Adjust retry configuration and add comment

.github/actions/check-codescanning-config/index.ts

@@ -6,16 +6,6 @@ import * as assert from 'assert'
 
 const actualConfig = loadActualConfig()
 
-function sortConfigArrays(config) {
-  for (const key of Object.keys(config)) {
-    const value = config[key];
-    if (key === 'queries' && Array.isArray(value)) {
-      config[key] = value.sort();
-    }
-  }
-  return config;
-}
-
 const rawExpectedConfig = process.argv[3].trim()
 if (!rawExpectedConfig) {
   core.setFailed('No expected configuration provided')
@@ -28,8 +18,8 @@ if (!rawExpectedConfig) {
 const expectedConfig = rawExpectedConfig ? JSON.parse(rawExpectedConfig) : undefined;
 
 assert.deepStrictEqual(
-  sortConfigArrays(actualConfig),
-  sortConfigArrays(expectedConfig),
+  actualConfig,
+  expectedConfig,
   'Expected configuration does not match actual configuration'
 );
 

.github/actions/check-sarif/action.yml

@@ -16,5 +16,5 @@ inputs:
       Comma separated list of query ids that should NOT be included in this SARIF file.
 
 runs:
-  using: node24
+  using: node20
   main: index.js

.github/dependabot.yml

@@ -20,14 +20,18 @@ updates:
         patterns:
           - "*"
   - package-ecosystem: github-actions
-    directories:
-      - "/.github/workflows"
-      - "/.github/actions"
+    directory: "/"
     schedule:
       interval: weekly
-    labels:
-      - Rebuild
     groups:
       actions:
         patterns:
           - "*"
+  - package-ecosystem: github-actions
+    directory: "/.github/actions/setup-swift/" # All subdirectories outside of "/.github/workflows" must be explicitly included.
+    schedule:
+      interval: weekly
+    groups:
+      actions-setup-swift:
+        patterns:
+          - "*"

.github/workflows/__all-platform-bundle.yml

@@ -48,12 +48,7 @@ jobs:
         include:
           - os: ubuntu-latest
             version: nightly-latest
-          - os: macos-latest
-            version: nightly-latest
-          - os: windows-latest
-            version: nightly-latest
     name: All-platform bundle
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -70,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'true'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__analyze-ref-input.yml

@@ -48,8 +48,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__autobuild-action.yml

@@ -43,7 +43,6 @@ jobs:
           - os: windows-latest
             version: linked
     name: autobuild-action
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -55,7 +55,6 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__autobuild-direct-tracing.yml

@@ -0,0 +1,103 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Autobuild direct tracing
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+  workflow_call:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  autobuild-direct-tracing:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
+    name: Autobuild direct tracing
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Install Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Set up Java test repo configuration
+        run: |
+          mv * .github ../action/tests/multi-language-repo/
+          mv ../action/tests/multi-language-repo/.github/workflows .github
+          mv ../action/tests/java-repo/* .
+
+      - uses: ./../action/init
+        id: init
+        with:
+          build-mode: autobuild
+          db-location: ${{ runner.temp }}/customDbLocation
+          languages: java
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Check that indirect tracing is disabled
+        run: |
+          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
+            echo "Expected indirect tracing to be disabled, but the" \
+              "CODEQL_RUNNER environment variable is set."
+            exit 1
+          fi
+
+      - uses: ./../action/analyze
+    env:
+      CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__build-mode-autobuild.yml

@@ -21,19 +21,9 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
   workflow_call:
-    inputs:
-      java-version:
-        type: string
-        description: The version of Java to install
-        required: false
-        default: '17'
+    inputs: {}
 defaults:
   run:
     shell: bash
@@ -47,15 +37,8 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest
-            version: linked
-          - os: windows-latest
-            version: linked
-          - os: ubuntu-latest
-            version: nightly-latest
-          - os: windows-latest
             version: nightly-latest
     name: Build mode autobuild
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -71,11 +54,6 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ inputs.java-version || '17' }}
-          distribution: temurin
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -90,11 +68,6 @@ jobs:
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: Install yq
-        if: runner.os == 'Windows'
-        run: |
-          choco install yq -y
-
       - name: Validate database build mode
         run: |
           metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
@@ -104,14 +77,6 @@ jobs:
             exit 1
           fi
 
-      - name: Check that indirect tracing is disabled
-        run: |
-          if [[ ! -z "${CODEQL_RUNNER}" ]]; then
-            echo "Expected indirect tracing to be disabled, but the" \
-              "CODEQL_RUNNER environment variable is set."
-            exit 1
-          fi
-
       - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__build-mode-manual.yml

@@ -49,7 +49,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode manual
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__build-mode-none.yml

@@ -41,7 +41,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode none
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__build-mode-rollback.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode rollback
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__bundle-toolcache.yml

@@ -43,7 +43,6 @@ jobs:
           - os: windows-latest
             version: linked
     name: 'Bundle: Caching checks'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -60,7 +59,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const fs = require('fs');
@@ -70,7 +69,7 @@ jobs:
       - name: Install @actions/tool-cache
         run: npm install @actions/tool-cache
       - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const toolcache = require('@actions/tool-cache');
@@ -89,7 +88,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const toolcache = require('@actions/tool-cache');

