-      getRecordingLogger(messages),
-    );
-    t.is(buildMode, BuildMode.None);
-    t.deepEqual(messages, []);
-  });
+  test.serial(
+    `Build mode not overridden when disable ${displayName} buildless feature flag disabled`,
+    async (t) => {
+      const messages: LoggedMessage[] = [];
+      const buildMode = await configUtils.parseBuildModeInput(
+        "none",
+        [language],
+        createFeatures([]),
+        getRecordingLogger(messages),
+      );
+      t.is(buildMode, BuildMode.None);
+      t.deepEqual(messages, []);
+    },
+  );
 
-  test(`Build mode not overridden for other languages when disable ${displayName} buildless feature flag enabled`, async (t) => {
-    const messages: LoggedMessage[] = [];
-    const buildMode = await configUtils.parseBuildModeInput(
-      "none",
-      [KnownLanguage.python],
-      createFeatures([feature]),
-      getRecordingLogger(messages),
-    );
-    t.is(buildMode, BuildMode.None);
-    t.deepEqual(messages, []);
-  });
+  test.serial(
+    `Build mode not overridden for other languages when disable ${displayName} buildless feature flag enabled`,
+    async (t) => {
+      const messages: LoggedMessage[] = [];
+      const buildMode = await configUtils.parseBuildModeInput(
+        "none",
+        [KnownLanguage.python],
+        createFeatures([feature]),
+        getRecordingLogger(messages),
+      );
+      t.is(buildMode, BuildMode.None);
+      t.deepEqual(messages, []);
+    },
+  );
 
-  test(`Build mode overridden when analyzing ${displayName} and disable ${displayName} buildless feature flag enabled`, async (t) => {
-    const messages: LoggedMessage[] = [];
-    const buildMode = await configUtils.parseBuildModeInput(
-      "none",
-      [language],
-      createFeatures([feature]),
-      getRecordingLogger(messages),
-    );
-    t.is(buildMode, BuildMode.Autobuild);
-    t.deepEqual(messages, [
-      {
-        message: `Scanning ${displayName} code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.`,
-        type: "warning",
-      },
-    ]);
-  });
+  test.serial(
+    `Build mode overridden when analyzing ${displayName} and disable ${displayName} buildless feature flag enabled`,
+    async (t) => {
+      const messages: LoggedMessage[] = [];
+      const buildMode = await configUtils.parseBuildModeInput(
+        "none",
+        [language],
+        createFeatures([feature]),
+        getRecordingLogger(messages),
+      );
+      t.is(buildMode, BuildMode.Autobuild);
+      t.deepEqual(messages, [
+        {
+          message: `Scanning ${displayName} code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.`,
+          type: "warning",
+        },
+      ]);
+    },
+  );
 }
 
 interface OverlayDatabaseModeTestSetup {
@@ -1026,19 +1033,16 @@ const defaultOverlayDatabaseModeTestSetup: OverlayDatabaseModeTestSetup = {
   repositoryProperties: {},
 };
 
-const checkOverlayEnablementMacro = test.macro({
+const getOverlayDatabaseModeMacro = test.macro({
   exec: async (
     t: ExecutionContext,
     _title: string,
     setupOverrides: Partial<OverlayDatabaseModeTestSetup>,
-    expected:
-      | {
-          overlayDatabaseMode: OverlayDatabaseMode;
-          useOverlayDatabaseCaching: boolean;
-        }
-      | {
-          disabledReason: OverlayDisabledReason;
-        },
+    expected: {
+      overlayDatabaseMode: OverlayDatabaseMode;
+      useOverlayDatabaseCaching: boolean;
+      disabledReason?: OverlayDisabledReason;
+    },
   ) => {
     return await withTmpDir(async (tempDir) => {
       const messages: LoggedMessage[] = [];
@@ -1096,7 +1100,7 @@ const checkOverlayEnablementMacro = test.macro({
           .stub(gitUtils, "isAnalyzingDefaultBranch")
           .resolves(setup.isDefaultBranch);
 
-        const result = await configUtils.checkOverlayEnablement(
+        const result = await configUtils.getOverlayDatabaseMode(
           codeql,
           features,
           setup.languages,
@@ -1109,22 +1113,22 @@ const checkOverlayEnablementMacro = test.macro({
           logger,
         );
 
