Rebuild

.github/actions/prepare-mergeback-branch/action.yml

@@ -91,15 +91,18 @@ runs:
 
           Please do the following:
 
-          - [ ] Approve running the full set of PR checks.
+          - [ ] Mark the PR as ready for review to trigger the full set of PR checks.
           - [ ] Approve and merge the PR. When merging the PR, make sure "Create a merge commit" is
                 selected rather than "Squash and merge" or "Rebase and merge".
         EOF
         )
 
+        # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft
+        # so that a maintainer can take the PR out of draft, thereby triggering the PR checks.
         gh pr create \
           --head "${NEW_BRANCH}" \
           --base "${BASE_BRANCH}" \
           --title "${pr_title}" \
           --body "${pr_body}" \
-          --assignee "${GITHUB_ACTOR}"
+          --assignee "${GITHUB_ACTOR}" \
+          --draft

.github/actions/release-initialise/action.yml

@@ -16,13 +16,13 @@ runs:
       shell: bash
 
     - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@v6
       with:
         node-version: 24
         cache: 'npm'
 
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@v6
       with:
         python-version: '3.12'
 

.github/update-release-branch.py

@@ -136,7 +136,7 @@ def open_pr(
   body.append(f' - [ ] Check that there are not any unexpected commits being merged into the `{target_branch}` branch.')
   body.append(' - [ ] Ensure the docs team is aware of any documentation changes that need to be released.')
 
-  body.append(' - [ ] Approve running the full set of PR checks if you have not pushed any changes.')
+  body.append(' - [ ] Mark the PR as ready for review to trigger the full set of PR checks.')
   body.append(' - [ ] Approve and merge this PR. Make sure `Create a merge commit` is selected rather than `Squash and merge` or `Rebase and merge`.')
 
   if is_primary_release:
@@ -146,7 +146,9 @@ def open_pr(
   title = f'Merge {source_branch} into {target_branch}'
 
   # Create the pull request
-  pr = repo.create_pull(title=title, body='\n'.join(body), head=new_branch_name, base=target_branch)
+  # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft so that
+  # a maintainer can take the PR out of draft, thereby triggering the PR checks.
+  pr = repo.create_pull(title=title, body='\n'.join(body), head=new_branch_name, base=target_branch, draft=True)
   print(f'Created PR #{str(pr.number)}')
 
   # Assign the conductor

.github/workflows/__all-platform-bundle.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,13 +74,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__analysis-kinds.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -67,7 +72,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -87,7 +92,7 @@ jobs:
           post-processed-sarif-path: '${{ runner.temp }}/post-processed'
 
       - name: Upload SARIF files
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -95,7 +100,7 @@ jobs:
           retention-days: 7
 
       - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -105,7 +110,7 @@ jobs:
 
       - name: Check quality query does not appear in security SARIF
         if: contains(matrix.analysis-kinds, 'code-scanning')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
           EXPECT_PRESENT: 'false'
@@ -113,7 +118,7 @@ jobs:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
           EXPECT_PRESENT: 'true'

.github/workflows/__analyze-ref-input.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -65,13 +70,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__autobuild-action.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -59,9 +64,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Prepare test

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -61,9 +66,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__autobuild-working-dir.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-autobuild.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -61,9 +66,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@v5
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__build-mode-manual.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -65,13 +70,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__build-mode-none.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-rollback.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__bundle-from-nightly.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__bundle-from-toolcache.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -57,7 +62,7 @@ jobs:
         run: npm install @actions/tool-cache@3
       - name: Check toolcache contains CodeQL
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
@@ -70,7 +75,7 @@ jobs:
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const toolcache = require('@actions/tool-cache');

.github/workflows/__bundle-toolcache.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -58,7 +63,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -68,7 +73,7 @@ jobs:
       - name: Install @actions/tool-cache
         run: npm install @actions/tool-cache@3
       - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
@@ -87,7 +92,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const toolcache = require('@actions/tool-cache');

.github/workflows/__bundle-zstd.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -58,7 +63,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -77,13 +82,13 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.os }}-zstd-bundle.sarif
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
         with:

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__config-export.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -65,13 +70,13 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check config properties appear in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         with:

.github/workflows/__config-input.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,9 +50,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 20.x
           cache: npm

.github/workflows/__cpp-deptrace-disabled.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-enabled.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__diagnostics-export.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -76,13 +81,13 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'
           retention-days: 7
       - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
         with:

.github/workflows/__export-file-baseline-information.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,13 +74,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -97,7 +102,7 @@ jobs:
         with:
           output: '${{ runner.temp }}/results'
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'

.github/workflows/__extractor-ram-threads.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__global-proxy.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-custom-queries.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -67,13 +72,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -55,9 +60,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -73,7 +78,7 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       # Deliberately change Go after the `init` step
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@v6
         with:
           go-version: '1.20'
       - name: Build code
@@ -83,7 +88,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -55,9 +60,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -84,7 +89,7 @@ jobs:
           output: '${{ runner.temp }}/results'
           upload-database: false
       - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
         env:
           SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
         with:

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -55,9 +60,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-tracing-autobuilder.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -75,9 +80,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -75,9 +80,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -75,9 +80,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__init-with-registries.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__javascript-source-root.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__job-run-uuid-sarif.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -62,7 +67,7 @@ jobs:
         with:
           output: '${{ runner.temp }}/results'
       - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
           path: '${{ runner.temp }}/results/javascript.sarif'

.github/workflows/__language-aliases.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__local-bundle.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -65,13 +70,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__multi-language-autodetect.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -56,19 +61,19 @@ jobs:
         include:
           - os: ubuntu-latest
             version: stable-v2.19.4
-          - os: macos-15-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.19.4
           - os: ubuntu-latest
             version: stable-v2.20.7
-          - os: macos-15-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
-          - os: macos-15-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.21.4
           - os: ubuntu-latest
             version: stable-v2.22.4
-          - os: macos-15-xlarge
+          - os: macos-latest-xlarge
             version: stable-v2.22.4
           - os: ubuntu-latest
             version: stable-v2.23.9
@@ -99,13 +104,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -120,13 +125,12 @@ jobs:
         # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
       - name: Use Xcode 16
-        # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
-        if: matrix.os == 'macos-15-xlarge'
+        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
         run: sudo xcode-select -s "/Applications/Xcode_16.app"
 
