Fix linitng issues.

Pass changed files in code ratehr than by file-system.
Include diff-edidted files in overlay changes.
2026-08-05 13:02:04 -05:00 · 2025-10-10 14:26:40 +01:00 · 2025-10-09 21:05:00 +01:00 · 2025-10-09 20:47:37 +01:00 · 2025-10-09 20:47:04 +01:00 · 2025-10-09 20:46:30 +01:00
224 changed files with 83584 additions and 95000 deletions
@@ -6,6 +6,16 @@ import * as assert from 'assert'

 const actualConfig = loadActualConfig()

+function sortConfigArrays(config) {
+  for (const key of Object.keys(config)) {
+    const value = config[key];
+    if (key === 'queries' && Array.isArray(value)) {
+      config[key] = value.sort();
+    }
+  }
+  return config;
+}
+
 const rawExpectedConfig = process.argv[3].trim()
 if (!rawExpectedConfig) {
  core.setFailed('No expected configuration provided')
@@ -18,8 +28,8 @@ if (!rawExpectedConfig) {
 const expectedConfig = rawExpectedConfig ? JSON.parse(rawExpectedConfig) : undefined;

 assert.deepStrictEqual(
-  actualConfig,
-  expectedConfig,
+  sortConfigArrays(actualConfig),
+  sortConfigArrays(expectedConfig),
  'Expected configuration does not match actual configuration'
 );

@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node20
+  using: node24
  main: index.js
@@ -2,7 +2,7 @@ name: "Prepare test"
 description: Performs some preparation to run tests
 inputs:
  version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
+    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'toolcache', 'nightly', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
    required: true
  use-all-platform-bundle:
    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
@@ -35,37 +35,34 @@ runs:
      run: |
        set -e # Fail this Action if `gh release list` fails.

-        if [[ "$VERSION" == "linked" ]]; then
+        if [[ "$VERSION" == "nightly" || "$VERSION" == "nightly-latest" ]]; then
+          echo "tools-url=nightly" >> "$GITHUB_OUTPUT"
+          exit 0
+        elif [[ "$VERSION" == "linked" ]]; then
          echo "tools-url=linked" >> "$GITHUB_OUTPUT"
          exit 0
+        elif [[ "$VERSION" == "toolcache" ]]; then
+          echo "tools-url=toolcache" >> "$GITHUB_OUTPUT"
+          exit 0
        elif [[ "$VERSION" == "default" ]]; then
          echo "tools-url=" >> "$GITHUB_OUTPUT"
          exit 0
        fi

-        if [[ "$VERSION" == "nightly-latest" && "$RUNNER_OS" != "Windows" ]]; then
-          extension="tar.zst"
-        else
-          extension="tar.gz"
-        fi
-
        if [[ "$USE_ALL_PLATFORM_BUNDLE" == "true" ]]; then
-          artifact_name="codeql-bundle.$extension"
+          artifact_name="codeql-bundle.tar.gz"
        elif [[ "$RUNNER_OS" == "Linux" ]]; then
-          artifact_name="codeql-bundle-linux64.$extension"
+          artifact_name="codeql-bundle-linux64.tar.gz"
        elif [[ "$RUNNER_OS" == "macOS" ]]; then
-          artifact_name="codeql-bundle-osx64.$extension"
+          artifact_name="codeql-bundle-osx64.tar.gz"
        elif [[ "$RUNNER_OS" == "Windows" ]]; then
-          artifact_name="codeql-bundle-win64.$extension"
+          artifact_name="codeql-bundle-win64.tar.gz"
        else
          echo "::error::Unrecognized OS $RUNNER_OS"
          exit 1
        fi

-        if [[ "$VERSION" == "nightly-latest" ]]; then
-          tag=`gh release list --repo dsp-testing/codeql-cli-nightlies -L 1 | cut -f 3`
-          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/$artifact_name" >> $GITHUB_OUTPUT
-        elif [[ "$VERSION" == *"nightly"* ]]; then
+        if [[ "$VERSION" == *"nightly"* ]]; then
          version=`echo "$VERSION" | sed -e 's/^.*\-//'`
          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
        elif [[ "$VERSION" == *"stable"* ]]; then
@@ -1,4 +0,0 @@
-# Configuration for the CodeQL Actions Queries
-name: "CodeQL Actions Queries config"
-queries:
-  - uses: security-and-quality
@@ -7,9 +7,9 @@ queries:
  # we include both even though one is a superset of the
  # other, because we're testing the parsing logic and
  # that the suites exist in the codeql bundle.
+  - uses: security-and-quality
  - uses: security-experimental
  - uses: security-extended
-  - uses: security-and-quality
 paths-ignore:
-  - tests
  - lib
+  - tests
@@ -11,9 +11,6 @@ updates:
      # There is a type incompatibility issue between v0.0.9 and our other dependencies.
      - dependency-name: "@octokit/plugin-retry"
        versions: ["~6.0.0"]
-      # v7 requires ESM
-      - dependency-name: "del"
-        versions: ["^7.0.0"]
      # This is broken due to the way configuration files have changed. 
      # This might be fixed when we move to eslint v9.
      - dependency-name: "eslint-plugin-import"
@@ -23,18 +20,14 @@ updates:
        patterns:
          - "*"
  - package-ecosystem: github-actions
-    directory: "/"
+    directories:
+      - "/.github/workflows"
+      - "/.github/actions"
    schedule:
      interval: weekly
+    labels:
+      - Rebuild
    groups:
      actions:
        patterns:
          - "*"
-  - package-ecosystem: github-actions
-    directory: "/.github/actions/setup-swift/" # All subdirectories outside of "/.github/workflows" must be explicitly included.
-    schedule:
-      interval: weekly
-    groups:
-      actions-setup-swift:
-        patterns:
-          - "*"
@@ -1,4 +1,13 @@
+<!--
+    For GitHub staff: Remember that this is a public repository. Do not link to internal resources.
+                      If necessary, link to this PR from an internal issue and include further details there.

+    Everyone: Include a summary of the context of this change, what it aims to accomplish, and why you
+              chose the approach you did if applicable. Indicate any open questions you want to answer
+              during the review process and anything you want reviewers to pay particular attention to.
+
+    See https://github.com/github/codeql-action/blob/main/CONTRIBUTING.md for additional information.
+-->

 ### Risk assessment

@@ -7,6 +16,44 @@ For internal use only. Please select the risk level of this change:
 - **Low risk:** Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
 - **High risk:** Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

+#### Which use cases does this change impact?
+
+<!-- Delete options that don't apply. -->
+
+- **Advanced setup** - Impacts users who have custom workflows.
+- **Default setup** - Impacts users who use default setup.
+- **Code Scanning** - Impacts Code Scanning (i.e. `analysis-kinds: code-scanning`).
+- **Code Quality** - Impacts Code Quality (i.e. `analysis-kinds: code-quality`).
+- **Third-party analyses** - Impacts third-party analyses (i.e. `upload-sarif`).
+- **GHES** - Impacts GitHub Enterprise Server.
+
+#### How did/will you validate this change?
+
+<!-- Delete options that don't apply. -->
+
+- **Test repository** - This change will be tested on a test repository before merging.
+- **Unit tests** - I am depending on unit test coverage (i.e. tests in `.test.ts` files).
+- **End-to-end tests** - I am depending on PR checks (i.e. tests in `pr-checks`).
+- **Other** - Please provide details.
+- **None** - I am not validating these changes.
+
+#### If something goes wrong after this change is released, what are the mitigation and rollback strategies?
+
+<!-- Delete strategies that don't apply. -->
+
+- **Feature flags** - All new or changed code paths can be fully disabled with corresponding feature flags.
+- **Rollback** - Change can only be disabled by rolling back the release or releasing a new version with a fix.
+- **Other** - Please provide details.
+
+#### How will you know if something goes wrong after this change is released?
+
+<!-- Delete options that don't apply. -->
+
+- **Telemetry** - I rely on existing telemetry or have made changes to the telemetry.
+    - **Dashboards** - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
+    - **Alerts** - New or existing monitors will trip if something goes wrong with this change.
+- **Other** - Please provide details.
+
 ### Merge / deployment checklist