-        if ("disabledReason" in expected) {
-          t.deepEqual(result, new Failure(expected.disabledReason));
-        } else {
-          t.deepEqual(result, new Success(expected));
+        if (!("disabledReason" in expected)) {
+          expected.disabledReason = undefined;
         }
+
+        t.deepEqual(result, expected);
       } finally {
         // Restore the original environment
         process.env = originalEnv;
       }
     });
   },
-  title: (_, title) => `checkOverlayEnablement: ${title}`,
+  title: (_, title) => `getOverlayDatabaseMode: ${title}`,
 });
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Environment variable override - Overlay",
   {
     overlayDatabaseEnvVar: "overlay",
@@ -1136,7 +1140,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Environment variable override - OverlayBase",
   {
     overlayDatabaseEnvVar: "overlay-base",
@@ -1148,41 +1152,45 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Environment variable override - None",
   {
     overlayDatabaseEnvVar: "none",
   },
   {
-    disabledReason: OverlayDisabledReason.DisabledByEnvironmentVariable,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Ignore invalid environment variable",
   {
     overlayDatabaseEnvVar: "invalid-mode",
   },
   {
-    disabledReason: OverlayDisabledReason.OverallFeatureNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Ignore feature flag when analyzing non-default branch",
   {
     languages: [KnownLanguage.javascript],
     features: [Feature.OverlayAnalysis, Feature.OverlayAnalysisJavascript],
   },
   {
-    disabledReason: OverlayDisabledReason.NotPullRequestOrDefaultBranch,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch when feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1196,7 +1204,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch when feature enabled with custom analysis",
   {
     languages: [KnownLanguage.javascript],
@@ -1213,7 +1221,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch when code-scanning feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1230,7 +1238,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch if runner disk space is too low",
   {
     languages: [KnownLanguage.javascript],
@@ -1245,12 +1253,14 @@ test.serial(
     },
   },
   {
-    disabledReason: OverlayDisabledReason.InsufficientDiskSpace,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch if we can't determine runner disk space",
   {
     languages: [KnownLanguage.javascript],
@@ -1262,12 +1272,14 @@ test.serial(
     diskUsage: undefined,
   },
   {
-    disabledReason: OverlayDisabledReason.UnableToDetermineDiskUsage,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch if runner disk space is too low and skip resource checks flag is enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1289,7 +1301,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1305,12 +1317,14 @@ test.serial(
     },
   },
   {
-    disabledReason: OverlayDisabledReason.InsufficientDiskSpace,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1332,7 +1346,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1347,12 +1361,14 @@ test.serial(
     },
   },
   {
-    disabledReason: OverlayDisabledReason.InsufficientDiskSpace,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch if memory flag is too low",
   {
     languages: [KnownLanguage.javascript],
@@ -1364,12 +1380,14 @@ test.serial(
     memoryFlagValue: 3072,
   },
   {
-    disabledReason: OverlayDisabledReason.InsufficientMemory,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch if memory flag is too low but CodeQL >= 2.24.3",
   {
     languages: [KnownLanguage.javascript],
@@ -1388,7 +1406,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay-base database on default branch if memory flag is too low and skip resource checks flag is enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1407,7 +1425,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when cached status indicates previous failure",
   {
     languages: [KnownLanguage.javascript],
@@ -1420,12 +1438,14 @@ test.serial(
     shouldSkipOverlayAnalysisDueToCachedStatus: true,
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.SkippedDueToCachedStatus,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when cached status indicates previous failure",
   {
     languages: [KnownLanguage.javascript],
@@ -1438,12 +1458,14 @@ test.serial(
     shouldSkipOverlayAnalysisDueToCachedStatus: true,
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.SkippedDueToCachedStatus,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when code-scanning feature enabled with disable-default-queries",
   {
     languages: [KnownLanguage.javascript],
@@ -1457,12 +1479,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when code-scanning feature enabled with packs",
   {
     languages: [KnownLanguage.javascript],
@@ -1476,12 +1500,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when code-scanning feature enabled with queries",
   {
     languages: [KnownLanguage.javascript],
@@ -1495,12 +1521,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when code-scanning feature enabled with query-filters",
   {
     languages: [KnownLanguage.javascript],
@@ -1514,12 +1542,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when only language-specific feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1527,12 +1557,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.OverallFeatureNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when only code-scanning feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1540,12 +1572,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.OverallFeatureNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay-base database on default branch when language-specific feature disabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1553,12 +1587,14 @@ test.serial(
     isDefaultBranch: true,
   },
   {