.github/workflows/__bundle-zstd.yml

@@ -43,7 +43,6 @@ jobs:
           - os: windows-latest
             version: linked
     name: 'Bundle: Zstandard checks'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -60,7 +59,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const fs = require('fs');
@@ -85,7 +84,7 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
         with:

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Clean up database cluster directory
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__config-export.yml

@@ -38,10 +38,17 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: Config export
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -73,7 +80,7 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check config properties appear in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
         with:

.github/workflows/__config-input.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Config input
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -49,7 +48,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Install Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
           cache: npm

.github/workflows/__cpp-deptrace-disabled.yml

@@ -43,7 +43,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'C/C++: disabling autoinstalling dependencies (Linux)'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -41,7 +41,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__cpp-deptrace-enabled.yml

@@ -43,7 +43,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies (Linux)'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__diagnostics-export.yml

@@ -38,10 +38,17 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: Diagnostic export
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -84,7 +91,7 @@ jobs:
           path: ${{ runner.temp }}/results/javascript.sarif
           retention-days: 7
       - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
         with:

.github/workflows/__export-file-baseline-information.yml

@@ -53,7 +53,6 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Export file baseline information
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -70,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__extractor-ram-threads.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Extractor ram and threads options test
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-custom-queries.yml

@@ -51,7 +51,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Go: Custom queries'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -68,7 +67,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -49,7 +49,6 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: diagnostic when Go is changed after init step'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -75,7 +74,7 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
   # Deliberately change Go after the `init` step
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.20'
       - name: Build code
@@ -85,7 +84,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/go.sarif
         with:

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -49,7 +49,6 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: diagnostic when `file` is not installed'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -86,7 +85,7 @@ jobs:
           output: ${{ runner.temp }}/results
           upload-database: false
       - name: Check diagnostic appears in SARIF
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/go.sarif
         with:

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -49,7 +49,6 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: workaround for indirect tracing'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-tracing-autobuilder.yml

@@ -83,7 +83,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with autobuilder step'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -100,7 +99,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -83,7 +83,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with custom build steps'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -100,7 +99,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -83,7 +83,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with legacy workflow'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -100,7 +99,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__init-with-registries.yml

@@ -38,12 +38,23 @@ jobs:
         include:
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: 'Packaging: Download using registries'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       packages: read
@@ -106,6 +117,8 @@ jobs:
           fi
 
       - name: Verify contents of qlconfig.yml
+    # yq is not available on windows
+        if: runner.os != 'Windows'
         run: |
           QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
           cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'

.github/workflows/__javascript-source-root.yml

@@ -43,7 +43,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Custom source root
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__job-run-uuid-sarif.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Job run UUID added to SARIF
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__language-aliases.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Language aliases
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__multi-language-autodetect.yml

@@ -83,7 +83,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Multi-language repository
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -100,7 +99,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__overlay-init-fallback.yml

@@ -41,7 +41,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Overlay database init fallback
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -48,12 +48,23 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -63,7 +74,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Install Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
           cache: npm
@@ -77,7 +88,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__packaging-config-inputs-js.yml

@@ -48,12 +48,23 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: 'Packaging: Config and input'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -63,7 +74,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Install Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
           cache: npm
@@ -77,7 +88,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__packaging-config-js.yml

@@ -48,12 +48,23 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: 'Packaging: Config file'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -63,7 +74,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Install Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
           cache: npm
@@ -77,7 +88,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__packaging-inputs-js.yml

@@ -48,12 +48,23 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: 'Packaging: Action input'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -63,7 +74,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Install Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
           cache: npm
@@ -77,7 +88,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__quality-queries.yml

@@ -45,6 +45,24 @@ jobs:
           - os: ubuntu-latest
             version: linked
             analysis-kinds: code-scanning,code-quality
+          - os: macos-latest
+            version: linked
+            analysis-kinds: code-scanning
+          - os: macos-latest
+            version: linked
+            analysis-kinds: code-quality
+          - os: macos-latest
+            version: linked
+            analysis-kinds: code-scanning,code-quality
+          - os: windows-latest
+            version: linked
+            analysis-kinds: code-scanning
+          - os: windows-latest
+            version: linked
+            analysis-kinds: code-quality
+          - os: windows-latest
+            version: linked
+            analysis-kinds: code-scanning,code-quality
           - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning
@@ -54,8 +72,25 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
             analysis-kinds: code-scanning,code-quality
+          - os: macos-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning
+          - os: macos-latest
+            version: nightly-latest
+            analysis-kinds: code-quality
+          - os: macos-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
+          - os: windows-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning
+          - os: windows-latest
+            version: nightly-latest
+            analysis-kinds: code-quality
+          - os: windows-latest
+            version: nightly-latest
+            analysis-kinds: code-scanning,code-quality
     name: Quality queries input
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -98,7 +133,7 @@ jobs:
           retention-days: 7
       - name: Check quality query does not appear in security SARIF
         if: contains(matrix.analysis-kinds, 'code-scanning')
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
           EXPECT_PRESENT: 'false'
@@ -106,7 +141,7 @@ jobs:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         env:
           SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif
           EXPECT_PRESENT: 'true'