 - Confirm this change is backwards compatible with existing workflows.
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  all-platform-bundle:
    strategy:
@@ -42,7 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
    name: All-platform bundle
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,7 +70,7 @@ jobs:
          use-all-platform-bundle: 'true'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -70,7 +81,6 @@ jobs:
          languages: cpp,csharp,go,java,javascript,python,ruby
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
    env:
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  analyze-ref-input:
    strategy:
@@ -42,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
    name: "Analyze: 'ref' and 'sha' from inputs"
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -63,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -74,7 +77,6 @@ jobs:
          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
            github.sha }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  autobuild-action:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: autobuild-action
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -67,7 +74,6 @@ jobs:
          CORECLR_PROFILER_PATH_64: ''
      - uses: ./../action/analyze
      - name: Check database
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/codeql_databases"
          if [[ ! -d csharp ]]; then
@@ -34,6 +34,12 @@ on:
        description: The version of Java to install
        required: false
        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  autobuild-direct-tracing-with-working-dir:
    strategy:
@@ -49,6 +55,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Autobuild direct tracing (custom working directory)
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -70,7 +77,6 @@ jobs:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
      - name: Test setup
-        shell: bash
        run: |
          # Make sure that Gradle build succeeds in autobuild-dir ...
          cp -a ../action/tests/java-repo autobuild-dir
@@ -82,7 +88,6 @@ jobs:
          languages: java
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Check that indirect tracing is disabled
-        shell: bash
        run: |
          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
            echo "Expected indirect tracing to be disabled, but the" \
@@ -1,99 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Autobuild direct tracing
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
-  workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
-jobs:
-  autobuild-direct-tracing:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: linked
-          - os: windows-latest
-            version: linked
-          - os: ubuntu-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
-    name: Autobuild direct tracing
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v5
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Install Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
-      - name: Set up Java test repo configuration
-        shell: bash
-        run: |
-          mv * .github ../action/tests/multi-language-repo/
-          mv ../action/tests/multi-language-repo/.github/workflows .github
-          mv ../action/tests/java-repo/* .
-
-      - uses: ./../action/init
-        id: init
-        with:
-          build-mode: autobuild
-          db-location: ${{ runner.temp }}/customDbLocation
-          languages: java
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Check that indirect tracing is disabled
-        shell: bash
-        run: |
-          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
-            echo "Expected indirect tracing to be disabled, but the" \
-              "CODEQL_RUNNER environment variable is set."
-            exit 1
-          fi
-
-      - uses: ./../action/analyze
-    env:
-      CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
-      CODEQL_ACTION_TEST_MODE: true
@@ -24,8 +24,14 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  test-autobuild-working-dir:
+  autobuild-working-dir:
    strategy:
      fail-fast: false
      matrix:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Autobuild working directory
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,7 +56,6 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Test setup
-        shell: bash
        run: |
          # Make sure that Gradle build succeeds in autobuild-dir ...
          cp -a ../action/tests/java-repo autobuild-dir
@@ -64,7 +70,6 @@ jobs:
          working-directory: autobuild-dir
      - uses: ./../action/analyze
      - name: Check database
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/codeql_databases"
          if [[ ! -d java ]]; then
@@ -21,9 +21,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-autobuild:
    strategy:
@@ -31,8 +47,15 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: windows-latest
            version: nightly-latest
    name: Build mode autobuild
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -48,6 +71,11 @@ jobs:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
+      - name: Install Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Set up Java test repo configuration
        run: |
          mv * .github ../action/tests/multi-language-repo/
@@ -62,6 +90,11 @@ jobs:
          languages: java
          tools: ${{ steps.prepare-test.outputs.tools-url }}

+      - name: Install yq
+        if: runner.os == 'Windows'
+        run: |
+          choco install yq -y
+
      - name: Validate database build mode
        run: |
          metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
@@ -71,6 +104,14 @@ jobs:
            exit 1
          fi

+      - name: Check that indirect tracing is disabled
+        run: |
+          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
+            echo "Expected indirect tracing to be disabled, but the" \
+              "CODEQL_RUNNER environment variable is set."
+            exit 1
+          fi
+
      - uses: ./../action/analyze
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-manual:
    strategy:
@@ -43,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode manual
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -81,7 +88,6 @@ jobs:
          fi