-    disabledReason: OverlayDisabledReason.LanguageNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay analysis on PR when feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1572,7 +1608,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay analysis on PR when feature enabled with custom analysis",
   {
     languages: [KnownLanguage.javascript],
@@ -1589,7 +1625,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay analysis on PR when code-scanning feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1606,7 +1642,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR if runner disk space is too low",
   {
     languages: [KnownLanguage.javascript],
@@ -1621,12 +1657,14 @@ test.serial(
     },
   },
   {
-    disabledReason: OverlayDisabledReason.InsufficientDiskSpace,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay analysis on PR if runner disk space is too low and skip resource checks flag is enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1648,7 +1686,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR if we can't determine runner disk space",
   {
     languages: [KnownLanguage.javascript],
@@ -1660,12 +1698,14 @@ test.serial(
     diskUsage: undefined,
   },
   {
-    disabledReason: OverlayDisabledReason.UnableToDetermineDiskUsage,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR if memory flag is too low",
   {
     languages: [KnownLanguage.javascript],
@@ -1677,12 +1717,14 @@ test.serial(
     memoryFlagValue: 3072,
   },
   {
-    disabledReason: OverlayDisabledReason.InsufficientMemory,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.InsufficientResources,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay analysis on PR if memory flag is too low but CodeQL >= 2.24.3",
   {
     languages: [KnownLanguage.javascript],
@@ -1701,7 +1743,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay analysis on PR if memory flag is too low and skip resource checks flag is enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1720,7 +1762,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when code-scanning feature enabled with disable-default-queries",
   {
     languages: [KnownLanguage.javascript],
@@ -1734,12 +1776,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when code-scanning feature enabled with packs",
   {
     languages: [KnownLanguage.javascript],
@@ -1753,12 +1797,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when code-scanning feature enabled with queries",
   {
     languages: [KnownLanguage.javascript],
@@ -1772,12 +1818,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when code-scanning feature enabled with query-filters",
   {
     languages: [KnownLanguage.javascript],
@@ -1791,12 +1839,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.NonDefaultQueries,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when only language-specific feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1804,12 +1854,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.OverallFeatureNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when only code-scanning feature enabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1817,12 +1869,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.OverallFeatureNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay analysis on PR when language-specific feature disabled",
   {
     languages: [KnownLanguage.javascript],
@@ -1830,12 +1884,14 @@ test.serial(
     isPullRequest: true,
   },
   {
-    disabledReason: OverlayDisabledReason.LanguageNotEnabled,
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: OverlayDisabledReason.FeatureNotEnabled,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay PR analysis by env",
   {
     overlayDatabaseEnvVar: "overlay",
@@ -1847,7 +1903,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay PR analysis by env on a runner with low disk space",
   {
     overlayDatabaseEnvVar: "overlay",
@@ -1860,7 +1916,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay PR analysis by feature flag",
   {
     languages: [KnownLanguage.javascript],
@@ -1874,7 +1930,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Fallback due to autobuild with traced language",
   {
     overlayDatabaseEnvVar: "overlay",
@@ -1882,12 +1938,14 @@ test.serial(
     languages: [KnownLanguage.java],
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.IncompatibleBuildMode,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Fallback due to no build mode with traced language",
   {
     overlayDatabaseEnvVar: "overlay",
@@ -1895,60 +1953,70 @@ test.serial(
     languages: [KnownLanguage.java],
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.IncompatibleBuildMode,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Fallback due to old CodeQL version",
   {
     overlayDatabaseEnvVar: "overlay",
     codeqlVersion: "2.14.0",
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.IncompatibleCodeQl,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Fallback due to missing git root",
   {
     overlayDatabaseEnvVar: "overlay",
     gitRoot: undefined,
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.NoGitRoot,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Fallback due to old git version",
   {
     overlayDatabaseEnvVar: "overlay",
     gitVersion: new GitVersionInfo("2.30.0", "2.30.0"), // Version below required 2.38.0
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.IncompatibleGit,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Fallback when git version cannot be determined",
   {
     overlayDatabaseEnvVar: "overlay",
     gitVersion: undefined,
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.IncompatibleGit,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "No overlay when disabled via repository property",
   {
     languages: [KnownLanguage.javascript],
@@ -1959,12 +2027,14 @@ test.serial(
     },
   },
   {
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
     disabledReason: OverlayDisabledReason.DisabledByRepositoryProperty,
   },
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Overlay not disabled when repository property is false",
   {
     languages: [KnownLanguage.javascript],
@@ -1981,7 +2051,7 @@ test.serial(
 );
 