.github/workflows/__remote-config.yml

@@ -51,7 +51,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Remote config file
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -68,7 +67,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__resolve-environment-action.yml

@@ -38,12 +38,23 @@ jobs:
         include:
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
           - os: ubuntu-latest
             version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
     name: Resolve environment
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__rubocop-multi-language.yml

@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -56,7 +55,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__ruby.yml

@@ -49,7 +49,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Ruby analysis
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__rust.yml

@@ -47,7 +47,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Rust analysis
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__split-workflow.yml

@@ -59,7 +59,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Split workflow
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -76,7 +75,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__start-proxy.yml

@@ -43,7 +43,6 @@ jobs:
           - os: windows-latest
             version: linked
     name: Start proxy
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__submit-sarif-failure.yml

@@ -43,7 +43,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Submit SARIF after failure
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: write # needed to upload the SARIF file

.github/workflows/__swift-autobuild.yml

@@ -39,7 +39,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Swift analysis using autobuild
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__swift-custom-build.yml

@@ -53,7 +53,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Swift analysis using a custom build command
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -70,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__test-autobuild-working-dir.yml

@@ -31,7 +31,7 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  autobuild-working-dir:
+  test-autobuild-working-dir:
     strategy:
       fail-fast: false
       matrix:
@@ -39,7 +39,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Autobuild working directory
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__test-local-codeql.yml

@@ -41,7 +41,7 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  local-bundle:
+  test-local-codeql:
     strategy:
       fail-fast: false
       matrix:
@@ -49,7 +49,6 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Local CodeQL bundle
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +65,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__test-proxy.yml

@@ -31,7 +31,7 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
-  global-proxy:
+  test-proxy:
     strategy:
       fail-fast: false
       matrix:
@@ -41,7 +41,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Proxy test
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read

.github/workflows/__unset-environment.yml

@@ -51,7 +51,6 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Test unsetting environment variables
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -68,7 +67,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__upload-quality-sarif.yml

@@ -48,8 +48,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
     name: 'Upload-sarif: code quality endpoint'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -89,7 +92,7 @@ jobs:
           ref: refs/heads/main
           sha: 5e235361806c361d4d3f8859e3c897658025a9a2
       - name: Check output from `upload-sarif` step
-        if: '!(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)'
+        if: fromJSON(steps.upload-sarif.outputs.sarif-ids)[0].analysis != 'code-quality'
         run: exit 1
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -48,8 +48,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/__with-checkout-path.yml

@@ -48,8 +48,11 @@ jobs:
         include:
           - os: ubuntu-latest
             version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
     name: Use a custom `checkout_path`
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -66,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false

.github/workflows/codeql.yml

@@ -23,7 +23,6 @@ env:
 jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
   check-codeql-versions:
-    if: github.triggering_actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     outputs:
       versions: ${{ steps.compare.outputs.versions }}
@@ -76,7 +75,6 @@ jobs:
         echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
 
   analyze-javascript:
-    if: github.triggering_actor != 'dependabot[bot]'
     needs: [check-codeql-versions]
     strategy:
       fail-fast: false
@@ -112,7 +110,6 @@ jobs:
         upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }}
 
   analyze-other:
-    if: github.triggering_actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
 
     strategy:

.github/workflows/codescanning-config-cli.yml

@@ -28,7 +28,6 @@ defaults:
 
 jobs:
   code-scanning-config-tests:
-    if: github.triggering_actor != 'dependabot[bot]'
     continue-on-error: true
 
     permissions:
@@ -42,10 +41,16 @@ jobs:
         include:
         - os: ubuntu-latest
           version: linked
+        - os: macos-latest
+          version: linked
         - os: ubuntu-latest
           version: default
+        - os: macos-latest
+          version: default
         - os: ubuntu-latest
           version: nightly-latest
+        - os: macos-latest
+          version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
     name: Code Scanning Configuration tests
@@ -56,9 +61,9 @@ jobs:
       uses: actions/checkout@v5
 
     - name: Set up Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: '20'
         cache: 'npm'
 
     - name: Install dependencies
@@ -175,13 +180,13 @@ jobs:
       with:
         expected-config-file-contents: |
           {
+            "queries": [
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" },
+              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }
+            ],
             "packs": {
               "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
+            }
           }
         languages: javascript
         queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql

.github/workflows/debug-artifacts-failure-safe.yml

@@ -24,7 +24,6 @@ defaults:
 
 jobs:
   upload-artifacts:
-    if: github.triggering_actor != 'dependabot[bot]'
     strategy:
       fail-fast: false
       matrix:
@@ -51,7 +50,7 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
           go-version: ^1.13.1
       - uses: ./../action/init
@@ -71,7 +70,6 @@ jobs:
           expect-error: true
   download-and-check-artifacts:
     name: Download and check debug artifacts after failure in analyze
-    if: github.triggering_actor != 'dependabot[bot]'
     needs: upload-artifacts
     timeout-minutes: 45
     permissions:

.github/workflows/debug-artifacts-safe.yml

@@ -23,7 +23,6 @@ defaults:
 
 jobs:
   upload-artifacts:
-    if: github.triggering_actor != 'dependabot[bot]'
     strategy:
       fail-fast: false
       matrix:
@@ -47,7 +46,7 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
           go-version: ^1.13.1
       - uses: ./../action/init
@@ -65,7 +64,6 @@ jobs:
         id: analysis
   download-and-check-artifacts:
     name: Download and check debug artifacts
-    if: github.triggering_actor != 'dependabot[bot]'
     needs: upload-artifacts
     timeout-minutes: 45
     permissions:

.github/workflows/post-release-mergeback.yml

@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v4
 
       - name: Update git config
         run: |
@@ -139,7 +139,7 @@ jobs:
           token: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Generate token
-        uses: actions/create-github-app-token@v2.1.4
+        uses: actions/create-github-app-token@v2.1.1
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/pr-checks.yml

@@ -15,12 +15,10 @@ defaults:
 jobs:
   unit-tests:
     name: Unit Tests
-    if: github.triggering_actor != 'dependabot[bot]'
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        node-version: [20, 24]
     permissions:
       contents: read
       security-events: write # needed to upload ESLint results
@@ -33,15 +31,15 @@ jobs:
         run: git config --global core.autocrlf false
 
       - uses: actions/checkout@v5
-
+      
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: '20.x'
           cache: 'npm'
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: 3.11
 
@@ -56,31 +54,24 @@ jobs:
         run: .github/workflows/script/check-js.sh
 
       - name: Verify PR checks up to date
-        if: always()
         run: .github/workflows/script/verify-pr-checks.sh
 
       - name: Run unit tests
-        if: always()
         run: npm test
 
-      - name: Run pr-checks tests
-        if: always()
-        working-directory: pr-checks
-        run: python -m unittest discover
-
       - name: Lint
-        if: always() && matrix.os != 'windows-latest'
+        if: matrix.os != 'windows-latest'
         run: npm run lint-ci
 
       - name: Upload sarif
         uses: github/codeql-action/upload-sarif@v3
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24
+        if: matrix.os == 'ubuntu-latest'
         with:
           sarif_file: eslint.sarif
           category: eslint
 
   check-node-version:
-    if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]'
+    if: github.event.pull_request
     name: Check Action Node versions
     runs-on: ubuntu-latest
     timeout-minutes: 45

.github/workflows/python312-windows.yml

@@ -18,7 +18,6 @@ defaults:
 
 jobs:
   test-setup-python-scripts:
-    if: github.triggering_actor != 'dependabot[bot]'
     env:
       CODEQL_ACTION_TEST_MODE: true
     timeout-minutes: 45
@@ -27,7 +26,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@v5
       with:
         python-version: 3.12
 

.github/workflows/query-filters.yml

@@ -22,7 +22,6 @@ defaults:
 jobs:
   query-filters:
     name: Query Filters Tests
-    if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
     runs-on: ubuntu-latest
     permissions:
@@ -32,9 +31,9 @@ jobs:
       uses: actions/checkout@v5
 
     - name: Install Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 20.x
         cache: npm
 
     - name: Install dependencies

.github/workflows/rebuild.yml

@@ -15,10 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
-    env:
-      HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }}
-      BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
-
     permissions:
       contents: write # needed to push rebuilt commit
       pull-requests: write # needed to comment on the PR
@@ -27,7 +23,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
-          ref: ${{ env.HEAD_REF }}
+          ref: ${{ github.event.pull_request.head.ref || github.event.ref }}
 
       - name: Remove label
         if: github.event_name == 'pull_request'
@@ -45,6 +41,8 @@ jobs:
 
       - name: Merge in changes from base branch
         id: merge
+        env:
+          BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }}
         run: |
           git fetch origin "$BASE_BRANCH"
 
@@ -74,20 +72,13 @@ jobs:
           npm run build
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: 3.11
 
-      - name: Sync back version updates to generated workflows
-        # Only sync back versions on Dependabot update PRs
-        if: startsWith(env.HEAD_REF, 'dependabot/')
-        working-directory: pr-checks
-        run: |
-          python3 sync_back.py -v
-
       - name: Generate workflows
-        working-directory: pr-checks
         run: |
+          cd pr-checks
           python -m pip install --upgrade pip
           pip install ruamel.yaml==0.17.31
           python3 sync.py

.github/workflows/rollback-release.yml

@@ -10,10 +10,6 @@ on:
         required: true
   # Only for dry-runs of changes to the workflow.
   push:
-    # Don't run dry-run on release branches, to avoid an issue where the
-    # "new" tag determined by the "Prepare release" job already exists.
-    branches-ignore:
-      - releases/v*
     paths:
       - .github/workflows/rollback-release.yml
       - .github/actions/prepare-mergeback-branch/**
@@ -137,7 +133,7 @@ jobs:
 
       - name: Generate token
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@v2.1.4
+        uses: actions/create-github-app-token@v2.1.1
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/script/check-js.sh

@@ -16,18 +16,6 @@ if [ ! -z "$(git status --porcelain)" ]; then
     # If we get a fail here then the PR needs attention
     >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
     git status
-
-    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/js.diff"
-    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    # Reset bundled files to allow other checks to test for changes
-    git checkout lib
-
-    # Fail this check
     exit 1
 fi
 echo "Success: JavaScript files are up to date"