      - name: Build code
-        shell: bash
        run: ./build.sh

      - uses: ./../action/analyze
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-none:
    strategy:
@@ -35,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode none
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  build-mode-rollback:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Build mode rollback
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -0,0 +1,86 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: 'PR Check - Bundle: From toolcache'
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  bundle-from-toolcache:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: toolcache
+    name: 'Bundle: From toolcache'
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Install @actions/tool-cache
+        run: npm install @actions/tool-cache
+      - name: Check toolcache contains CodeQL
+        continue-on-error: true
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const toolcache = require('@actions/tool-cache');
+            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
+            if (allCodeqlVersions.length === 0) {
+              throw new Error(`CodeQL could not be found in the toolcache`);
+            }
+      - id: init
+        uses: ./../action/init
+        with:
+          languages: javascript
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check CodeQL is installed within the toolcache
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const toolcache = require('@actions/tool-cache');
+            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
+            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
+            if (allCodeqlVersions.length === 0) {
+              throw new Error('CodeQL not found in toolcache');
+            }
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  bundle-toolcache:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: 'Bundle: Caching checks'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,7 +60,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
@@ -63,7 +70,7 @@ jobs:
      - name: Install @actions/tool-cache
        run: npm install @actions/tool-cache
      - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const toolcache = require('@actions/tool-cache');
@@ -82,7 +89,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const toolcache = require('@actions/tool-cache');
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  bundle-zstd:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: 'Bundle: Zstandard checks'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,7 +60,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
@@ -78,7 +85,7 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
        with:
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cleanup-db-cluster-dir:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Clean up database cluster directory
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  config-export:
    strategy:
@@ -32,17 +38,10 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: Config export
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -74,7 +73,7 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check config properties appear in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
        with:
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  config-input:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Config input
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -42,7 +49,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cpp-deptrace-disabled:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,7 +60,6 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Test setup
-        shell: bash
        run: |
          cp -a ../action/tests/cpp-autobuild autobuild-dir
      - uses: ./../action/init
@@ -65,8 +71,7 @@ jobs:
          working-directory: autobuild-dir
        env:
          CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: false
-      - shell: bash
-        run: |
+      - run: |
          if ls /usr/bin/errno; then
            echo "C/C++ autobuild installed errno, but it should not have since auto-install dependencies is disabled."
            exit 1
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cpp-deptrace-enabled-on-macos:
    strategy:
@@ -35,6 +41,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -51,7 +58,6 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Test setup
-        shell: bash
        run: |
          cp -a ../action/tests/cpp-autobuild autobuild-dir
      - uses: ./../action/init
@@ -63,8 +69,7 @@ jobs:
          working-directory: autobuild-dir
        env:
          CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-      - shell: bash
-        run: |
+      - run: |
          if ! ls /usr/bin/errno; then
            echo "As expected, CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES is a no-op on macOS"
          else
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  cpp-deptrace-enabled:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'C/C++: autoinstalling dependencies (Linux)'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,7 +60,6 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Test setup
-        shell: bash
        run: |
          cp -a ../action/tests/cpp-autobuild autobuild-dir
      - uses: ./../action/init
@@ -65,8 +71,7 @@ jobs:
          working-directory: autobuild-dir
        env:
          CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
-      - shell: bash
-        run: |
+      - run: |
          if ! ls /usr/bin/errno; then
            echo "Did not autoinstall errno"
            exit 1
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  diagnostics-export:
    strategy:
@@ -32,17 +38,10 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: Diagnostic export
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -64,7 +63,6 @@ jobs:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Add test diagnostics
-        shell: bash
        env:
          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
        run: |
@@ -86,7 +84,7 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
        with:
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  export-file-baseline-information:
    strategy:
@@ -47,6 +53,7 @@ jobs:
          - os: windows-latest
            version: nightly-latest
    name: Export file baseline information
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -63,7 +70,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -73,7 +80,6 @@ jobs:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -85,7 +91,6 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          expected_baseline_languages="c csharp go java kotlin javascript python ruby"
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  extractor-ram-threads:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Extractor ram and threads options test
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -54,7 +61,6 @@ jobs:
          ram: 230
          threads: 1
      - name: Assert Results
-        shell: bash
        run: |
          if [ "${CODEQL_RAM}" != "230" ]; then
            echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"
@@ -24,8 +24,14 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  test-proxy:
+  global-proxy:
    strategy:
      fail-fast: false
      matrix:
@@ -35,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Proxy test
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-custom-queries:
    strategy:
@@ -45,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: 'Go: Custom queries'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -61,7 +68,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -71,7 +78,6 @@ jobs:
          config-file: ./.github/codeql/custom-queries.yml
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
    env:
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-indirect-tracing-workaround-diagnostic:
    strategy:
@@ -43,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: diagnostic when Go is changed after init step'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -68,18 +75,17 @@ jobs:
          languages: go
          tools: ${{ steps.prepare-test.outputs.tools-url }}
  # Deliberately change Go after the `init` step
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
        with:
          go-version: '1.20'
      - name: Build code
-        shell: bash
        run: go build main.go
      - uses: ./../action/analyze
        with:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/go.sarif
        with:
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-indirect-tracing-workaround-no-file-program:
    strategy:
@@ -43,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: diagnostic when `file` is not installed'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -73,14 +80,13 @@ jobs:
          languages: go
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: go build main.go
      - uses: ./../action/analyze
        with:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/go.sarif
        with:
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-indirect-tracing-workaround:
    strategy:
@@ -43,6 +49,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: 'Go: workaround for indirect tracing'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -68,11 +75,9 @@ jobs:
          languages: go
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: go build main.go
      - uses: ./../action/analyze
-      - shell: bash
-        run: |
+      - run: |
          if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then
            echo "Expected the workaround for indirect tracing of static binaries to trigger, but the" \
              "CODEQL_ACTION_GO_BINARY environment variable is not set."
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-tracing-autobuilder:
    strategy:
@@ -60,6 +66,10 @@ jobs:
            version: stable-v2.21.4
          - os: macos-latest
            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: stable-v2.22.4
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -73,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with autobuilder step'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -89,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -99,8 +110,7 @@ jobs:
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - uses: ./../action/autobuild
      - uses: ./../action/analyze
-      - shell: bash
-        run: |
+      - run: |
          if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
            echo "Expected the Go autobuilder to be run, but the" \
              "CODEQL_ACTION_DID_AUTOBUILD_GOLANG environment variable was not true."
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-tracing-custom-build-steps:
    strategy:
@@ -60,6 +66,10 @@ jobs:
            version: stable-v2.21.4
          - os: macos-latest
            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: stable-v2.22.4
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -73,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with custom build steps'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -89,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -98,11 +109,9 @@ jobs:
          languages: go
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: go build main.go
      - uses: ./../action/analyze
-      - shell: bash
-        run: |
+      - run: |
          # Once we start running Bash 4.2 in all environments, we can replace the
          # `! -z` flag with the more elegant `-v` which confirms that the variable
          # is actually unset and not potentially set to a blank value.
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  go-tracing-legacy-workflow:
    strategy:
@@ -60,6 +66,10 @@ jobs:
            version: stable-v2.21.4
          - os: macos-latest
            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
+          - os: macos-latest
+            version: stable-v2.22.4
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -73,6 +83,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: 'Go: tracing with legacy workflow'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -89,7 +100,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -98,8 +109,7 @@ jobs:
          languages: go
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - uses: ./../action/analyze
-      - shell: bash
-        run: |
+      - run: |
          cd "$RUNNER_TEMP/codeql_databases"
          if [[ ! -d go ]]; then
            echo "Did not find a Go database"
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  init-with-registries:
    strategy:
@@ -32,23 +38,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Download using registries'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      packages: read
@@ -78,7 +73,6 @@ jobs:
              token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Verify packages installed
-        shell: bash
        run: |
          PRIVATE_PACK="$HOME/.codeql/packages/codeql-testing/private-pack"
          CODEQL_PACK1="$HOME/.codeql/packages/codeql-testing/codeql-pack1"
@@ -100,7 +94,6 @@ jobs:
          fi

      - name: Verify qlconfig.yml file was created
-        shell: bash
        run: |
          QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
          echo "Expected qlconfig.yml file to be created at $QLCONFIG_PATH"
@@ -113,9 +106,6 @@ jobs:
          fi

      - name: Verify contents of qlconfig.yml
-    # yq is not available on windows
-        if: runner.os != 'Windows'
-        shell: bash
        run: |
          QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
          cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  javascript-source-root:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Custom source root
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -53,7 +60,6 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Move codeql-action
-        shell: bash
        run: |
          mkdir ../new-source-root
          mv * ../new-source-root
@@ -66,7 +72,6 @@ jobs:
        with:
          skip-queries: true
      - name: Assert database exists
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/codeql_databases"
          if [[ ! -d javascript ]]; then
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  job-run-uuid-sarif:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Job run UUID added to SARIF
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -63,7 +70,6 @@ jobs:
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Check results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  language-aliases:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: linked
    name: Language aliases
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -34,15 +34,22 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  test-local-codeql:
+  local-bundle:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
-            version: nightly-latest
+            version: linked
    name: Local CodeQL bundle
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -59,16 +66,13 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
-      - name: Fetch a CodeQL bundle
-        shell: bash
-        env:
-          CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Fetch latest CodeQL bundle
        run: |
-          wget "$CODEQL_URL"
+          wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst
      - id: init
        uses: ./../action/init
        with:
@@ -76,7 +80,6 @@ jobs:
          languages: cpp,csharp,go,java,javascript,python,ruby
          tools: ./codeql-bundle-linux64.tar.zst
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
    env:
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  multi-language-autodetect:
    strategy:
@@ -60,6 +66,10 @@ jobs:
            version: stable-v2.21.4
          - os: ubuntu-latest
            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.22.4
+          - os: ubuntu-latest
+            version: stable-v2.22.4
          - os: macos-latest
            version: default
          - os: ubuntu-latest
@@ -73,6 +83,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Multi-language repository
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -89,12 +100,11 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Use Xcode 16
-        shell: bash
        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
        run: sudo xcode-select -s "/Applications/Xcode_16.app"

@@ -107,7 +117,6 @@ jobs:
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - name: Build code
-        shell: bash
        run: ./build.sh

      - uses: ./../action/analyze
@@ -116,7 +125,6 @@ jobs:
          upload-database: false

      - name: Check language autodetect for all languages excluding Swift
-        shell: bash
        run: |
          CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
          if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -156,7 +164,6 @@ jobs:

      - name: Check language autodetect for Swift on macOS
        if: runner.os == 'macOS'
-        shell: bash
        run: |
          SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
          if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -164,4 +171,5 @@ jobs:
            exit 1
          fi
    env:
+      CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
      CODEQL_ACTION_TEST_MODE: true
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  overlay-init-fallback:
    strategy:
@@ -35,6 +41,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Overlay database init fallback
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -61,7 +68,6 @@ jobs:
        with:
          upload-database: false
      - name: Check database
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/codeql_databases/actions"
          if ! grep -q 'overlayBaseDatabase: false' codeql-database.yml ; then
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-codescanning-config-inputs-js:
    strategy:
@@ -42,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Config and input passed to the CLI'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -68,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -82,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -93,7 +88,6 @@ jobs:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -109,7 +103,6 @@ jobs:
          queries-not-run: foo,bar