 test.serial(
-  checkOverlayEnablementMacro,
+  getOverlayDatabaseModeMacro,
   "Environment variable override takes precedence over repository property",
   {
     overlayDatabaseEnvVar: "overlay",
@@ -1998,7 +2068,7 @@ test.serial(
 // Exercise language-specific overlay analysis features code paths
 for (const language in KnownLanguage) {
   test.serial(
-    checkOverlayEnablementMacro,
+    getOverlayDatabaseModeMacro,
     `Check default overlay analysis feature for ${language}`,
     {
       languages: [language],
@@ -2006,7 +2076,9 @@ for (const language in KnownLanguage) {
       isPullRequest: true,
     },
     {
-      disabledReason: OverlayDisabledReason.LanguageNotEnabled,
+      overlayDatabaseMode: OverlayDatabaseMode.None,
+      useOverlayDatabaseCaching: false,
+      disabledReason: OverlayDisabledReason.FeatureNotEnabled,
     },
   );
 }

src/config-utils.ts

@@ -69,9 +69,6 @@ import {
   isInTestMode,
   joinAtMost,
   DiskUsage,
-  Result,
-  Success,
-  Failure,
 } from "./util";
 
 /**
@@ -656,18 +653,14 @@ const OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES: Record<Language, Feature> = {
   swift: Feature.OverlayAnalysisCodeScanningSwift,
 };
 
-/**
- * Checks whether the overlay analysis feature is enabled for the given
- * languages and configuration.
- */
-async function checkOverlayAnalysisFeatureEnabled(
+async function isOverlayAnalysisFeatureEnabled(
   features: FeatureEnablement,
   codeql: CodeQL,
   languages: Language[],
   codeScanningConfig: UserConfig,
-): Promise<Result<void, OverlayDisabledReason>> {
+): Promise<boolean> {
   if (!(await features.getValue(Feature.OverlayAnalysis, codeql))) {
-    return new Failure(OverlayDisabledReason.OverallFeatureNotEnabled);
+    return false;
   }
   let enableForCodeScanningOnly = false;
   for (const language of languages) {
@@ -684,35 +677,39 @@ async function checkOverlayAnalysisFeatureEnabled(
       enableForCodeScanningOnly = true;
       continue;
     }
-    return new Failure(OverlayDisabledReason.LanguageNotEnabled);
+    return false;
   }
   if (enableForCodeScanningOnly) {
     // A code-scanning configuration runs only the (default) code-scanning suite
     // if the default queries are not disabled, and no packs, queries, or
     // query-filters are specified.
-    const usesDefaultQueriesOnly =
+    return (
       codeScanningConfig["disable-default-queries"] !== true &&
       codeScanningConfig.packs === undefined &&
       codeScanningConfig.queries === undefined &&
-      codeScanningConfig["query-filters"] === undefined;
-    if (!usesDefaultQueriesOnly) {
-      return new Failure(OverlayDisabledReason.NonDefaultQueries);
-    }
+      codeScanningConfig["query-filters"] === undefined
+    );
   }
-  return new Success(undefined);
+  return true;
 }
 
 /** Checks if the runner has enough disk space for overlay analysis. */
 function runnerHasSufficientDiskSpace(
-  diskUsage: DiskUsage,
+  diskUsage: DiskUsage | undefined,
   logger: Logger,
   useV2ResourceChecks: boolean,
 ): boolean {
   const minimumDiskSpaceBytes = useV2ResourceChecks
     ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES
     : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES;
-  if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) {
-    const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000);
+  if (
+    diskUsage === undefined ||
+    diskUsage.numAvailableBytes < minimumDiskSpaceBytes
+  ) {
+    const diskSpaceMb =
+      diskUsage === undefined
+        ? 0
+        : Math.round(diskUsage.numAvailableBytes / 1_000_000);
     const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1_000_000);
     logger.info(
       `Setting overlay database mode to ${OverlayDatabaseMode.None} ` +
@@ -757,28 +754,23 @@ async function runnerHasSufficientMemory(
 }
 