.github/workflows/script/verify-pr-checks.sh

@@ -20,14 +20,6 @@ if [ ! -z "$(git status --porcelain)" ]; then
     git diff
     git status
     >&2 echo "Failed: PR checks are not up to date. Run 'cd pr-checks && python3 sync.py' to update"
-
-    echo "### Generated workflows diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/workflows.diff"
-    cat "$RUNNER_TEMP/workflows.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
     exit 1
 fi
-echo "Success: PR checks are up to date"
+echo "Success: PR checks are up to date"

.github/workflows/test-codeql-bundle-all.yml

@@ -28,7 +28,6 @@ jobs:
         - os: ubuntu-latest
           version: nightly-latest
     name: 'CodeQL Bundle All'
-    if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
       security-events: read
@@ -47,7 +46,7 @@ jobs:
       uses: ./../action/init
       with:
         # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby
+        languages: cpp,csharp,go,java,javascript,python,ruby 
         tools: ${{ steps.prepare-test.outputs.tools-url }}
     - name: Build code
       run: ./build.sh

.github/workflows/update-bundle.yml

@@ -41,9 +41,9 @@ jobs:
           git config --global user.name "github-actions[bot]"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '20.x'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/update-proxy-release.yml

@@ -0,0 +1,99 @@
+name: Update dependency proxy release assets
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag of CodeQL Bundle release that contains the proxy binaries as release assets"
+        type: string
+        required: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  update:
+    name: Update code and create PR
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # needed to push the updated files
+      pull-requests: write # needed to create the PR
+    env:
+      RELEASE_TAG: ${{ inputs.tag }}
+    steps:
+      - name: Check release tag format
+        id: checks
+        run: |
+          if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
+            exit 1
+          fi
+
+          echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
+
+      - name: Check that the release exists
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          (gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0  # ensure we have all tags and can push commits
+          ref: main
+
+      - name: Update git config
+        run: |
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+
+      - name: Update release tag and version
+        run: |
+          NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
+          sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
+          sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
+
+      - name: Compile TypeScript and commit changes
+        env:
+          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
+        run: |
+          set -exu
+          git checkout -b "$TARGET_BRANCH"
+
+          npm run build
+          git add ./src/start-proxy-action.ts
+          git add ./lib
+          git commit -m "Update release used by \`start-proxy\` action"
+
+      - name: Push changes and open PR
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
+          PR_FLAG: ${{ (github.event_name == 'workflow_dispatch' && '--draft') || '--dry-run' }}
+        run: |
+          set -exu
+          pr_title="Update release used by \`start-proxy\` to \`$RELEASE_TAG\`"
+          pr_body=$(cat << EOF
+            This PR updates the \`start-proxy\` action to use the private registry proxy binaries that
+            are attached as release assets to the \`$RELEASE_TAG\` release.
+
+
+            Please do the following before merging:
+
+            - [ ] Verify that the changes to the code are correct.
+            - [ ] Mark the PR as ready for review to trigger the CI.
+          EOF
+          )
+
+          git push origin "$TARGET_BRANCH"
+          gh pr create \
+            --head "$TARGET_BRANCH" \
+            --base "main" \
+            --title "${pr_title}" \
+            --body "${pr_body}" \
+            $PR_FLAG

.github/workflows/update-release-branch.yml

@@ -93,7 +93,7 @@ jobs:
       pull-requests: write # needed to create pull request
     steps:
     - name: Generate token
-      uses: actions/create-github-app-token@v2.1.4
+      uses: actions/create-github-app-token@v2.1.1
       id: app-token
       with:
         app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: "3.13"
       - name: Checkout CodeQL Action

.vscode/settings.json

@@ -8,11 +8,6 @@
     "build": true,
     "lib": true,
   },
-  "search.exclude": {
-    "**/node_modules": true,
-    "build": true,
-    "lib": true,
-  },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
   // an intermediate stage where many files are modified. This setting suppresses these warnings.
   "git.ignoreLimitWarning": true,

CHANGELOG.md

@@ -2,24 +2,11 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
-## 4.30.7 - 06 Oct 2025
-
-- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)
-
-## 3.30.6 - 02 Oct 2025
-
-- Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
-
-## 3.30.5 - 26 Sep 2025
-
-- We fixed a bug that was introduced in `3.30.4` with `upload-sarif` which resulted in files without a `.sarif` extension not getting uploaded. [#3160](https://github.com/github/codeql-action/pull/3160)
-
-## 3.30.4 - 25 Sep 2025
+## [UNRELEASED]
 
 - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100)
 - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107)
 - You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#3130](https://github.com/github/codeql-action/pull/3130)
-- Update default CodeQL bundle version to 2.23.1. [#3118](https://github.com/github/codeql-action/pull/3118)
 
 ## 3.30.3 - 10 Sep 2025
 

CONTRIBUTING.md

@@ -13,14 +13,13 @@ Please note that this project is released with a [Contributor Code of Conduct][c
 
 ## Development and Testing
 
-Before you start, ensure that you have a recent version of node (24 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node (16 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
 
 ### Common tasks
 
 * Transpile the TypeScript to JavaScript: `npm run build`.  Note that the JavaScript files are committed to git.
 * Run tests: `npm run test`.  You’ll need to ensure that the JavaScript files are up-to-date first by running the command above.
 * Run the linter: `npm run lint`.
-* Run tests for a specific path: `npm run ava -- ./src/filename.test.ts` or `npm run ava -- ./src/feature-flags/`
 
 This project also includes configuration to run tests from VSCode (with support for breakpoints) - open the test file you wish to run and choose "Debug AVA test file" from the Run menu in the Run panel.
 