      - name: Assert Results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          # We should have 4 hits from these rules
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-config-inputs-js:
    strategy:
@@ -42,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Config and input'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -68,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -82,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -93,7 +88,6 @@ jobs:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -109,7 +103,6 @@ jobs:
          queries-not-run: foo,bar

      - name: Assert Results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          # We should have 4 hits from these rules
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-config-js:
    strategy:
@@ -42,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Config file'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -68,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -82,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -92,7 +87,6 @@ jobs:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -108,7 +102,6 @@ jobs:
          queries-not-run: foo,bar

      - name: Assert Results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          # We should have 4 hits from these rules
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  packaging-inputs-js:
    strategy:
@@ -42,23 +48,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: 'Packaging: Action input'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -68,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: 20.x
          cache: npm
@@ -82,7 +77,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -93,7 +88,6 @@ jobs:
          packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -108,7 +102,6 @@ jobs:
          queries-not-run: foo,bar

      - name: Assert Results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          # We should have 4 hits from these rules
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  quality-queries:
    strategy:
@@ -32,17 +38,24 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
            version: linked
-          - os: windows-latest
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
            version: linked
+            analysis-kinds: code-scanning,code-quality
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
            version: nightly-latest
-          - os: windows-latest
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
    name: Quality queries input
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -61,33 +74,39 @@ jobs:
      - uses: ./../action/init
        with:
          languages: javascript
-          quality-queries: code-quality
+          analysis-kinds: ${{ matrix.analysis-kinds }}
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - uses: ./../action/analyze
        with:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload security SARIF
+        if: contains(matrix.analysis-kinds, 'code-scanning')
        uses: actions/upload-artifact@v4
        with:
-          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.sarif.json
+          name: |
+            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
          retention-days: 7
      - name: Upload quality SARIF
+        if: contains(matrix.analysis-kinds, 'code-quality')
        uses: actions/upload-artifact@v4
        with:
-          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.quality.sarif.json
+          name: |
+            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
          path: ${{ runner.temp }}/results/javascript.quality.sarif
          retention-days: 7
      - name: Check quality query does not appear in security SARIF
-        uses: actions/github-script@v7
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
          EXPECT_PRESENT: 'false'
        with:
          script: ${{ env.CHECK_SCRIPT }}
      - name: Check quality query appears in quality SARIF
-        uses: actions/github-script@v7
+        if: contains(matrix.analysis-kinds, 'code-quality')
+        uses: actions/github-script@v8
        env:
          SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif
          EXPECT_PRESENT: 'true'
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  remote-config:
    strategy:
@@ -45,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Remote config file
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -61,7 +68,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -72,7 +79,6 @@ jobs:
          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
            github.sha }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
    env:
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  resolve-environment-action:
    strategy:
@@ -32,23 +38,12 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
          - os: ubuntu-latest
            version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
    name: Resolve environment
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  rubocop-multi-language:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: ubuntu-latest
            version: default
    name: RuboCop multi-language
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -49,17 +56,14 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@efbf473cab83af4468e8606cc33eca9281bb213f # v1.256.0
+        uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
-        shell: bash
        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
      - name: Install dependencies
-        shell: bash
        run: bundle install
      - name: RuboCop run
-        shell: bash
        run: |
          bash -c "
            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  ruby:
    strategy:
@@ -43,6 +49,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Ruby analysis
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -67,7 +74,6 @@ jobs:
        with:
          upload-database: false
      - name: Check database
-        shell: bash
        run: |
          RUBY_DB="${{ fromJson(steps.analysis.outputs.db-locations).ruby }}"
          if [[ ! -d "$RUBY_DB" ]]; then
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  rust:
    strategy:
@@ -41,6 +47,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Rust analysis
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -65,7 +72,6 @@ jobs:
        with:
          upload-database: false
      - name: Check database
-        shell: bash
        run: |
          RUST_DB="${{ fromJson(steps.analysis.outputs.db-locations).rust }}"
          if [[ ! -d "$RUST_DB" ]]; then
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  split-workflow:
    strategy:
@@ -53,6 +59,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Split workflow
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -69,7 +76,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -80,7 +87,6 @@ jobs:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        with:
@@ -89,7 +95,6 @@ jobs:
          upload-database: false