 /**
- * Checks if the runner has sufficient disk space and memory for overlay
- * analysis.
+ * Checks if the runner supports overlay analysis based on available disk space
+ * and the maximum memory CodeQL will be allowed to use.
  */
-async function checkRunnerResources(
+async function runnerSupportsOverlayAnalysis(
   codeql: CodeQL,
-  diskUsage: DiskUsage,
+  diskUsage: DiskUsage | undefined,
   ramInput: string | undefined,
   logger: Logger,
   useV2ResourceChecks: boolean,
-): Promise<Result<void, OverlayDisabledReason>> {
+): Promise<boolean> {
   if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) {
-    return new Failure(OverlayDisabledReason.InsufficientDiskSpace);
+    return false;
   }
   if (!(await runnerHasSufficientMemory(codeql, ramInput, logger))) {
-    return new Failure(OverlayDisabledReason.InsufficientMemory);
+    return false;
   }
-  return new Success(undefined);
-}
-
-interface EnabledOverlayConfig {
-  overlayDatabaseMode: Exclude<OverlayDatabaseMode, OverlayDatabaseMode.None>;
-  useOverlayDatabaseCaching: boolean;
+  return true;
 }
 
 /**
@@ -799,11 +791,10 @@ interface EnabledOverlayConfig {
  * For `Overlay` and `OverlayBase`, the function performs further checks and
  * reverts to `None` if any check should fail.
  *
- * @returns A `Success` containing the overlay database mode and whether the
- * action should perform overlay-base database caching, or a `Failure`
- * containing the reason why overlay analysis is disabled.
+ * @returns An object containing the overlay database mode and whether the
+ * action should perform overlay-base database caching.
  */
-export async function checkOverlayEnablement(
+export async function getOverlayDatabaseMode(
   codeql: CodeQL,
   features: FeatureEnablement,
   languages: Language[],
@@ -814,7 +805,15 @@ export async function checkOverlayEnablement(
   repositoryProperties: RepositoryProperties,
   gitVersion: GitVersionInfo | undefined,
   logger: Logger,
-): Promise<Result<EnabledOverlayConfig, OverlayDisabledReason>> {
+): Promise<{
+  overlayDatabaseMode: OverlayDatabaseMode;
+  useOverlayDatabaseCaching: boolean;
+  disabledReason: OverlayDisabledReason | undefined;
+}> {
+  let overlayDatabaseMode = OverlayDatabaseMode.None;
+  let useOverlayDatabaseCaching = false;
+  let disabledReason: OverlayDisabledReason | undefined;
+
   const modeEnv = process.env.CODEQL_OVERLAY_DATABASE_MODE;
   // Any unrecognized CODEQL_OVERLAY_DATABASE_MODE value will be ignored and
   // treated as if the environment variable was not set.
@@ -823,132 +822,101 @@ export async function checkOverlayEnablement(
     modeEnv === OverlayDatabaseMode.OverlayBase ||
     modeEnv === OverlayDatabaseMode.None
   ) {
+    overlayDatabaseMode = modeEnv;
     logger.info(
-      `Setting overlay database mode to ${modeEnv} ` +
+      `Setting overlay database mode to ${overlayDatabaseMode} ` +
         "from the CODEQL_OVERLAY_DATABASE_MODE environment variable.",
     );
-    if (modeEnv === OverlayDatabaseMode.None) {
-      return new Failure(OverlayDisabledReason.DisabledByEnvironmentVariable);
-    }
-    return validateOverlayDatabaseMode(
-      modeEnv,
-      false,
-      codeql,
-      languages,
-      sourceRoot,
-      buildMode,
-      gitVersion,
-      logger,
-    );
-  }
-
-  if (repositoryProperties[RepositoryPropertyName.DISABLE_OVERLAY] === true) {
+  } else if (
+    repositoryProperties[RepositoryPropertyName.DISABLE_OVERLAY] === true
+  ) {
     logger.info(
       `Setting overlay database mode to ${OverlayDatabaseMode.None} ` +
         `because the ${RepositoryPropertyName.DISABLE_OVERLAY} repository property is set to true.`,
     );
-    return new Failure(OverlayDisabledReason.DisabledByRepositoryProperty);
-  }
-
-  const featureResult = await checkOverlayAnalysisFeatureEnabled(
-    features,
-    codeql,
-    languages,
-    codeScanningConfig,
-  );
-  if (featureResult.isFailure()) {
-    return featureResult;
-  }
-
-  const performResourceChecks = !(await features.getValue(
-    Feature.OverlayAnalysisSkipResourceChecks,
-    codeql,
-  ));
-  const useV2ResourceChecks = await features.getValue(
-    Feature.OverlayAnalysisResourceChecksV2,
-  );
-  const checkOverlayStatus = await features.getValue(
-    Feature.OverlayAnalysisStatusCheck,
-  );
-  const needDiskUsage = performResourceChecks || checkOverlayStatus;
-  const diskUsage = needDiskUsage ? await checkDiskUsage(logger) : undefined;