       - uses: ./../action/init

.github/workflows/__overlay-init-fallback.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,18 +74,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 20.x
           cache: npm

.github/workflows/__packaging-config-inputs-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,18 +74,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 20.x
           cache: npm

.github/workflows/__packaging-config-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,18 +74,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 20.x
           cache: npm

.github/workflows/__packaging-inputs-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,18 +74,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 20.x
           cache: npm

.github/workflows/__remote-config.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -67,13 +72,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__resolve-environment-action.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__rubocop-multi-language.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -54,7 +59,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__ruby.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -55,7 +60,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__rust.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -53,7 +58,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__split-workflow.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -75,13 +80,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__start-proxy.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__submit-sarif-failure.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -49,7 +54,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -57,7 +62,7 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v6
       - uses: ./init
         with:
           languages: javascript

.github/workflows/__swift-autobuild.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__swift-custom-build.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -69,13 +74,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -86,6 +91,9 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Use Xcode 16
+        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
+        run: sudo xcode-select -s "/Applications/Xcode_16.app"
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__unset-environment.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -67,13 +72,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__upload-ref-sha-input.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -65,13 +70,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__upload-sarif.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -72,13 +77,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__with-checkout-path.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   merge_group:
     types:
       - checks_requested
@@ -66,13 +71,13 @@ jobs:
     steps:
       # This ensures we don't accidentally use the original checkout for any part of the test.
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -91,7 +96,7 @@ jobs:
           rm -rf ./* .github .git
       # Check out the actions repo again, but at a different location.
       # choose an arbitrary SHA so that we can later test that the commit_oid is not from main
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v6
         with:
           ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
           path: x/y/z/some-path

.github/workflows/check-expected-release-files.yml

@@ -5,10 +5,9 @@ on:
     paths:
       - .github/workflows/check-expected-release-files.yml
       - src/defaults.json
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
+    # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
+    # by other workflows.
+    types: [opened, synchronize, reopened, ready_for_review]
 
 defaults:
   run:
@@ -23,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout CodeQL Action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Check Expected Release Files
         run: |
           bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")"

.github/workflows/codeql.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main, releases/v*]
   pull_request:
+    # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
+    # by other workflows.
+    types: [opened, synchronize, reopened, ready_for_review]
   merge_group:
     types: [checks_requested]
   schedule:
@@ -32,7 +35,7 @@ jobs:
       security-events: read
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@v6
     - name: Set up default CodeQL bundle
       id: setup-default
       uses: ./setup-codeql
@@ -84,7 +87,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@v6
     - name: Initialize CodeQL
       uses: ./init
       id: init
@@ -121,7 +124,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@v6
     - name: Initialize CodeQL
       uses: ./init
       with:

.github/workflows/codescanning-config-cli.yml

@@ -13,16 +13,17 @@ on:
     - main
     - releases/v*
   pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   merge_group:
     types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
 
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -54,10 +55,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@v6
 
     - name: Set up Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@v6
       with:
         node-version: 24
         cache: 'npm'

.github/workflows/debug-artifacts-failure-safe.yml

@@ -9,16 +9,17 @@ on:
     - main
     - releases/v*
   pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   merge_group:
     types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
 
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -48,17 +49,17 @@ jobs:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@v6
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
@@ -89,7 +90,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@v8
       - name: Check expected artifacts exist
         run: |
           LANGUAGES="cpp csharp go java javascript python"

.github/workflows/debug-artifacts-safe.yml

@@ -8,16 +8,17 @@ on:
     - main
     - releases/v*
   pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   merge_group:
     types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
 
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -44,17 +45,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@v6
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
@@ -82,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@v8
       - name: Check expected artifacts exist
         run: |
           VERSIONS="stable-v2.20.3 default linked nightly-latest"

.github/workflows/label-pr-size.yml

@@ -7,6 +7,7 @@ on:
       - synchronize
       - reopened
       - edited
+      - ready_for_review
 
 permissions:
   contents: read

.github/workflows/post-release-mergeback.yml

@@ -44,14 +44,14 @@ jobs:
           GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "${GITHUB_CONTEXT}"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: 'npm'
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
 
@@ -134,7 +134,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/pr-checks.yml

@@ -3,14 +3,13 @@ name: PR Checks
 on:
   push:
   pull_request:
+    # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
+    # by other workflows.
+    types: [opened, synchronize, reopened, ready_for_review]
   merge_group:
     types: [checks_requested]
   workflow_dispatch:
 
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -30,19 +29,15 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
 
-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-unit-tests-${{ github.ref }}-${{ github.event_name }}-${{ matrix.os }}-node${{ matrix['node-version'] }}
-
     steps:
       - name: Prepare git (Windows)
         if: runner.os == 'Windows'
         run: git config --global core.autocrlf false
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -66,53 +61,66 @@ jobs:
         run: npm run lint-ci
 
       - name: Upload sarif
-        uses: ./upload-sarif
+        uses: github/codeql-action/upload-sarif@v4
         if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
         with:
           sarif_file: eslint.sarif
           category: eslint
 
-  # These checks do not need to be run as part of the same matrix that we use for the `unit-tests`
-  # job.
-  other-checks:
-    name: Other checks
+  # Verifying the PR checks are up-to-date requires Node 24. The PR checks are not dependent
+  # on the main codebase and therefore do not need to be run as part of the same matrix that
+  # we use for the `unit-tests` job.
+  verify-pr-checks:
+    name: Verify PR checks
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 10
 
-    concurrency:
-      cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-      group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }}
-
     steps:
+      - name: Prepare git (Windows)
+        if: runner.os == 'Windows'
+        run: git config --global core.autocrlf false
+
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: 'npm'
 
       - name: Install dependencies
-        id: install-deps
         run: npm ci
 
       - name: Verify PR checks up to date
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        if: always()
         run: .github/workflows/script/verify-pr-checks.sh
 
       - name: Run pr-checks tests
-        if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
+        if: always()
         working-directory: pr-checks
         run: npx tsx --test
 