README.md

@@ -62,8 +62,7 @@ For compiled languages:
 
 The following versions of the CodeQL Action are currently supported:
 
-- v4 (latest)
-- v3
+- v3 (latest)
 
 ## Supported versions of the CodeQL Bundle on GitHub Enterprise Server
 

analyze/action.yml

@@ -92,6 +92,6 @@ outputs:
   sarif-id:
     description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
+  using: node20
   main: "../lib/analyze-action.js"
   post: "../lib/analyze-action-post.js"

autobuild/action.yml

@@ -15,5 +15,5 @@ inputs:
       $GITHUB_WORKSPACE as its working directory.
     required: false
 runs:
-  using: node24
+  using: node20
   main: '../lib/autobuild-action.js'

eslint.config.mjs

@@ -146,12 +146,6 @@ export default [
       "@typescript-eslint/prefer-regexp-exec": "off",
       "@typescript-eslint/require-await": "off",
       "@typescript-eslint/restrict-template-expressions": "off",
-      "@typescript-eslint/no-unused-vars": [
-        "error",
-        {
-          "argsIgnorePattern": "^_",
-        }
-      ],
       "func-style": "off",
     },
   },

init/action.yml

@@ -165,6 +165,6 @@ outputs:
   codeql-version:
     description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
+  using: node20
   main: '../lib/init-action.js'
   post: '../lib/init-action-post.js'

justfile

@@ -22,7 +22,7 @@ test: build
 
 # Run the tests for a single file
 test_file filename: build
-    npm run ava {{filename}}
+    npx ava --verbose {{filename}}
 
 [doc("Refresh the .js build artefacts in the lib directory")]
 [confirm]

lib/analyze-action-post.js

@@ -26438,17 +26438,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -26464,7 +26463,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -26491,7 +26490,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -26504,7 +26503,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -28542,7 +28541,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -67283,7 +67282,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -72092,18 +72091,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72122,10 +72114,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72142,8 +72130,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72249,18 +72235,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72279,10 +72258,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72299,8 +72274,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73064,7 +73037,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core14 = __importStar4(require_core());
     var path6 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -73072,6 +73045,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants7();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -73089,14 +73063,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError2;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73368,6 +73334,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core14.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core14.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73379,10 +73348,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core14.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -73399,9 +73365,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -73411,8 +73374,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError2.name) {
             core14.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core14.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core14.error(`Failed to save: ${typedError.message}`);
@@ -117115,6 +117076,9 @@ function getCachedCodeQlVersion() {
 async function codeQlVersionAtLeast(codeql, requiredVersion) {
   return semver.gte((await codeql.getVersion()).version, requiredVersion);
 }
+function isInTestMode() {
+  return process.env["CODEQL_ACTION_TEST_MODE" /* TEST_MODE */] === "true";
+}
 function wrapError(error2) {
   return error2 instanceof Error ? error2 : new Error(String(error2));
 }
@@ -117234,6 +117198,9 @@ var githubUtils = __toESM(require_utils4());
 var retry = __toESM(require_dist_node15());
 var import_console_log_level = __toESM(require_console_log_level());
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -117241,7 +117208,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -117733,7 +117701,7 @@ function withGroup(groupName, f) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -117961,11 +117929,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -118671,7 +118634,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion
       if (fs5.existsSync(baseTempDir)) {
         const outputDirs = fs5.readdirSync(baseTempDir);
         for (const outputDir of outputDirs) {
-          const sarifFiles = fs5.readdirSync(path5.resolve(baseTempDir, outputDir)).filter((f) => path5.extname(f) === ".sarif");
+          const sarifFiles = fs5.readdirSync(path5.resolve(baseTempDir, outputDir)).filter((f) => f.endsWith(".sarif"));
           for (const sarifFile of sarifFiles) {
             toUpload.push(path5.resolve(baseTempDir, outputDir, sarifFile));
           }

lib/analyze-action.js

@@ -28149,11 +28149,11 @@ var require_out = __commonJS({
       async.read(path20, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports2.stat = stat;
-    function statSync4(path20, optionsOrSettings) {
+    function statSync3(path20, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path20, settings);
     }
-    exports2.statSync = statSync4;
+    exports2.statSync = statSync3;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -32287,17 +32287,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -32313,7 +32312,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -32340,7 +32339,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -32353,7 +32352,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -34391,7 +34390,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -73132,7 +73131,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -77941,18 +77940,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77971,10 +77963,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -77991,8 +77979,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78098,18 +78084,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78128,10 +78107,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -78148,8 +78123,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78913,7 +78886,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core15 = __importStar4(require_core());
     var path20 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -78921,6 +78894,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants10();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -78938,14 +78912,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError2;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79217,6 +79183,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core15.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core15.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79228,10 +79197,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core15.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -79248,9 +79214,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core15.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -79260,8 +79223,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError2.name) {
             core15.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core15.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core15.error(`Failed to save: ${typedError.message}`);
@@ -90167,7 +90128,6 @@ var CodeScanning = {
   target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
   sarifExtension: ".sarif",
   sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
-  fixCategory: (_, category) => category,
   sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
 };
 var CodeQuality = {
@@ -90176,7 +90136,6 @@ var CodeQuality = {
   target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
   sarifExtension: ".quality.sarif",
   sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
-  fixCategory: fixCodeQualityCategory,
   sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
 };
 