-  if (needDiskUsage && diskUsage === undefined) {
-    logger.warning(
-      `Unable to determine disk usage, therefore setting overlay database mode to ${OverlayDatabaseMode.None}.`,
-    );
-    return new Failure(OverlayDisabledReason.UnableToDetermineDiskUsage);
-  }
-  const resourceResult =
-    performResourceChecks && diskUsage !== undefined
-      ? await checkRunnerResources(
-          codeql,
-          diskUsage,
-          ramInput,
-          logger,
-          useV2ResourceChecks,
-        )
-      : new Success<void>(undefined);
-  if (resourceResult.isFailure()) {
-    return resourceResult;
-  }
-  if (
-    checkOverlayStatus &&
-    diskUsage !== undefined &&
-    (await shouldSkipOverlayAnalysis(codeql, languages, diskUsage, logger))
+    overlayDatabaseMode = OverlayDatabaseMode.None;
+    disabledReason = OverlayDisabledReason.DisabledByRepositoryProperty;
+  } else if (
+    await isOverlayAnalysisFeatureEnabled(
+      features,
+      codeql,
+      languages,
+      codeScanningConfig,
+    )
   ) {
-    logger.info(
-      `Setting overlay database mode to ${OverlayDatabaseMode.None} ` +
-        "because overlay analysis previously failed with this combination of languages, " +
-        "disk space, and CodeQL version.",
+    const performResourceChecks = !(await features.getValue(
+      Feature.OverlayAnalysisSkipResourceChecks,
+      codeql,
+    ));
+    const useV2ResourceChecks = await features.getValue(
+      Feature.OverlayAnalysisResourceChecksV2,
     );
-    return new Failure(OverlayDisabledReason.SkippedDueToCachedStatus);
-  }
-
-  let overlayDatabaseMode: OverlayDatabaseMode;
-  if (isAnalyzingPullRequest()) {
-    overlayDatabaseMode = OverlayDatabaseMode.Overlay;
-    logger.info(
-      `Setting overlay database mode to ${overlayDatabaseMode} ` +
-        "with caching because we are analyzing a pull request.",
-    );
-  } else if (await isAnalyzingDefaultBranch()) {
-    overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
-    logger.info(
-      `Setting overlay database mode to ${overlayDatabaseMode} ` +
-        "with caching because we are analyzing the default branch.",
+    const checkOverlayStatus = await features.getValue(
+      Feature.OverlayAnalysisStatusCheck,
     );
+    const diskUsage =
+      performResourceChecks || checkOverlayStatus
+        ? await checkDiskUsage(logger)
+        : undefined;
+    if (
+      performResourceChecks &&
+      !(await runnerSupportsOverlayAnalysis(
+        codeql,
+        diskUsage,
+        ramInput,
+        logger,
+        useV2ResourceChecks,
+      ))
+    ) {
+      overlayDatabaseMode = OverlayDatabaseMode.None;
+      disabledReason = OverlayDisabledReason.InsufficientResources;
+    } else if (checkOverlayStatus && diskUsage === undefined) {
+      logger.warning(
+        `Unable to determine disk usage, therefore setting overlay database mode to ${OverlayDatabaseMode.None}.`,
+      );
+      overlayDatabaseMode = OverlayDatabaseMode.None;
+      disabledReason = OverlayDisabledReason.UnableToDetermineDiskUsage;
+    } else if (
+      checkOverlayStatus &&
+      diskUsage &&
+      (await shouldSkipOverlayAnalysis(codeql, languages, diskUsage, logger))
+    ) {
+      logger.info(
+        `Setting overlay database mode to ${OverlayDatabaseMode.None} ` +
+          "because overlay analysis previously failed with this combination of languages, " +
+          "disk space, and CodeQL version.",
+      );
+      overlayDatabaseMode = OverlayDatabaseMode.None;
+      disabledReason = OverlayDisabledReason.SkippedDueToCachedStatus;
+    } else if (isAnalyzingPullRequest()) {
+      overlayDatabaseMode = OverlayDatabaseMode.Overlay;
+      useOverlayDatabaseCaching = true;
+      logger.info(
+        `Setting overlay database mode to ${overlayDatabaseMode} ` +
+          "with caching because we are analyzing a pull request.",
+      );
+    } else if (await isAnalyzingDefaultBranch()) {
+      overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
+      useOverlayDatabaseCaching = true;
+      logger.info(
+        `Setting overlay database mode to ${overlayDatabaseMode} ` +
+          "with caching because we are analyzing the default branch.",
+      );
+    }
   } else {
-    return new Failure(OverlayDisabledReason.NotPullRequestOrDefaultBranch);
+    disabledReason = OverlayDisabledReason.FeatureNotEnabled;
   }
 