-      - name: Verify all Actions use the same Node version
-        id: head-version
+  check-node-version:
+    if: github.triggering_actor != 'dependabot[bot]'
+    name: Check Action Node versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      BASE_REF: ${{ github.base_ref }}
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v6
+      - id: head-version
+        name: Verify all Actions use the same Node version
         run: |
-          NODE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
+          NODE_VERSION=$(find . -name "action.yml" -exec yq -e '.runs.using' {} \; | grep node | sort | uniq)
           echo "NODE_VERSION: ${NODE_VERSION}"
           if [[ $(echo "$NODE_VERSION" | wc -l) -gt 1 ]]; then
             echo "::error::More than one node version used in 'action.yml' files."
@@ -120,111 +128,22 @@ jobs:
           fi
           echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
 
-      - name: Fetch base commit
-        id: fetch-base
-        # Forks and Dependabot PRs don't have permission to write comments, so skip the repo size
-        # check in those cases.
-        if: >-
-          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.event.pull_request.user.login != 'dependabot[bot]'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Compare against the merge base so the size delta reflects only the commits actually
-          # added by this PR, ignoring any changes that have landed on the base branch since the
-          # PR branched off.
-          merge_base=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_SHA...$HEAD_SHA" --jq '.merge_base_commit.sha')
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-
-      - name: Check repo size
-        if: steps.fetch-base.outcome == 'success'
-        working-directory: pr-checks
-        env:
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-          BASE_SHA: ${{ steps.fetch-base.outputs.merge_base }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: npx tsx check-repo-size.ts --output-dir "$RUNNER_TEMP/repo-size"
-
-      - name: Upload repo size comment
-        if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: repo-size-comment
-          path: ${{ runner.temp }}/repo-size/
-          if-no-files-found: error
-
-      - name: 'Backport: Check out base ref'
-        id: checkout-base
+      - id: checkout-base
+        name: 'Backport: Check out base ref'
         if: ${{ startsWith(github.head_ref, 'backport-') }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
         with:
-          ref: ${{ github.base_ref }}
+          ref: ${{ env.BASE_REF }}
 
       - name: 'Backport: Verify Node versions unchanged'
         if: steps.checkout-base.outcome == 'success'
         env:
           HEAD_VERSION: ${{ steps.head-version.outputs.node_version }}
         run: |
-          BASE_VERSION=$(find . -path "*/node_modules" -prune -o -name "action.yml" -exec yq -o=json '.runs.using' {} \; | jq -rs '[.[] | select(. != null and startswith("node"))] | unique | .[]')
+          BASE_VERSION=$(find . -name "action.yml" -exec yq -e '.runs.using' {} \; | grep node | sort | uniq)
           echo "HEAD_VERSION: ${HEAD_VERSION}"
           echo "BASE_VERSION: ${BASE_VERSION}"
           if [[ "$BASE_VERSION" != "$HEAD_VERSION" ]]; then
             echo "::error::Cannot change the Node version of an Action in a backport PR."
             exit 1
           fi
-
-  post-repo-size-comment:
-    name: Post repo size comment
-    needs: other-checks
-    # Keep write permissions isolated from the job that checks out and tests PR code. This job only
-    # posts the candidate comment body produced by the read-only `pr-checks` job.
-    if: >-
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
-      needs.other-checks.result == 'success'
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 10
-
-    concurrency:
-      cancel-in-progress: true
-      group: check-repo-size-${{ github.event.pull_request.number }}
-
-    steps:
-      - name: Download repo size comment
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: repo-size-comment
-          path: repo-size-comment
-
-      - name: Post repo size comment
-        env:
-          COMMENT_MARKER: "<!-- repo-size-diff-bot -->"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          significant=$(jq -r '.significant' repo-size-comment/metadata.json)
-          comment_id=$(
-            gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-              --paginate \
-              --jq ".[] | select(.body | contains(\"$COMMENT_MARKER\")) | .id" \
-              | head -n 1
-          )
-
-          if [[ -n "$comment_id" ]]; then
-            echo "Updating existing comment $comment_id."
-            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --field body=@repo-size-comment/body.md
-          elif [[ "$significant" == "true" ]]; then
-            echo "Creating new repo size comment."
-            gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --field body=@repo-size-comment/body.md
-          else
-            echo "Skipping repo size comment because the delta is below the threshold and no sticky comment exists."
-          fi

.github/workflows/prepare-release.yml

@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Need full history for calculation of diffs
 

.github/workflows/publish-immutable-action.yml

@@ -20,8 +20,8 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
 
       - name: Publish immutable release
         id: publish
-        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/python312-windows.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main, releases/v*]
   pull_request:
+    # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
+    # by other workflows.
+    types: [opened, synchronize, reopened, ready_for_review]
   merge_group:
     types: [checks_requested]
   schedule:
@@ -11,10 +14,6 @@ on:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -32,11 +31,11 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+    - uses: actions/setup-python@v6
       with:
         python-version: 3.12
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@v6
 
     - name: Prepare test
       uses: ./.github/actions/prepare-test

.github/workflows/query-filters.yml

@@ -6,16 +6,17 @@ on:
     - main
     - releases/v*
   pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   merge_group:
     types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
 
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -30,10 +31,10 @@ jobs:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@v6
 
     - name: Install Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@v6
       with:
         node-version: 24
         cache: npm

.github/workflows/rebuild.yml

@@ -24,13 +24,13 @@ jobs:
       pull-requests: write # needed to comment on the PR
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           ref: ${{ env.HEAD_REF }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: 'npm'
@@ -143,5 +143,6 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           echo "Pushed a commit to rebuild the Action." \
-            "Please approve running the PR checks." |
+            "Please mark the PR as ready for review to trigger PR checks." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
+          gh pr ready --undo --repo github/codeql-action "$PR_NUMBER"

.github/workflows/rollback-release.yml

@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Need full history for calculation of diffs
 
@@ -136,7 +136,7 @@ jobs:
 
       - name: Generate token
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/test-codeql-bundle-all.yml

@@ -8,16 +8,16 @@ on:
     - main
     - releases/v*
   pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   merge_group:
     types: [checks_requested]
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ${{ github.workflow }}-${{ github.ref }}
-
 defaults:
   run:
     shell: bash
@@ -38,7 +38,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@v6
     - name: Prepare test
       id: prepare-test
       uses: ./.github/actions/prepare-test
@@ -46,7 +46,7 @@ jobs:
         version: ${{ matrix.version }}
         use-all-platform-bundle: true
     - name: Install .NET
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+      uses: actions/setup-dotnet@v5
       with:
         dotnet-version: '9.x'
     - id: init