@@ -90218,6 +90177,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -90225,7 +90187,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -90239,14 +90202,6 @@ function getApiDetails() {
 function getApiClient() {
   return createApiClientWithDetails(getApiDetails());
 }
-function getAuthorizationHeaderFor(logger, apiDetails, url2) {
-  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug(`Providing an authorization token.`);
-    return `token ${apiDetails.auth}`;
-  }
-  logger.debug(`Not using an authorization token.`);
-  return void 0;
-}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
   if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -90636,8 +90591,8 @@ var path8 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.2";
-var cliVersion = "2.23.2";
+var bundleVersion = "codeql-bundle-v2.23.0";
+var cliVersion = "2.23.0";
 
 // src/overlay-database-utils.ts
 var crypto = __toESM(require("crypto"));
@@ -90868,7 +90823,7 @@ function formatDuration(durationMs) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -91205,11 +91160,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -92268,6 +92218,17 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       toolsVersion: "local"
     };
   }
+  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
+  if (forceShippedTools) {
+    logger.info(
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+    );
+    if (toolsInput === "latest") {
+      logger.warning(
+        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
+      );
+    }
+  }
   let cliVersion2;
   let tagName;
   let url2;
@@ -92277,18 +92238,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
     );
     toolsInput = await getNightlyToolsUrl(logger);
   }
-  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
   if (forceShippedTools) {
     cliVersion2 = cliVersion;
     tagName = bundleVersion;
-    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
-    );
-    if (toolsInput === "latest") {
-      logger.warning(
-        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
-      );
-    }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
     url2 = toolsInput;
@@ -92438,12 +92390,11 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
   let authorization = void 0;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
+  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug("Providing an authorization token to download CodeQL tools.");
+    authorization = `token ${apiDetails.auth}`;
   } else {
-    authorization = getAuthorizationHeaderFor(
-      logger,
-      apiDetails,
-      codeqlURL
-    );
+    logger.debug("Downloading CodeQL tools without an authorization token.");
   }
   const toolcacheInfo = getToolcacheDestinationInfo(
     maybeBundleVersion,
@@ -93340,7 +93291,6 @@ async function makeGlobber(patterns) {
   return glob.create(patterns.join("\n"));
 }
 async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
-  const status = [];
   for (const language of config.languages) {
     const cacheConfig = getDefaultCacheConfig()[language];
     if (cacheConfig === void 0) {
@@ -93351,7 +93301,6 @@ async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
     }
     const globber = await makeGlobber(cacheConfig.hash);
     if ((await globber.glob()).length === 0) {
-      status.push({ language, result: "no-hash" /* NoHash */ });
       logger.info(
         `Skipping upload of dependency cache for ${language} as we cannot calculate a hash for the cache key.`
       );
@@ -93359,7 +93308,6 @@ async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
     }
     const size = await getTotalCacheSize(cacheConfig.paths, logger, true);
     if (size === 0) {
-      status.push({ language, result: "empty" /* Empty */ });
       logger.info(
         `Skipping upload of dependency cache for ${language} since it is empty.`
       );
@@ -93370,28 +93318,18 @@ async function uploadDependencyCaches(config, logger, minimizeJavaJars) {
       `Uploading cache of size ${size} for ${language} with key ${key}...`
     );
     try {
-      const start = performance.now();
       await actionsCache3.saveCache(cacheConfig.paths, key);
-      const upload_duration_ms = Math.round(performance.now() - start);
-      status.push({
-        language,
-        result: "stored" /* Stored */,
-        upload_size_bytes: Math.round(size),
-        upload_duration_ms
-      });
     } catch (error2) {
       if (error2 instanceof actionsCache3.ReserveCacheError) {
         logger.info(
           `Not uploading cache for ${language}, because ${key} is already in use.`
         );
         logger.debug(error2.message);
-        status.push({ language, result: "duplicate" /* Duplicate */ });
       } else {
         throw error2;
       }
     }
   }
-  return status;
 }
 async function cacheKey2(language, cacheConfig, minimizeJavaJars = false) {
   const hash2 = await glob.hashFiles(cacheConfig.hash.join("\n"));
@@ -93841,7 +93779,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
     logger.info(`Interpreting ${analysis.name} results for ${language}`);
     let category = automationDetailsId;
     if (analysis.kind === "code-quality" /* CodeQuality */) {
-      category = analysis.fixCategory(logger, automationDetailsId);
+      category = fixCodeQualityCategory(logger, automationDetailsId);
     }
     const sarifFile = path16.join(
       sarifFolder,
@@ -94123,9 +94061,6 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
     logger.warning(
       `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
     );
-    if (isInTestMode()) {
-      throw e;
-    }
     return void 0;
   }
 }
@@ -95717,7 +95652,6 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
   const gitHubVersion = await getGitHubVersion();
   let sarif;
-  category = uploadTarget.fixCategory(logger, category);
   if (sarifPaths.length > 1) {
     for (const sarifPath of sarifPaths) {
       const parsedSarif = readSarifFile(sarifPath);
@@ -95960,7 +95894,7 @@ function filterAlertsByDiffRange(logger, sarif) {
 }
 