      - name: Assert No Results
-        shell: bash
        run: |
          if [ "$(ls -A $RUNNER_TEMP/results)" ]; then
            echo "Expected results directory to be empty after skipping query execution!"
@@ -100,7 +105,6 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Assert Results
-        shell: bash
        run: |
          cd "$RUNNER_TEMP/results"
          # We should have 4 hits from these rules
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  start-proxy:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: windows-latest
            version: linked
    name: Start proxy
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  submit-sarif-failure:
    strategy:
@@ -37,6 +43,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Submit SARIF after failure
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: write # needed to upload the SARIF file
@@ -24,6 +24,12 @@ on:
    inputs: {}
  workflow_call:
    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  swift-autobuild:
    strategy:
@@ -33,6 +39,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using autobuild
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -55,7 +62,6 @@ jobs:
          build-mode: autobuild
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Check working directory
-        shell: bash
        run: pwd
      - uses: ./../action/autobuild
        timeout-minutes: 30
@@ -64,7 +70,6 @@ jobs:
        with:
          upload-database: false
      - name: Check database
-        shell: bash
        run: |
          SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
          if [[ ! -d "$SWIFT_DB" ]]; then
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  swift-custom-build:
    strategy:
@@ -47,6 +53,7 @@ jobs:
          - os: macos-latest
            version: nightly-latest
    name: Swift analysis using a custom build command
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -63,12 +70,11 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Use Xcode 16
-        shell: bash
        if: runner.os == 'macOS' && matrix.version != 'nightly-latest'
        run: sudo xcode-select -s "/Applications/Xcode_16.app"
      - uses: ./../action/init
@@ -77,17 +83,14 @@ jobs:
          languages: swift
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Check working directory
-        shell: bash
        run: pwd
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        id: analysis
        with:
          upload-database: false
      - name: Check database
-        shell: bash
        run: |
          SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
          if [[ ! -d "$SWIFT_DB" ]]; then
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  unset-environment:
    strategy:
@@ -45,6 +51,7 @@ jobs:
          - os: ubuntu-latest
            version: nightly-latest
    name: Test unsetting environment variables
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -61,7 +68,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -73,14 +80,12 @@ jobs:
          languages: cpp,csharp,go,java,javascript,python,ruby
          tools: ${{ steps.prepare-test.outputs.tools-url }}
      - name: Build code
-        shell: bash
        run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
      - uses: ./../action/analyze
        id: analysis
        with:
          upload-database: false
-      - shell: bash
-        run: |
+      - run: |
          CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
          if [[ ! -d "$CPP_DB" ]] || [[ ! "$CPP_DB" == "${RUNNER_TEMP}/customDbLocation/cpp" ]]; then
            echo "::error::Did not create a database for CPP, or created it in the wrong location." \
@@ -1,91 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: 'PR Check - Upload-sarif: code quality endpoint'
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-  workflow_call:
-    inputs:
-      go-version:
-        type: string
-        description: The version of Go to install
-        required: false
-        default: '>=1.21.0'
-jobs:
-  upload-quality-sarif:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
-    name: 'Upload-sarif: code quality endpoint'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v5
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ inputs.go-version || '>=1.21.0' }}
-          cache: false
-      - uses: ./../action/init
-        with:
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-          languages: cpp,csharp,java,javascript,python
-          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
-            github.sha }}
-          quality-queries: code-quality
-      - name: Build code
-        shell: bash
-        run: ./build.sh
-  # Generate some SARIF we can upload with the upload-sarif step
-      - uses: ./../action/analyze
-        with:
-          ref: refs/heads/main
-          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
-          upload: never
-      - uses: ./../action/upload-sarif
-        with:
-          ref: refs/heads/main
-          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
-    env:
-      CODEQL_ACTION_TEST_MODE: true
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  upload-ref-sha-input:
    strategy:
@@ -42,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: default
-          - os: macos-latest
-            version: default
-          - os: windows-latest
-            version: default
    name: "Upload-sarif: 'ref' and 'sha' from inputs"
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -63,7 +66,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
@@ -74,7 +77,6 @@ jobs:
          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
            github.sha }}
      - name: Build code
-        shell: bash
        run: ./build.sh
  # Generate some SARIF we can upload with the upload-sarif step
      - uses: ./../action/analyze
@@ -0,0 +1,158 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Test different uses of `upload-sarif`
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+  workflow_call:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  upload-sarif:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-scanning
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-quality
+          - os: ubuntu-latest
+            version: default
+            analysis-kinds: code-scanning,code-quality
+    name: Test different uses of `upload-sarif`
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - uses: ./../action/init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: csharp,java,javascript,python
+          analysis-kinds: ${{ matrix.analysis-kinds }}
+      - name: Build code
+        run: ./build.sh
+  # Generate some SARIF we can upload with the upload-sarif step
+      - uses: ./../action/analyze
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          upload: never
+          output: ${{ runner.temp }}/results
+
+      - name: |
+          Upload all SARIF files for `analysis-kinds: ${{ matrix.analysis-kinds }}`
+        uses: ./../action/upload-sarif
+        id: upload-sarif
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
+      - name: Fail for missing output from `upload-sarif` step for `code-scanning`
+        if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
+        run: exit 1
+      - name: Fail for missing output from `upload-sarif` step for `code-quality`
+        if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
+        run: exit 1
+
+      - name: Upload single SARIF file for Code Scanning
+        uses: ./../action/upload-sarif
+        id: upload-single-sarif-code-scanning
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results/javascript.sarif
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
+      - name: Fail for missing output from `upload-single-sarif-code-scanning` step
+        if: contains(matrix.analysis-kinds, 'code-scanning') &&
+          !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
+        run: exit 1
+      - name: Upload single SARIF file for Code Quality
+        uses: ./../action/upload-sarif
+        id: upload-single-sarif-code-quality
+        if: contains(matrix.analysis-kinds, 'code-quality')
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
+      - name: Fail for missing output from `upload-single-sarif-code-quality` step
+        if: contains(matrix.analysis-kinds, 'code-quality') &&
+          !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
+        run: exit 1
+
+      - name: Change SARIF file extension
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        run: mv ${{ runner.temp }}/results/javascript.sarif ${{ runner.temp }}/results/javascript.sarif.json
+      - name: Upload single non-`.sarif` file
+        uses: ./../action/upload-sarif
+        id: upload-single-non-sarif
+        if: contains(matrix.analysis-kinds, 'code-scanning')
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
+          category: |
+            ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
+      - name: Fail for missing output from `upload-single-non-sarif` step
+        if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
+        run: exit 1
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -34,6 +34,12 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
  with-checkout-path:
    strategy:
@@ -42,11 +48,8 @@ jobs:
        include:
          - os: ubuntu-latest
            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
    name: Use a custom `checkout_path`
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -63,12 +66,11 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Delete original checkout
-        shell: bash
        run: |
          # delete the original checkout so we don't accidentally use it.
          # Actions does not support deleting the current working directory, so we
@@ -89,7 +91,6 @@ jobs:
          source-root: x/y/z/some-path/tests/multi-language-repo

      - name: Build code
-        shell: bash
        working-directory: x/y/z/some-path/tests/multi-language-repo
        run: |
          ./build.sh
@@ -101,31 +102,31 @@ jobs:
          sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6

      - name: Verify SARIF after upload
-        shell: bash
        run: |
+          PAYLOAD_FILE="$RUNNER_TEMP/payload-code-scanning.json"
          EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
          EXPECTED_REF="v1.1.0"
          EXPECTED_CHECKOUT_URI_SUFFIX="/x/y/z/some-path/tests/multi-language-repo"

-          ACTUAL_COMMIT_OID="$(cat "$RUNNER_TEMP/payload.json" | jq -r .commit_oid)"
-          ACTUAL_REF="$(cat "$RUNNER_TEMP/payload.json" | jq -r .ref)"
-          ACTUAL_CHECKOUT_URI="$(cat "$RUNNER_TEMP/payload.json" | jq -r .checkout_uri)"
+          ACTUAL_COMMIT_OID="$(cat "$PAYLOAD_FILE" | jq -r .commit_oid)"
+          ACTUAL_REF="$(cat "$PAYLOAD_FILE" | jq -r .ref)"
+          ACTUAL_CHECKOUT_URI="$(cat "$PAYLOAD_FILE" | jq -r .checkout_uri)"

          if [[ "$EXPECTED_COMMIT_OID" != "$ACTUAL_COMMIT_OID" ]]; then
            echo "::error Invalid commit oid. Expected: $EXPECTED_COMMIT_OID Actual: $ACTUAL_COMMIT_OID"
-            echo "$RUNNER_TEMP/payload.json"
+            echo "$PAYLOAD_FILE"
            exit 1
          fi

          if [[ "$EXPECTED_REF" != "$ACTUAL_REF" ]]; then
            echo "::error Invalid ref. Expected: '$EXPECTED_REF' Actual: '$ACTUAL_REF'"
-            echo "$RUNNER_TEMP/payload.json"
+            echo "$PAYLOAD_FILE"
            exit 1
          fi

          if [[ "$ACTUAL_CHECKOUT_URI" != *$EXPECTED_CHECKOUT_URI_SUFFIX ]]; then
            echo "::error Invalid checkout URI suffix. Expected suffix: $EXPECTED_CHECKOUT_URI_SUFFIX Actual uri: $ACTUAL_CHECKOUT_URI"
-            echo "$RUNNER_TEMP/payload.json"
+            echo "$PAYLOAD_FILE"
            exit 1
          fi
    env:
@@ -9,6 +9,10 @@ on:
    # by other workflows.
    types: [opened, synchronize, reopened, ready_for_review]

+defaults:
+  run:
+    shell: bash
+
 jobs:
  check-expected-release-files:
    runs-on: ubuntu-latest
@@ -13,12 +13,17 @@ on:
    - cron: '30 1 * * 0'
  workflow_dispatch:

+defaults:
+  run:
+    shell: bash
+
 env:
  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks

 jobs:
  # Identify the CodeQL tool versions to use in the analysis job.
  check-codeql-versions:
+    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    outputs:
      versions: ${{ steps.compare.outputs.versions }}
@@ -71,6 +76,7 @@ jobs:
        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT

  analyze-javascript:
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: [check-codeql-versions]
    strategy:
      fail-fast: false
@@ -91,22 +97,30 @@ jobs:
      id: init
      with:
        languages: javascript
-        config-file: ./.github/codeql/codeql-config.yml
+        config-file: ./.github/codeql/codeql-config-javascript.yml
        tools: ${{ matrix.tools }}
    # confirm steps.init.outputs.codeql-path points to the codeql binary
    - name: Print CodeQL Version
-      run: ${{steps.init.outputs.codeql-path}} version --format=json
+      run: >
+        "$CODEQL" version --format=json
+      env:
+        CODEQL: ${{steps.init.outputs.codeql-path}}
    - name: Perform CodeQL Analysis
      uses: ./analyze
      with:
        category: "/language:javascript"
+        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}