.github/workflows/update-bundle.yml

@@ -33,7 +33,7 @@ jobs:
           GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "$GITHUB_CONTEXT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@v6
 
       - name: Update git config
         run: |
@@ -41,12 +41,12 @@ jobs:
           git config --global user.name "github-actions[bot]"
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
         with:
           python-version: '3.12'
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: 'npm'
@@ -114,6 +114,7 @@ jobs:
             --title "Update default bundle to $cli_version" \
             --body "$pr_body" \
             --assignee "$GITHUB_ACTOR" \
+            --draft \
           )
           echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
           echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"

.github/workflows/update-release-branch.yml

@@ -38,7 +38,7 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0  # Need full history for calculation of diffs
     - uses: ./.github/actions/release-initialise
@@ -94,14 +94,14 @@ jobs:
       pull-requests: write # needed to create pull request
     steps:
     - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@v3.2.0
       id: app-token
       with:
         app-id: ${{ vars.AUTOMATION_APP_ID }}
         private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
     - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0  # Need full history for calculation of diffs
         token: ${{ steps.app-token.outputs.token }}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -9,7 +9,7 @@ on:
       - main
     paths:
       - .github/workflows/update-supported-enterprise-server-versions.yml
-      - pr-checks/update-ghes-versions.ts
+      - .github/workflows/update-supported-enterprise-server-versions/update.py
 
 jobs:
   update-supported-enterprise-server-versions:
@@ -23,41 +23,30 @@ jobs:
 
     steps:
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
-
       - name: Checkout CodeQL Action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
+        uses: actions/checkout@v6
       - name: Checkout Enterprise Releases
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@v6
         with:
           repository: github/enterprise-releases
           token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }}
           path: ${{ github.workspace }}/enterprise-releases/
           sparse-checkout: releases.json
-
       - name: Update Supported Enterprise Server Versions
-        working-directory: pr-checks
         run: |
-          npx tsx update-ghes-versions.ts
+          cd ./.github/workflows/update-supported-enterprise-server-versions/
+          python3 -m pip install pipenv
+          pipenv install
+          pipenv run ./update.py
           rm --recursive "$ENTERPRISE_RELEASES_PATH"
+          npm ci
+          npm run build
         env:
           ENTERPRISE_RELEASES_PATH: ${{ github.workspace }}/enterprise-releases/
 
-      - name: Rebuild
-        run: npm run build
-
       - name: Update git config
         run: |
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

.github/workflows/update-supported-enterprise-server-versions/Pipfile

@@ -0,0 +1,9 @@
+[[source]]
+name = "pypi"
+url = "https://pypi.org/simple"
+verify_ssl = true
+
+[dev-packages]
+
+[packages]
+semver = "*"

.github/workflows/update-supported-enterprise-server-versions/Pipfile.lock

@@ -0,0 +1,27 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "e3ba923dcb4888e05de5448c18a732bf40197e80fabfa051a61c01b22c504879"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "semver": {
+            "hashes": [
+                "sha256:ced8b23dceb22134307c1b8abfa523da14198793d9787ac838e70e29e77458d4",
+                "sha256:fa0fe2722ee1c3f57eac478820c3a5ae2f624af8264cbdf9000c980ff7f75e3f"
+            ],
+            "index": "pypi",
+            "version": "==2.13.0"
+        }
+    },
+    "develop": {}
+}

.github/workflows/update-supported-enterprise-server-versions/update.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+import datetime
+import json
+import os
+import pathlib
+
+import semver
+
+_API_COMPATIBILITY_PATH = pathlib.Path(__file__).absolute().parents[3] / "src" / "api-compatibility.json"
+_ENTERPRISE_RELEASES_PATH = pathlib.Path(os.environ["ENTERPRISE_RELEASES_PATH"])
+_RELEASE_FILE_PATH = _ENTERPRISE_RELEASES_PATH / "releases.json"
+_FIRST_SUPPORTED_RELEASE = semver.VersionInfo.parse("2.22.0") # Versions older than this did not include Code Scanning.
+
+def main():
+	api_compatibility_data = json.loads(_API_COMPATIBILITY_PATH.read_text())
+
+	releases = json.loads(_RELEASE_FILE_PATH.read_text())
+
+	# Remove GHES version using a previous version numbering scheme.
+	if "11.10" in releases:
+		del releases["11.10"]
+
+	oldest_supported_release = None
+	newest_supported_release = semver.VersionInfo.parse(api_compatibility_data["maximumVersion"] + ".0")
+
+	for release_version_string, release_data in releases.items():
+		release_version = semver.VersionInfo.parse(release_version_string + ".0")
+		if release_version < _FIRST_SUPPORTED_RELEASE:
+			continue
+
+		if release_version > newest_supported_release:
+			feature_freeze_date = datetime.date.fromisoformat(release_data["feature_freeze"])
+			if feature_freeze_date < datetime.date.today() + datetime.timedelta(weeks=2):
+				newest_supported_release = release_version
+
+		if oldest_supported_release is None or release_version < oldest_supported_release:
+			end_of_life_date = datetime.date.fromisoformat(release_data["end"])
+			# The GHES version is not actually end of life until the end of the day specified by
+			# `end_of_life_date`. Wait an extra week to be safe.
+			is_end_of_life = datetime.date.today() > end_of_life_date + datetime.timedelta(weeks=1)
+			if not is_end_of_life:
+				oldest_supported_release = release_version
+
+	api_compatibility_data = {
+		"minimumVersion": f"{oldest_supported_release.major}.{oldest_supported_release.minor}",
+		"maximumVersion": f"{newest_supported_release.major}.{newest_supported_release.minor}",
+	}
+	_API_COMPATIBILITY_PATH.write_text(json.dumps(api_compatibility_data, sort_keys=True) + "\n")
+
+if __name__ == "__main__":
+	main()

CHANGELOG.md

@@ -6,29 +6,9 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 No user facing changes.
 
-## v4.36.4 - 06 Jul 2026
+## v4.36.0 - 19 May 2026
 
-This release rolls back 4.36.3 due to issues with that release. It is identical to 0.0.0.
-
-## 4.36.3 - 01 Jul 2026
-
-No user facing changes.
-
-## 4.36.2 - 04 Jun 2026
-
-- Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943)
-- Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937)
-- Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948)
-
-## 4.36.1 - 02 Jun 2026
-
-No user facing changes.
-
-## 4.36.0 - 22 May 2026
-
-- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
-- Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
-- Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926)
+This release rolls back 4.35.5 due to issues with that release. It is identical to 0.0.0.
 