-  return validateOverlayDatabaseMode(
-    overlayDatabaseMode,
-    true,
-    codeql,
-    languages,
-    sourceRoot,
-    buildMode,
-    gitVersion,
-    logger,
-  );
-}
+  const disabledResult = (reason: OverlayDisabledReason | undefined) => ({
+    overlayDatabaseMode: OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+    disabledReason: reason,
+  });
+
+  if (overlayDatabaseMode === OverlayDatabaseMode.None) {
+    return disabledResult(disabledReason);
+  }
 
-/**
- * Validates that the given overlay database mode is compatible with the current
- * configuration (build mode, CodeQL version, git repository, git version). Returns
- * the mode unchanged if all checks pass, or falls back to `None` with the
- * appropriate disabled reason.
- */
-async function validateOverlayDatabaseMode(
-  overlayDatabaseMode: Exclude<OverlayDatabaseMode, OverlayDatabaseMode.None>,
-  useOverlayDatabaseCaching: boolean,
-  codeql: CodeQL,
-  languages: Language[],
-  sourceRoot: string,
-  buildMode: BuildMode | undefined,
-  gitVersion: GitVersionInfo | undefined,
-  logger: Logger,
-): Promise<Result<EnabledOverlayConfig, OverlayDisabledReason>> {
   if (
     buildMode !== BuildMode.None &&
     (
@@ -969,7 +937,7 @@ async function validateOverlayDatabaseMode(
         `build-mode is set to "${buildMode}" instead of "none". ` +
         "Falling back to creating a normal full database instead.",
     );
-    return new Failure(OverlayDisabledReason.IncompatibleBuildMode);
+    return disabledResult(OverlayDisabledReason.IncompatibleBuildMode);
   }
   if (!(await codeQlVersionAtLeast(codeql, CODEQL_OVERLAY_MINIMUM_VERSION))) {
     logger.warning(
@@ -977,7 +945,7 @@ async function validateOverlayDatabaseMode(
         `the CodeQL CLI is older than ${CODEQL_OVERLAY_MINIMUM_VERSION}. ` +
         "Falling back to creating a normal full database instead.",
     );
-    return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
+    return disabledResult(OverlayDisabledReason.IncompatibleCodeQl);
   }
   if ((await getGitRoot(sourceRoot)) === undefined) {
     logger.warning(
@@ -985,7 +953,7 @@ async function validateOverlayDatabaseMode(
         `the source root "${sourceRoot}" is not inside a git repository. ` +
         "Falling back to creating a normal full database instead.",
     );
-    return new Failure(OverlayDisabledReason.NoGitRoot);
+    return disabledResult(OverlayDisabledReason.NoGitRoot);
   }
   if (gitVersion === undefined) {
     logger.warning(
@@ -993,7 +961,7 @@ async function validateOverlayDatabaseMode(
         "the Git version could not be determined. " +
         "Falling back to creating a normal full database instead.",
     );
-    return new Failure(OverlayDisabledReason.IncompatibleGit);
+    return disabledResult(OverlayDisabledReason.IncompatibleGit);
   }
   if (!gitVersion.isAtLeast(GIT_MINIMUM_VERSION_FOR_OVERLAY)) {
     logger.warning(
@@ -1001,13 +969,14 @@ async function validateOverlayDatabaseMode(
         `the installed Git version is older than ${GIT_MINIMUM_VERSION_FOR_OVERLAY}. ` +
         "Falling back to creating a normal full database instead.",
     );
-    return new Failure(OverlayDisabledReason.IncompatibleGit);
+    return disabledResult(OverlayDisabledReason.IncompatibleGit);
   }
 