-
-  analyze-actions:
+  analyze-other:
+    if: github.triggering_actor != 'dependabot[bot]'
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+          - language: python

    permissions:
      contents: read
@@ -118,9 +132,15 @@ jobs:
    - name: Initialize CodeQL
      uses: ./init
      with:
-        languages: actions
-        config-file: ./.github/codeql/codeql-actions-config.yml
+        languages: ${{ matrix.language }}
+        build-mode: none
+        config: >
+          paths-ignore:
+            - lib
+            - tests
+          queries:
+            - uses: security-and-quality
    - name: Perform CodeQL Analysis
      uses: ./analyze
      with:
-        category: "/language:actions"
+        category: "/language:${{ matrix.language }}"
@@ -22,8 +22,13 @@ on:
    - cron: '0 5 * * *'
  workflow_dispatch: {}

+defaults:
+  run:
+    shell: bash
+
 jobs:
  code-scanning-config-tests:
+    if: github.triggering_actor != 'dependabot[bot]'
    continue-on-error: true

    permissions:
@@ -37,16 +42,10 @@ jobs:
        include:
        - os: ubuntu-latest
          version: linked
-        - os: macos-latest
-          version: linked
        - os: ubuntu-latest
          version: default
-        - os: macos-latest
-          version: default
        - os: ubuntu-latest
          version: nightly-latest
-        - os: macos-latest
-          version: nightly-latest

    # Code-Scanning config not created because environment variable is not set
    name: Code Scanning Configuration tests
@@ -57,9 +56,9 @@ jobs:
      uses: actions/checkout@v5

    - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
      with:
-        node-version: '20'
+        node-version: 24
        cache: 'npm'

    - name: Install dependencies
@@ -176,13 +175,13 @@ jobs:
      with:
        expected-config-file-contents: |
          {
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }
-            ],
            "packs": {
              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            }
+            },
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+            ]
          }
        languages: javascript
        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
@@ -17,8 +17,14 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch: {}
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
  upload-artifacts:
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -45,7 +51,7 @@ jobs:
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
        with:
          go-version: ^1.13.1
      - uses: ./../action/init
@@ -55,7 +61,6 @@ jobs:
          debug-artifact-name: my-debug-artifacts
          debug-database-name: my-db
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        id: analysis
@@ -66,6 +71,7 @@ jobs:
          expect-error: true
  download-and-check-artifacts:
    name: Download and check debug artifacts after failure in analyze
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
@@ -75,7 +81,6 @@ jobs:
      - name: Download all artifacts
        uses: actions/download-artifact@v5
      - name: Check expected artifacts exist
-        shell: bash
        run: |
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
@@ -16,8 +16,14 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch: {}
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
  upload-artifacts:
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
@@ -41,7 +47,7 @@ jobs:
        uses: ./.github/actions/prepare-test
        with:
          version: ${{ matrix.version }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
        with:
          go-version: ^1.13.1
      - uses: ./../action/init
@@ -54,12 +60,12 @@ jobs:
          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
          languages: cpp,csharp,go,java,javascript,python,ruby
      - name: Build code
-        shell: bash
        run: ./build.sh
      - uses: ./../action/analyze
        id: analysis
  download-and-check-artifacts:
    name: Download and check debug artifacts
+    if: github.triggering_actor != 'dependabot[bot]'
    needs: upload-artifacts
    timeout-minutes: 45
    permissions:
@@ -69,7 +75,6 @@ jobs:
      - name: Download all artifacts
        uses: actions/download-artifact@v5
      - name: Check expected artifacts exist
-        shell: bash
        run: |
          VERSIONS="stable-v2.20.3 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
@@ -18,6 +18,10 @@ on:
    branches:
      - releases/v*

+defaults:
+  run:
+    shell: bash
+
 jobs:
  merge-back:
    runs-on: ubuntu-latest
@@ -43,7 +47,7 @@ jobs:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5

      - name: Update git config
        run: |
@@ -135,7 +139,7 @@ jobs:
          token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Generate token
-        uses: actions/create-github-app-token@v2.1.1
+        uses: actions/create-github-app-token@v2.1.4
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -8,13 +8,19 @@ on:
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:

+defaults:
+  run:
+    shell: bash
+
 jobs:
  unit-tests:
    name: Unit Tests
+    if: github.triggering_actor != 'dependabot[bot]'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
+        node-version: [20, 24]
    permissions:
      contents: read
      security-events: write # needed to upload ESLint results
@@ -22,16 +28,20 @@ jobs:
    timeout-minutes: 45

    steps:
+      - name: Prepare git (Windows)
+        if: runner.os == 'Windows'
+        run: git config --global core.autocrlf false
+
      - uses: actions/checkout@v5
-      
+
      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
-          node-version: '20.x'
+          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: 3.11

@@ -46,24 +56,31 @@ jobs:
        run: .github/workflows/script/check-js.sh

      - name: Verify PR checks up to date
+        if: always()
        run: .github/workflows/script/verify-pr-checks.sh

      - name: Run unit tests
+        if: always()
        run: npm test

+      - name: Run pr-checks tests
+        if: always()
+        working-directory: pr-checks
+        run: python -m unittest discover
+
      - name: Lint
-        if: matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-latest'
        run: npm run lint-ci

      - name: Upload sarif
        uses: github/codeql-action/upload-sarif@v3
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
        with:
          sarif_file: eslint.sarif
          category: eslint

  check-node-version:
-    if: github.event.pull_request
+    if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]'
    name: Check Action Node versions
    runs-on: ubuntu-latest
    timeout-minutes: 45
@@ -22,6 +22,10 @@ on:
    paths:
      - .github/workflows/prepare-release.yml

+defaults:
+  run:
+    shell: bash
+
 jobs:
  prepare:
    name: "Prepare release"
@@ -4,6 +4,10 @@ on:
  release:
    types: [published]

+defaults:
+  run:
+    shell: bash
+
 jobs:
  publish:
    runs-on: ubuntu-latest
@@ -12,8 +12,13 @@ on:
    - cron: '0 0 * * 1'
  workflow_dispatch:

+defaults:
+  run:
+    shell: bash
+
 jobs:
  test-setup-python-scripts:
+    if: github.triggering_actor != 'dependabot[bot]'
    env:
      CODEQL_ACTION_TEST_MODE: true
    timeout-minutes: 45
@@ -22,7 +27,7 @@ jobs:
    runs-on: windows-latest

    steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
      with:
        python-version: 3.12

@@ -15,9 +15,14 @@ on:
    - cron: '0 5 * * *'
  workflow_dispatch: {}

+defaults:
+  run:
+    shell: bash
+
 jobs:
  query-filters:
    name: Query Filters Tests
+    if: github.triggering_actor != 'dependabot[bot]'
    timeout-minutes: 45
    runs-on: ubuntu-latest
    permissions:
@@ -27,9 +32,9 @@ jobs:
      uses: actions/checkout@v5

    - name: Install Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
      with:
-        node-version: 20.x
+        node-version: 24
        cache: npm

    - name: Install dependencies
@@ -5,12 +5,20 @@ on:
    types: [labeled]
  workflow_dispatch:

+defaults:
+  run:
+    shell: bash
+
 jobs:
  rebuild:
    name: Rebuild Action
    runs-on: ubuntu-latest
    if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'

+    env:
+      HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }}
+      BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
+
    permissions:
      contents: write # needed to push rebuilt commit
      pull-requests: write # needed to comment on the PR
@@ -19,7 +27,7 @@ jobs:
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref || github.event.ref }}
+          ref: ${{ env.HEAD_REF }}

      - name: Remove label
        if: github.event_name == 'pull_request'
@@ -37,8 +45,6 @@ jobs:

      - name: Merge in changes from base branch
        id: merge
-        env:
-          BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
        run: |
          git fetch origin "$BASE_BRANCH"