 ## 4.35.5 - 15 May 2026
 

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.25.6",
-  "cliVersion": "2.25.6",
-  "priorBundleVersion": "codeql-bundle-v2.25.5",
-  "priorCliVersion": "2.25.5"
+  "bundleVersion": "codeql-bundle-v2.25.4",
+  "cliVersion": "2.25.4",
+  "priorBundleVersion": "codeql-bundle-v2.25.3",
+  "priorCliVersion": "2.25.3"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.36.5",
+  "version": "4.36.1",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -22,7 +22,7 @@
   "dependencies": {
     "@actions/artifact": "^5.0.3",
     "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^5.1.0",
+    "@actions/cache": "^5.0.5",
     "@actions/core": "^2.0.3",
     "@actions/exec": "^2.0.0",
     "@actions/github": "^8.0.1",
@@ -31,45 +31,45 @@
     "@actions/io": "^2.0.0",
     "@actions/tool-cache": "^3.0.1",
     "@octokit/plugin-retry": "^8.1.0",
-    "archiver": "^8.0.0",
+    "archiver": "^7.0.1",
     "fast-deep-equal": "^3.1.3",
     "follow-redirects": "^1.16.0",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.1.0",
+    "js-yaml": "^4.1.1",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
     "node-forge": "^1.4.0",
-    "semver": "^7.8.5",
-    "uuid": "^14.0.1"
+    "semver": "^7.7.4",
+    "uuid": "^14.0.0"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^2.1.0",
+    "@eslint/compat": "^2.0.5",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
     "@octokit/types": "^16.0.0",
-    "@types/archiver": "^8.0.0",
+    "@types/archiver": "^7.0.0",
     "@types/follow-redirects": "^1.14.4",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.19.43",
+    "@types/node": "^20.19.39",
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.7.1",
     "@types/sinon": "^21.0.1",
     "ava": "^6.4.1",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.0",
     "eslint": "^9.39.4",
-    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-import-x": "^4.17.0",
+    "eslint-plugin-import-x": "^4.16.2",
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
-    "glob": "^13.0.6",
-    "globals": "^17.7.0",
-    "nock": "^14.0.15",
+    "glob": "^11.1.0",
+    "globals": "^17.6.0",
+    "nock": "^14.0.12",
     "sinon": "^22.0.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.62.0"
+    "typescript-eslint": "^8.59.2"
   },
   "overrides": {
     "@actions/tool-cache": {
@@ -90,7 +90,7 @@
     "eslint-plugin-jsx-a11y": {
       "semver": ">=6.3.1"
     },
-    "glob": "^13.0.6",
+    "glob": "^11.1.0",
     "undici": "^6.24.0"
   }
 }