-  return new Success({
+  return {
     overlayDatabaseMode,
     useOverlayDatabaseCaching,
-  });
+    disabledReason,
+  };
 }
 
 function dbLocationOrDefault(
@@ -1153,7 +1122,11 @@ export async function initConfig(
   // and queries, which in turn depends on the user config and the augmentation
   // properties. So we need to calculate the overlay database mode after the
   // rest of the config has been populated.
-  const overlayDatabaseModeResult = await checkOverlayEnablement(
+  const {
+    overlayDatabaseMode,
+    useOverlayDatabaseCaching,
+    disabledReason: overlayDisabledReason,
+  } = await getOverlayDatabaseMode(
     inputs.codeql,
     inputs.features,
     config.languages,
@@ -1165,22 +1138,14 @@ export async function initConfig(
     gitVersion,
     logger,
   );
-  if (overlayDatabaseModeResult.isSuccess()) {
-    const { overlayDatabaseMode, useOverlayDatabaseCaching } =
-      overlayDatabaseModeResult.value;
-    logger.info(
-      `Using overlay database mode: ${overlayDatabaseMode} ` +
-        `${useOverlayDatabaseCaching ? "with" : "without"} caching.`,
-    );
-    config.overlayDatabaseMode = overlayDatabaseMode;
-    config.useOverlayDatabaseCaching = useOverlayDatabaseCaching;
-  } else {
-    const overlayDisabledReason = overlayDatabaseModeResult.value;
-    logger.info(
-      `Using overlay database mode: ${OverlayDatabaseMode.None} without caching.`,
-    );
-    config.overlayDatabaseMode = OverlayDatabaseMode.None;
-    config.useOverlayDatabaseCaching = false;
+  logger.info(
+    `Using overlay database mode: ${overlayDatabaseMode} ` +
+      `${useOverlayDatabaseCaching ? "with" : "without"} caching.`,
+  );
+  config.overlayDatabaseMode = overlayDatabaseMode;
+  config.useOverlayDatabaseCaching = useOverlayDatabaseCaching;
+
+  if (overlayDisabledReason !== undefined) {
     await addOverlayDisablementDiagnostics(
       config,
       inputs.codeql,
@@ -1189,7 +1154,7 @@ export async function initConfig(
   }
 
   if (
-    config.overlayDatabaseMode === OverlayDatabaseMode.Overlay ||
+    overlayDatabaseMode === OverlayDatabaseMode.Overlay ||
     (await shouldPerformDiffInformedAnalysis(
       inputs.codeql,
       inputs.features,

src/overlay/diagnostics.ts

@@ -10,35 +10,20 @@ import { RepositoryPropertyName } from "../feature-flags/properties";
 
 /** Reason why overlay analysis was disabled. */
 export enum OverlayDisabledReason {
-  /** Overlay analysis was disabled by the CODEQL_OVERLAY_DATABASE_MODE environment variable being set to "none". */
-  DisabledByEnvironmentVariable = "disabled-by-environment-variable",
   /** Overlay analysis was disabled by a repository property. */
   DisabledByRepositoryProperty = "disabled-by-repository-property",
+  /** Overlay analysis feature was not enabled. */
+  FeatureNotEnabled = "feature-not-enabled",
   /** The build mode is incompatible with overlay analysis. */
   IncompatibleBuildMode = "incompatible-build-mode",
   /** The CodeQL CLI version is too old to support overlay analysis. */
   IncompatibleCodeQl = "incompatible-codeql",
   /** The Git version could not be determined or is too old. */
   IncompatibleGit = "incompatible-git",
-  /** The runner does not have enough disk space to perform overlay analysis. */
-  InsufficientDiskSpace = "insufficient-disk-space",
-  /** The runner does not have enough memory to perform overlay analysis. */
-  InsufficientMemory = "insufficient-memory",
-  /** Overlay analysis is not enabled for one or more of the configured languages. */
-  LanguageNotEnabled = "language-not-enabled",
+  /** The runner does not have enough disk space or memory. */
+  InsufficientResources = "insufficient-resources",
   /** The source root is not inside a git repository. */
   NoGitRoot = "no-git-root",
-  /**
-   * For one or more of the configured languages, overlay analysis is only
-   * enabled when using the default query suite, but the config customises the
-   * queries by disabling default queries, specifying custom queries or packs,
-   * or adding query filters.
-   */
-  NonDefaultQueries = "non-default-queries",
-  /** We are not analyzing a pull request or the default branch. */
-  NotPullRequestOrDefaultBranch = "not-pull-request-or-default-branch",
-  /** The top-level overlay analysis feature flag is not enabled. */
-  OverallFeatureNotEnabled = "overall-feature-not-enabled",
   /** Overlay analysis was skipped because it previously failed with similar hardware resources. */
   SkippedDueToCachedStatus = "skipped-due-to-cached-status",
   /** Disk usage could not be determined during the overlay status check. */