@@ -68,13 +74,20 @@ jobs:
          npm run build

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: 3.11

-      - name: Generate workflows
+      - name: Sync back version updates to generated workflows
+        # Only sync back versions on Dependabot update PRs
+        if: startsWith(env.HEAD_REF, 'dependabot/')
+        working-directory: pr-checks
+        run: |
+          python3 sync_back.py -v
+
+      - name: Generate workflows
+        working-directory: pr-checks
        run: |
-          cd pr-checks
          python -m pip install --upgrade pip
          pip install ruamel.yaml==0.17.31
          python3 sync.py
@@ -10,10 +10,18 @@ on:
        required: true
  # Only for dry-runs of changes to the workflow.
  push:
+    # Don't run dry-run on release branches, to avoid an issue where the
+    # "new" tag determined by the "Prepare release" job already exists.
+    branches-ignore:
+      - releases/v*
    paths:
      - .github/workflows/rollback-release.yml
      - .github/actions/prepare-mergeback-branch/**

+defaults:
+  run:
+    shell: bash
+
 jobs:
  prepare:
    name: "Prepare release"
@@ -53,7 +61,6 @@ jobs:

      - name: Create tag for testing
        if: github.event_name != 'workflow_dispatch'
-        shell: bash
        run: git tag v0.0.0

      # We start by preparing the mergeback branch, mainly so that we have the updated changelog
@@ -96,7 +103,6 @@ jobs:
          echo "::endgroup::"

      - name: Create tags
-        shell: bash
        env:
          # We usually expect to checkout `inputs.rollback-tag` (required for `workflow_dispatch`),
          # but use `v0.0.0` for testing.
@@ -111,7 +117,6 @@ jobs:
      - name: Push tags
        # skip when testing
        if: github.event_name == 'workflow_dispatch'
-        shell: bash
        env:
          RELEASE_TAG: ${{ needs.prepare.outputs.version }}
          MAJOR_VERSION_TAG: ${{ needs.prepare.outputs.major_version }}
@@ -132,7 +137,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v2.1.1
+        uses: actions/create-github-app-token@v2.1.4
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -160,7 +165,6 @@ jobs:
          echo "Created draft rollback release at $RELEASE_URL" >> $GITHUB_STEP_SUMMARY

      - name: Update changelog
-        shell: bash
        env:
          NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
          NEW_BRANCH: "${{ steps.mergeback-branch.outputs.new-branch }}"
@@ -16,6 +16,18 @@ if [ ! -z "$(git status --porcelain)" ]; then
    # If we get a fail here then the PR needs attention
    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
    git status
+
+    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
+    echo "" >> $GITHUB_STEP_SUMMARY
+    echo '```diff' >> $GITHUB_STEP_SUMMARY
+    git diff --output="$RUNNER_TEMP/js.diff"
+    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
+    echo '```' >> $GITHUB_STEP_SUMMARY
+
+    # Reset bundled files to allow other checks to test for changes
+    git checkout lib
+
+    # Fail this check
    exit 1
 fi
 echo "Success: JavaScript files are up to date"
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Update the required checks based on the current branch.
-# Typically, this will be main.
+
+set -euo pipefail

 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 REPO_DIR="$(dirname "$SCRIPT_DIR")"
@@ -32,6 +33,12 @@ CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs -

 echo "$CHECKS" | jq

+# Fail if there are no checks
+if [ -z "$CHECKS" ] || [ "$(echo "$CHECKS" | jq '. | length')" -eq 0 ]; then
+  echo "No checks found for $GITHUB_SHA"
+  exit 1
+fi
+
 echo "{\"contexts\": ${CHECKS}}" > checks.json

 echo "Updating main"
@@ -20,6 +20,14 @@ if [ ! -z "$(git status --porcelain)" ]; then
    git diff
    git status
    >&2 echo "Failed: PR checks are not up to date. Run 'cd pr-checks && python3 sync.py' to update"
+
+    echo "### Generated workflows diff" >> $GITHUB_STEP_SUMMARY
+    echo "" >> $GITHUB_STEP_SUMMARY
+    echo '```diff' >> $GITHUB_STEP_SUMMARY
+    git diff --output="$RUNNER_TEMP/workflows.diff"
+    cat "$RUNNER_TEMP/workflows.diff" >> $GITHUB_STEP_SUMMARY
+    echo '```' >> $GITHUB_STEP_SUMMARY
+
    exit 1
 fi
-echo "Success: PR checks are up to date"
+echo "Success: PR checks are up to date"
@@ -16,6 +16,9 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch: {}
+defaults:
+  run:
+    shell: bash
 jobs:
  test-codeql-bundle-all:
    strategy:
@@ -25,6 +28,7 @@ jobs:
        - os: ubuntu-latest
          version: nightly-latest
    name: 'CodeQL Bundle All'
+    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
      contents: read
      security-events: read
@@ -43,10 +47,9 @@ jobs:
      uses: ./../action/init
      with:
        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby 
+        languages: cpp,csharp,go,java,javascript,python,ruby
        tools: ${{ steps.prepare-test.outputs.tools-url }}
    - name: Build code
-      shell: bash
      run: ./build.sh
    - uses: ./../action/analyze
    env:
@@ -13,6 +13,10 @@ on:
    # to filter pre-release attribute.
    types: [published]

+defaults:
+  run:
+    shell: bash
+
 jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
@@ -36,6 +40,15 @@ jobs:
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"

+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
      - name: Update bundle
        uses: ./.github/actions/update-bundle

@@ -1,101 +0,0 @@
-name: Update dependency proxy release assets
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag of CodeQL Bundle release that contains the proxy binaries as release assets"
-        type: string
-        required: true
-
-jobs:
-  update:
-    name: Update code and create PR
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # needed to push the updated files
-      pull-requests: write # needed to create the PR
-    env:
-      RELEASE_TAG: ${{ inputs.tag }}
-    steps:
-      - name: Check release tag format
-        id: checks
-        shell: bash
-        run: |
-          if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
-            exit 1
-          fi
-
-          echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
-
-      - name: Check that the release exists
-        shell: bash
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        run: |
-          (gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
-
-      - name: Install Node
-        uses: actions/setup-node@v4
-
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
-          ref: main
-
-      - name: Update git config
-        shell: bash
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Update release tag and version
-        shell: bash
-        run: |
-          NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
-          sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
-          sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
-
-      - name: Compile TypeScript and commit changes
-        shell: bash
-        env:
-          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
-        run: |
-          set -exu
-          git checkout -b "$TARGET_BRANCH"
-
-          npm run build
-          git add ./src/start-proxy-action.ts
-          git add ./lib
-          git commit -m "Update release used by \`start-proxy\` action"
-
-      - name: Push changes and open PR
-        shell: bash
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
-          PR_FLAG: ${{ (github.event_name == 'workflow_dispatch' && '--draft') || '--dry-run' }}
-        run: |
-          set -exu
-          pr_title="Update release used by \`start-proxy\` to \`$RELEASE_TAG\`"
-          pr_body=$(cat << EOF
-            This PR updates the \`start-proxy\` action to use the private registry proxy binaries that
-            are attached as release assets to the \`$RELEASE_TAG\` release.
-
-
-            Please do the following before merging:
-
-            - [ ] Verify that the changes to the code are correct.
-            - [ ] Mark the PR as ready for review to trigger the CI.
-          EOF
-          )
-
-          git push origin "$TARGET_BRANCH"
-          gh pr create \
-            --head "$TARGET_BRANCH" \
-            --base "main" \
-            --title "${pr_title}" \
-            --body "${pr_body}" \
-            $PR_FLAG
@@ -11,6 +11,10 @@ on:
    branches:
      - releases/*

+defaults:
+  run:
+    shell: bash
+
 jobs:

  prepare:
@@ -89,7 +93,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@v2.1.1
+      uses: actions/create-github-app-token@v2.1.4
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -17,7 +17,7 @@ jobs:

    steps:
      - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Checkout CodeQL Action
@@ -8,6 +8,11 @@
    "build": true,
    "lib": true,
  },
+  "search.exclude": {
+    "**/node_modules": true,
+    "build": true,
+    "lib": true,
+  },
  // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
  // an intermediate stage where many files are modified. This setting suppresses these warnings.
  "git.ignoreLimitWarning": true,
@@ -2,10 +2,46 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## 3.30.0 - 01 Sep 2025
+## [UNRELEASED]

 No user facing changes.