pr-checks/check-repo-size.test.ts

@@ -1,259 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Tests for check-repo-size.ts.
-*/
-
-import * as assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { afterEach, beforeEach, describe, it } from "node:test";
-
-import {
-  COMMENT_MARKER,
-  DEFAULT_BASE_REF,
-  buildCommentBody,
-  formatBytes,
-  formatPercent,
-  isDeltaSignificant,
-  measureArchiveSize,
-  readArgs,
-} from "./check-repo-size";
-
-describe("formatBytes", async () => {
-  const cases: Array<[number, boolean, string]> = [
-    // Unsigned values, including sub-KiB amounts which round to 0.00.
-    [0, false, "0.00 KiB"],
-    [512, false, "0.50 KiB"],
-    [1024, false, "1.00 KiB"],
-    [1024 * 1024, false, "1024.00 KiB"],
-    [2 * 1024 * 1024, false, "2048.00 KiB"],
-    // Negative values always use a leading minus.
-    [-2 * 1024 * 1024, false, "-2048.00 KiB"],
-    // signed=true prepends a + to non-negative values.
-    [0, true, "+0.00 KiB"],
-    [2 * 1024 * 1024, true, "+2048.00 KiB"],
-    [-2 * 1024 * 1024, true, "-2048.00 KiB"],
-  ];
-  for (const [bytes, signed, expected] of cases) {
-    await it(`formats ${bytes} (signed=${signed}) as ${expected}`, () => {
-      assert.equal(formatBytes(bytes, signed), expected);
-    });
-  }
-});
-
-describe("formatPercent", async () => {
-  await it("formats positive fractions with a leading +", () => {
-    assert.equal(formatPercent(0.1), "+10.00%");
-    assert.equal(formatPercent(0.0123), "+1.23%");
-  });
-
-  await it("formats negative fractions with a leading -", () => {
-    assert.equal(formatPercent(-0.1), "-10.00%");
-  });
-
-  await it("formats zero without a sign", () => {
-    assert.equal(formatPercent(0), "0.00%");
-  });
-});
-
-describe("isDeltaSignificant", async () => {
-  const cases: Array<[number, number, number, boolean]> = [
-    // At and above threshold (both signs).
-    [100, 1000, 0.1, true],
-    [101, 1000, 0.1, true],
-    [-100, 1000, 0.1, true],
-    // Below threshold (both signs, plus exact zero).
-    [99, 1000, 0.1, false],
-    [-99, 1000, 0.1, false],
-    [0, 1000, 0.1, false],
-  ];
-  for (const [delta, base, fraction, expected] of cases) {
-    await it(`returns ${expected} for delta=${delta}, base=${base}, fraction=${fraction}`, () => {
-      assert.equal(isDeltaSignificant(delta, base, fraction), expected);
-    });
-  }
-});
-
-describe("buildCommentBody", async () => {
-  await it("includes the marker, the base/PR/delta rows, and the run URL", () => {
-    const body = buildCommentBody({
-      baseRef: "main",
-      baseSize: 2_000_000,
-      prSize: 2_300_000,
-      runUrl: "https://example.test/run",
-    });
-
-    assert.match(body, new RegExp(`^${escapeRegExp(COMMENT_MARKER)}`));
-    assert.match(body, /Base \(`main`\) \| 1953\.13 KiB \(2000000 bytes\)/);
-    assert.match(body, /This PR \| 2246\.09 KiB \(2300000 bytes\)/);
-    assert.match(
-      body,
-      /\*\*Delta\*\* \| \*\*\+292\.97 KiB \(\+300000 bytes, \+15\.00%\)\*\*/,
-    );
-    assert.match(body, /\[workflow run\]\(https:\/\/example\.test\/run\)/);
-  });
-
-  await it("formats negative deltas with a leading minus and omits the run URL when missing", () => {
-    const body = buildCommentBody({
-      baseRef: "main",
-      baseSize: 2_000_000,
-      prSize: 1_800_000,
-    });
-    assert.match(
-      body,
-      /\*\*Delta\*\* \| \*\*-195\.31 KiB \(-200000 bytes, -10\.00%\)\*\*/,
-    );
-    assert.doesNotMatch(body, /workflow run/);
-  });
-});
-
-describe("readArgs", async () => {
-  await it("defaults the base ref and head commit for local runs", () => {
-    const originalEnv = process.env;
-    const originalArgv = process.argv;
-
-    try {
-      process.env = {};
-      process.argv = ["node", "check-repo-size.ts", "--output-dir", "/tmp/out"];
-
-      const args = readArgs();
-
-      assert.equal(args.baseRef, DEFAULT_BASE_REF);
-      assert.equal(args.baseCommitish, `origin/${DEFAULT_BASE_REF}`);
-      assert.equal(args.headCommitish, "HEAD");
-      assert.equal(args.outputDir, "/tmp/out");
-      assert.equal(args.runUrl, undefined);
-    } finally {
-      process.env = originalEnv;
-      process.argv = originalArgv;
-    }
-  });
-
-  await it("uses the base and head SHAs when provided by the workflow", () => {
-    const originalEnv = process.env;
-    const originalArgv = process.argv;
-
-    try {
-      process.env = {
-        BASE_REF: "main",
-        BASE_SHA: "abc123",
-        HEAD_SHA: "def456",
-        RUN_URL: "https://example.test/run",
-      };
-      process.argv = ["node", "check-repo-size.ts", "--output-dir", "/tmp/out"];
-
-      const args = readArgs();
-
-      assert.equal(args.baseRef, "main");
-      assert.equal(args.baseCommitish, "abc123");
-      assert.equal(args.headCommitish, "def456");
-      assert.equal(args.outputDir, "/tmp/out");
-      assert.equal(args.runUrl, "https://example.test/run");
-    } finally {
-      process.env = originalEnv;
-      process.argv = originalArgv;
-    }
-  });
-
-  await it("throws when --output-dir is missing", () => {
-    const originalEnv = process.env;
-    const originalArgv = process.argv;
-
-    try {
-      process.env = {};
-      process.argv = ["node", "check-repo-size.ts"];
-      assert.throws(() => readArgs(), /--output-dir is required/);
-    } finally {
-      process.env = originalEnv;
-      process.argv = originalArgv;
-    }
-  });
-});
-
-let repoDir: string;
-
-beforeEach(() => {
-  repoDir = fs.mkdtempSync(path.join(os.tmpdir(), "check-repo-size-test-"));
-  execFileSync("git", ["init", "--initial-branch=main", "-q"], {
-    cwd: repoDir,
-  });
-  execFileSync("git", ["config", "user.email", "test@example.test"], {
-    cwd: repoDir,
-  });
-  execFileSync("git", ["config", "user.name", "Test"], { cwd: repoDir });
-  execFileSync("git", ["config", "commit.gpgsign", "false"], { cwd: repoDir });
-});
-
-afterEach(() => {
-  fs.rmSync(repoDir, { recursive: true, force: true });
-});
-
-function commit(name: string, content: string, message: string) {
-  fs.writeFileSync(path.join(repoDir, name), content);
-  execFileSync("git", ["add", name], { cwd: repoDir });
-  execFileSync("git", ["commit", "-q", "-m", message], { cwd: repoDir });
-}
-
-describe("measureArchiveSize", async () => {
-  await it("returns a positive byte count for a non-empty repo", async () => {
-    commit("a.txt", "hello world\n", "first");
-    const size = await measureArchiveSize("HEAD", repoDir);
-    assert.ok(size > 0, `expected size > 0, got ${size}`);
-  });
-
-  await it("returns the same size on repeated runs (deterministic)", async () => {
-    commit("a.txt", "hello world\n", "first");
-    const a = await measureArchiveSize("HEAD", repoDir);
-    const b = await measureArchiveSize("HEAD", repoDir);
-    assert.equal(a, b);
-  });
-
-  await it("returns a larger size when more content is added", async () => {
-    commit("a.txt", "hello world\n", "first");
-    const small = await measureArchiveSize("HEAD", repoDir);
-
-    // Use random bytes so the new content is incompressible and the archive
-    // is guaranteed to grow even after gzip.
-    commit("b.bin", randomBytes(8192).toString("base64"), "second");
-    const big = await measureArchiveSize("HEAD", repoDir);
-    assert.ok(
-      big > small,
-      `expected ${big} > ${small} after adding more content`,
-    );
-  });
-
-  await it("ignores untracked files (e.g. node_modules)", async () => {
-    commit("a.txt", "hello\n", "first");
-    commit(".gitignore", "node_modules/\n", "ignore node_modules");
-    const sizeBefore = await measureArchiveSize("HEAD", repoDir);
-
-    fs.mkdirSync(path.join(repoDir, "node_modules"));
-    fs.writeFileSync(
-      path.join(repoDir, "node_modules", "huge.bin"),
-      "x".repeat(1_000_000),
-    );
-
-    const sizeAfter = await measureArchiveSize("HEAD", repoDir);
-    assert.equal(
-      sizeAfter,
-      sizeBefore,
-      "untracked node_modules should not affect the archive size",
-    );
-  });
-
-  await it("rejects when the ref does not exist", async () => {
-    commit("a.txt", "hello\n", "first");
-    await assert.rejects(
-      () => measureArchiveSize("does-not-exist", repoDir),
-      /git archive does-not-exist exited with code/,
-    );
-  });
-});
-
-function escapeRegExp(s: string): string {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}

pr-checks/check-repo-size.ts

@@ -1,223 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/*
-Measures the difference in the `.tar.gz`'d checkout size of the repo between the PR head and the PR
-base. This size is relevant because it corresponds to the duration of the "Download action
-repository" step that happens at the start of every job that uses this Action.
-
-Writes the candidate sticky-comment body and a small metadata file to `--output-dir`. A separate
-workflow job consumes those artifacts and decides whether to create or update a PR comment.
-*/
-
-import { spawn } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { parseArgs } from "node:util";
-
-import { REPO_ROOT } from "./config";
-
-/** Hidden marker used to find the existing sticky comment on a PR. */
-export const COMMENT_MARKER = "<!-- repo-size-diff-bot -->";
-
-export const DEFAULT_BASE_REF = "main";
-
-/**
- * Fraction of the base archive size at which a delta is considered significant enough to warrant
- * a new sticky comment. We always update an existing comment regardless, so the comment stays in
- * sync as the diff evolves.
- */
-export const SIGNIFICANT_DELTA_FRACTION = 0.1;
-
-/**
- * Stream `git archive --format=tar.gz <ref>` and count the compressed bytes.
- *
- * `git archive` only includes tracked files, so untracked directories like `node_modules` and
- * `build` aren't counted in the size downloaded when starting up a CodeQL job.
- */
-export async function measureArchiveSize(
-  ref: string,
-  cwd: string,
-): Promise<number> {
-  const git = spawn("git", ["archive", "--format=tar.gz", ref], { cwd });
-
-  let stderr = "";
-  git.stderr.on("data", (chunk: Buffer) => {
-    stderr += chunk.toString();
-  });
-
-  let size = 0;
-  git.stdout.on("data", (chunk: Buffer) => {
-    size += chunk.length;
-  });
-
-  const exitCode = await new Promise<number>((resolve, reject) => {
-    git.on("error", reject);
-    git.on("close", resolve);
-  });
-
-  if (exitCode !== 0) {
-    throw new Error(
-      `git archive ${ref} exited with code ${exitCode}: ${stderr.trim()}`,
-    );
-  }
-  return size;
-}
-
-/**
- * Format a byte count as KiB. If `signed` is true, a leading `+` is prepended for non-negative
- * values so gains and losses are visually distinct.
- */
-export function formatBytes(bytes: number, signed = false): string {
-  const sign = bytes < 0 ? "-" : signed ? "+" : "";
-  const kib = Math.abs(bytes) / 1024;
-  return `${sign}${kib.toFixed(2)} KiB`;
-}
-
-/** Format a fraction as a signed percentage with 2 decimal places. */
-export function formatPercent(fraction: number): string {
-  const pct = fraction * 100;
-  const sign = pct > 0 ? "+" : "";
-  return `${sign}${pct.toFixed(2)}%`;
-}
-
-export interface CommentBodyOptions {
-  baseRef: string;
-  baseSize: number;
-  prSize: number;
-  /** Optional URL of the workflow run, included in the comment footer. */
-  runUrl?: string;
-}
-
-export function buildCommentBody(opts: CommentBodyOptions): string {
-  const { baseRef, baseSize, prSize, runUrl } = opts;
-  const delta = prSize - baseSize;
-  const signedDelta = delta >= 0 ? `+${delta}` : `${delta}`;
-  const runUrlLine = runUrl
-    ? ` See the [workflow run](${runUrl}) for details.`
-    : "";
-
-  return [
-    COMMENT_MARKER,
-    "### Repository checkout size",
-    "",
-    "| | Compressed archive size |",
-    "|---|---|",
-    `| Base (\`${baseRef}\`) | ${formatBytes(baseSize)} (${baseSize} bytes) |`,
-    `| This PR | ${formatBytes(prSize)} (${prSize} bytes) |`,
-    `| **Delta** | **${formatBytes(delta, true)} (${signedDelta} bytes, ${formatPercent(delta / baseSize)})** |`,
-    "",
-    "Sizes are measured by streaming `git archive --format=tar.gz <ref>`, " +
-      "which includes tracked files and excludes untracked files such as " +
-      "`node_modules`. The compressed checkout is " +
-      "downloaded by every consumer of this Action, so changes here directly " +
-      `affect Action download time.${runUrlLine}`,
-  ].join("\n");
-}
-
-/**
- * Returns true when the absolute delta is at least `fraction` of the base size. Both increases and
- * decreases are considered significant, so we report wins as well as losses.
- */
-export function isDeltaSignificant(
-  delta: number,
-  baseSize: number,
-  fraction: number,
-): boolean {
-  return Math.abs(delta) >= baseSize * fraction;
-}
-
-interface MainArgs {
-  /** Base ref of the PR. Defaults to `main`. Used as the label in the PR comment. */
-  baseRef: string;
-  /** Base commit-ish to archive. Defaults to `origin/<baseRef>` for local runs. */
-  baseCommitish: string;
-  /** Head commit-ish to archive. Defaults to `HEAD` for local runs. */
-  headCommitish: string;
-  /** Optional URL of the workflow run, surfaced in the comment footer. */
-  runUrl?: string;
-  /** Directory where `body.md` and `metadata.json` are written. */
-  outputDir: string;
-}
-
-export function readArgs(): MainArgs {
-  const { values } = parseArgs({
-    options: {
-      "output-dir": { type: "string" },
-    },
-    strict: true,
-  });
-
-  const outputDir = values["output-dir"];
-  if (!outputDir) {
-    throw new Error("--output-dir is required");
-  }
-
-  const baseRef = process.env.BASE_REF ?? DEFAULT_BASE_REF;
-  const baseCommitish = process.env.BASE_SHA ?? `origin/${baseRef}`;
-  const headCommitish = process.env.HEAD_SHA ?? "HEAD";
-
-  return {
-    baseRef,
-    baseCommitish,
-    headCommitish,
-    runUrl: process.env.RUN_URL,
-    outputDir,
-  };
-}
-
-async function main(): Promise<number> {
-  const args = readArgs();
-
-  console.log(`Measuring base archive size for ${args.baseCommitish}...`);
-  const baseSize = await measureArchiveSize(args.baseCommitish, REPO_ROOT);
-  console.log(`  ${baseSize} bytes`);
-
-  console.log(`Measuring PR archive size for ${args.headCommitish}...`);
-  const prSize = await measureArchiveSize(args.headCommitish, REPO_ROOT);
-  console.log(`  ${prSize} bytes`);
-
-  const delta = prSize - baseSize;
-  const significant = isDeltaSignificant(
-    delta,
-    baseSize,
-    SIGNIFICANT_DELTA_FRACTION,
-  );
-  console.log(
-    `Delta: ${delta} bytes (significant=${significant}, threshold=${(
-      SIGNIFICANT_DELTA_FRACTION * 100
-    ).toFixed(2)}%)`,
-  );
-
-  const body = buildCommentBody({
-    baseRef: args.baseRef,
-    baseSize,
-    prSize,
-    runUrl: args.runUrl,
-  });
-
-  fs.mkdirSync(args.outputDir, { recursive: true });
-  fs.writeFileSync(path.join(args.outputDir, "body.md"), body);
-  fs.writeFileSync(
-    path.join(args.outputDir, "metadata.json"),
-    `${JSON.stringify(
-      { significant, baseRef: args.baseRef, baseSize, prSize, delta },
-      null,
-      2,
-    )}\n`,
-  );
-  console.log(`Wrote body.md and metadata.json to ${args.outputDir}.`);
-  return 0;
-}
-
-async function run(): Promise<void> {
-  try {
-    process.exit(await main());
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-  }
-}
-
-if (require.main === module) {
-  void run();
-}