+## 4.30.7 - 06 Oct 2025
+
+- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
+
+## 3.30.6 - 02 Oct 2025
+
+- Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
+
+## 3.30.5 - 26 Sep 2025
+
+- We fixed a bug that was introduced in `3.30.4` with `upload-sarif` which resulted in files without a `.sarif` extension not getting uploaded. [#3160](https://github.com/github/codeql-action/pull/3160)
+
+## 3.30.4 - 25 Sep 2025
+
+- We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
+- We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107)
+- You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#3130](https://github.com/github/codeql-action/pull/3130)
+- Update default CodeQL bundle version to 2.23.1. [#3118](https://github.com/github/codeql-action/pull/3118)
+
+## 3.30.3 - 10 Sep 2025
+
+No user facing changes.
+
+## 3.30.2 - 09 Sep 2025
+
+- Fixed a bug which could cause language autodetection to fail. [#3084](https://github.com/github/codeql-action/pull/3084)
+- Experimental: The `quality-queries` input that was added in `3.29.2` as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new `analysis-kinds` input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. [#3064](https://github.com/github/codeql-action/pull/3064)
+
+## 3.30.1 - 05 Sep 2025
+
+- Update default CodeQL bundle version to 2.23.0. [#3077](https://github.com/github/codeql-action/pull/3077)
+
+## 3.30.0 - 01 Sep 2025
+
+- Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. [#3054](https://github.com/github/codeql-action/pull/3054)
+
 ## 3.29.11 - 21 Aug 2025

 - Update default CodeQL bundle version to 2.22.4. [#3044](https://github.com/github/codeql-action/pull/3044)
@@ -13,13 +13,14 @@ Please note that this project is released with a [Contributor Code of Conduct][c

 ## Development and Testing

-Before you start, ensure that you have a recent version of node (16 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.

 ### Common tasks

 * Transpile the TypeScript to JavaScript: `npm run build`.  Note that the JavaScript files are committed to git.
 * Run tests: `npm run test`.  You’ll need to ensure that the JavaScript files are up-to-date first by running the command above.
 * Run the linter: `npm run lint`.
+* Run tests for a specific path: `npm run ava -- ./src/filename.test.ts` or `npm run ava -- ./src/feature-flags/`

 This project also includes configuration to run tests from VSCode (with support for breakpoints) - open the test file you wish to run and choose "Debug AVA test file" from the Run menu in the Run panel.

@@ -60,7 +61,7 @@ Here are a few things you can do that will increase the likelihood of your pull

    You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
 1. The workflow run will open a pull request titled "Merge main into releases/v3". Follow the steps on the checklist in the pull request. Once you've checked off all but the last two of these, approve the PR and automerge it.
-1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action. 
+1. When the "Merge main into releases/v3" pull request is merged into the `releases/v3` branch, a mergeback pull request to `main` will be automatically created. This mergeback pull request incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into releases/v3" pull request, and bumps the patch version of the CodeQL Action.
 1. If a backport to an older major version is required, a pull request targeting that version's branch will also be automatically created.
 1. Approve the mergeback and backport pull request (if applicable) and automerge them.

@@ -68,11 +69,12 @@ Once the mergeback and backport pull request have been merged, the release is co

 ## Keeping the PR checks up to date (admin access required)

-Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred jobs that need to pass in order for a PR to turn green. You can regenerate the checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:
+Since the `codeql-action` runs most of its testing through individual Actions workflows, there are over two hundred required jobs that need to pass in order for a PR to turn green. It would be too tedious to maintain that list manually. You can regenerate the set of required checks automatically by running the [update-required-checks.sh](.github/workflows/script/update-required-checks.sh) script:

-1. By default, this script retrieves the checks from the latest SHA on `main`, so make sure that your `main` branch is up to date.
-2. Run the script. If there's a reason to, you can pass in a different SHA as a CLI argument.
-3. After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.
+- If you run the script without an argument, it will retrieve the set of workflows that ran for the latest commit on `main`. Make sure that your local `main` branch is up to date before running the script.
+- You can specify a commit SHA as argument to retrieve the set of workflows for that commit instead. You will likely want to use this if you have a PR that removes or adds PR checks.
+
+After running, go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules for `main`, `v3`, and any other currently supported major versions have been updated.

 Note that any updates to checks on `main` need to be backported to all currently supported major version branches, in order to maintain the same set of names for required checks.

@@ -62,7 +62,8 @@ For compiled languages:

 The following versions of the CodeQL Action are currently supported:

- v3 (latest)
+- v4 (latest)
+- v3

 ## Supported versions of the CodeQL Bundle on GitHub Enterprise Server

@@ -58,7 +58,7 @@ inputs:
    # If changing this, make sure to update workflow.ts accordingly.
    default: ${{ github.workspace }}
  ref:
-    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks."
+    description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is ignored for pull requests from forks. Expected format: refs/heads/<branch name>, refs/tags/<tag>, refs/pull/<number>/merge, or refs/pull/<number>/head."
    required: false
  sha:
    description: "The sha of the HEAD of the ref where results will be uploaded. If not provided, the Action will use the GITHUB_SHA environment variable. If provided, the ref input must be provided as well. This input is ignored for pull requests from forks."
@@ -92,6 +92,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node20
+  using: node24
  main: "../lib/analyze-action.js"
  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node20
+  using: node24
  main: '../lib/autobuild-action.js'
@@ -76,7 +76,7 @@ export default [

        typescript: {},
      },
-      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry"],
+      "import/ignore": ["sinon", "uuid", "@octokit/plugin-retry", "del", "get-folder-size"],
    },

    rules: {
@@ -146,6 +146,12 @@ export default [
      "@typescript-eslint/prefer-regexp-exec": "off",
      "@typescript-eslint/require-await": "off",
      "@typescript-eslint/restrict-template-expressions": "off",
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        {
+          "argsIgnorePattern": "^_",
+        }
+      ],
      "func-style": "off",
    },
  },
@@ -12,6 +12,9 @@ inputs:
      - The URL of a CodeQL Bundle tarball GitHub release asset, or
      - A special value `linked` which uses the version of the CodeQL tools
        that the Action has been bundled with.
+      - A special value `nightly` which uses the latest nightly version of the
+        CodeQL tools. Note that this is unstable and not recommended for
+        production use.

      If not specified, the Action will check in several places until it finds
      the CodeQL tools.
@@ -97,7 +100,7 @@ inputs:
    description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
    required: false
  quality-queries:
-    description: '[Internal] Comma-separated list of code quality queries to run.'
+    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
    required: false
  packs:
    description: >-
@@ -162,6 +165,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node20
+  using: node24
  main: '../lib/init-action.js'
  post: '../lib/init-action-post.js'
@@ -22,7 +22,7 @@ test: build

 # Run the tests for a single file
 test_file filename: build
-    npx ava --verbose {{filename}}
+    npm run ava {{filename}}

 [doc("Refresh the .js build artefacts in the lib directory")]
 [confirm]
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.22.4",
-  "cliVersion": "2.22.4",
-  "priorBundleVersion": "codeql-bundle-v2.22.3",
-  "priorCliVersion": "2.22.3"
+  "bundleVersion": "codeql-bundle-v2.23.2",
+  "cliVersion": "2.23.2",
+  "priorBundleVersion": "codeql-bundle-v2.23.1",
+  "priorCliVersion": "2.23.1"
 }
--- a/Show More
+++ b/Show More