pr-checks/checks/analysis-kinds.yml

@@ -46,7 +46,7 @@ steps:
       post-processed-sarif-path: "${{ runner.temp }}/post-processed"
 
   - name: Upload SARIF files
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: |
         analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -54,7 +54,7 @@ steps:
       retention-days: 7
 
   - name: Upload post-processed SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: |
         post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -64,7 +64,7 @@ steps:
 
   - name: Check quality query does not appear in security SARIF
     if: contains(matrix.analysis-kinds, 'code-scanning')
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
       EXPECT_PRESENT: "false"
@@ -72,7 +72,7 @@ steps:
       script: ${{ env.CHECK_SCRIPT }}
   - name: Check quality query appears in quality SARIF
     if: contains(matrix.analysis-kinds, 'code-quality')
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
       EXPECT_PRESENT: "true"

pr-checks/checks/bundle-from-toolcache.yml

@@ -7,7 +7,7 @@ steps:
     run: npm install @actions/tool-cache@3
   - name: Check toolcache contains CodeQL
     continue-on-error: true
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     with:
       script: |
         const toolcache = require('@actions/tool-cache');
@@ -20,7 +20,7 @@ steps:
     with:
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     with:
       script: |
         const toolcache = require('@actions/tool-cache');

pr-checks/checks/bundle-toolcache.yml

@@ -8,7 +8,7 @@ operatingSystems:
   - windows
 steps:
   - name: Remove CodeQL from toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     with:
       script: |
         const fs = require('fs');
@@ -18,7 +18,7 @@ steps:
   - name: Install @actions/tool-cache
     run: npm install @actions/tool-cache@3
   - name: Check toolcache does not contain CodeQL
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     with:
       script: |
         const toolcache = require('@actions/tool-cache');
@@ -37,7 +37,7 @@ steps:
       output: ${{ runner.temp }}/results
       upload-database: false
   - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     with:
       script: |
         const toolcache = require('@actions/tool-cache');

pr-checks/checks/bundle-zstd.yml

@@ -8,7 +8,7 @@ operatingSystems:
   - windows
 steps:
   - name: Remove CodeQL from toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     with:
       script: |
         const fs = require('fs');
@@ -27,13 +27,13 @@ steps:
       output: ${{ runner.temp }}/results
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: ${{ matrix.os }}-zstd-bundle.sarif
       path: ${{ runner.temp }}/results/javascript.sarif
       retention-days: 7
   - name: Check diagnostic with expected tools URL appears in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
     with:

pr-checks/checks/config-export.yml

@@ -14,13 +14,13 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"
       retention-days: 7
   - name: Check config properties appear in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
     with:

pr-checks/checks/diagnostics-export.yml

@@ -27,13 +27,13 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"
       retention-days: 7
   - name: Check diagnostics appear in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
     with:

pr-checks/checks/export-file-baseline-information.yml

@@ -23,7 +23,7 @@ steps:
     with:
       output: "${{ runner.temp }}/results"
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"

pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml

@@ -12,7 +12,7 @@ steps:
       languages: go
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   # Deliberately change Go after the `init` step
-  - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+  - uses: actions/setup-go@v6
     with:
       go-version: "1.20"
   - name: Build code
@@ -22,7 +22,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Check diagnostic appears in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
     with:

pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml

@@ -23,7 +23,7 @@ steps:
       output: "${{ runner.temp }}/results"
       upload-database: false
   - name: Check diagnostic appears in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    uses: actions/github-script@v8
     env:
       SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
     with:

pr-checks/checks/job-run-uuid-sarif.yml

@@ -12,7 +12,7 @@ steps:
     with:
       output: "${{ runner.temp }}/results"
   - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    uses: actions/upload-artifact@v7
     with:
       name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
       path: "${{ runner.temp }}/results/javascript.sarif"

pr-checks/checks/multi-language-autodetect.yml

@@ -4,16 +4,6 @@ operatingSystems:
   - ubuntu
   - os: macos
     runner-image: macos-latest-xlarge
-  # Older CodeQL CLI versions only support Swift up to 6.1, which requires Xcode 16. That is
-  # not available on macOS 26, so run these versions on macOS 15 where we select Xcode 16
-  # below. See https://github.com/actions/runner-images/issues/14167.
-  - os: macos
-    runner-image: macos-15-xlarge
-    codeql-versions:
-      - stable-v2.19.4
-      - stable-v2.20.7
-      - stable-v2.21.4
-      - stable-v2.22.4
 env:
   CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
 installGo: true
@@ -23,13 +13,12 @@ steps:
     # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
     # See https://github.com/github/codeql-action/pull/3212
     if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-    uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+    uses: actions/setup-python@v6
     with:
       python-version: "3.13"
 
   - name: Use Xcode 16
-    # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
-    if: matrix.os == 'macos-15-xlarge'
+    if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
     run: sudo xcode-select -s "/Applications/Xcode_16.app"
 
   - uses: ./../action/init

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+    uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

pr-checks/checks/submit-sarif-failure.yml

@@ -21,7 +21,7 @@ permissions:
   security-events: write # needed to upload the SARIF file
 
 steps:
-  - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+  - uses: actions/checkout@v6
   - uses: ./init
     with:
       languages: javascript