 // src/analyze-action.ts
-async function sendStatusReport2(startedAt, config, stats, error2, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, trapCacheCleanup, dependencyCacheResults, logger) {
+async function sendStatusReport2(startedAt, config, stats, error2, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, trapCacheCleanup, logger) {
   const status = getActionsStatus(error2, stats?.analyze_failure_language);
   const statusReportBase = await createStatusReportBase(
     "finish" /* Analyze */,
@@ -95977,8 +95911,7 @@ async function sendStatusReport2(startedAt, config, stats, error2, trapCacheUplo
       ...statusReportBase,
       ...stats || {},
       ...dbCreationTimings || {},
-      ...trapCacheCleanup || {},
-      dependency_caching_upload_results: dependencyCacheResults
+      ...trapCacheCleanup || {}
     };
     if (config && didUploadTrapCaches) {
       const trapCacheUploadStatusReport = {
@@ -96059,7 +95992,6 @@ async function run() {
   let trapCacheUploadTime = void 0;
   let dbCreationTimings = void 0;
   let didUploadTrapCaches = false;
-  let dependencyCacheResults;
   initializeEnvironment(getActionVersion());
   persistInputs();
   const logger = getActionsLogger();
@@ -96167,14 +96099,16 @@ async function run() {
         core14.setOutput("sarif-id", uploadResult.sarifID);
       }
       if (isCodeQualityEnabled(config)) {
-        const analysis = CodeQuality;
         const qualityUploadResult = await uploadFiles(
           outputDir,
           getRequiredInput("checkout_path"),
-          getOptionalInput("category"),
+          fixCodeQualityCategory(
+            logger,
+            getOptionalInput("category")
+          ),
           features,
           logger,
-          analysis
+          CodeQuality
         );
         core14.setOutput("quality-sarif-id", qualityUploadResult.sarifID);
       }
@@ -96196,11 +96130,7 @@ async function run() {
         "java_minimize_dependency_jars" /* JavaMinimizeDependencyJars */,
         codeql
       );
-      dependencyCacheResults = await uploadDependencyCaches(
-        config,
-        logger,
-        minimizeJavaJars
-      );
+      await uploadDependencyCaches(config, logger, minimizeJavaJars);
     }
     if (isInTestMode()) {
       logger.debug("In test mode. Waiting for processing is disabled.");
@@ -96231,7 +96161,6 @@ async function run() {
       dbCreationTimings,
       didUploadTrapCaches,
       trapCacheCleanupTelemetry,
-      dependencyCacheResults,
       logger
     );
     return;
@@ -96249,7 +96178,6 @@ async function run() {
       dbCreationTimings,
       didUploadTrapCaches,
       trapCacheCleanupTelemetry,
-      dependencyCacheResults,
       logger
     );
   } else if (runStats) {
@@ -96262,7 +96190,6 @@ async function run() {
       dbCreationTimings,
       didUploadTrapCaches,
       trapCacheCleanupTelemetry,
-      dependencyCacheResults,
       logger
     );
   } else {
@@ -96275,7 +96202,6 @@ async function run() {
       dbCreationTimings,
       didUploadTrapCaches,
       trapCacheCleanupTelemetry,
-      dependencyCacheResults,
       logger
     );
   }

lib/autobuild-action.js

@@ -26438,17 +26438,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -26464,7 +26463,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -26491,7 +26490,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -26504,7 +26503,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -28542,7 +28541,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -67283,7 +67282,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -72092,18 +72091,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72122,10 +72114,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72142,8 +72130,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72249,18 +72235,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72279,10 +72258,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72299,8 +72274,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73064,7 +73037,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core14 = __importStar4(require_core());
     var path7 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -73072,6 +73045,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants7();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -73089,14 +73063,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73368,6 +73334,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core14.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core14.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73379,10 +73348,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core14.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -73399,9 +73365,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -73411,8 +73374,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError.name) {
             core14.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core14.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core14.error(`Failed to save: ${typedError.message}`);
@@ -77941,6 +77902,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -77948,7 +77912,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -78295,8 +78260,8 @@ var path3 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.2";
-var cliVersion = "2.23.2";
+var bundleVersion = "codeql-bundle-v2.23.0";
+var cliVersion = "2.23.0";
 
 // src/overlay-database-utils.ts
 var fs2 = __toESM(require("fs"));
@@ -78473,7 +78438,7 @@ function getActionsLogger() {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -78699,11 +78664,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -79872,9 +79832,6 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
     logger.warning(
       `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
     );
-    if (isInTestMode()) {
-      throw e;
-    }
     return void 0;
   }
 }

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.23.2",
-  "cliVersion": "2.23.2",
-  "priorBundleVersion": "codeql-bundle-v2.23.1",
-  "priorCliVersion": "2.23.1"
+  "bundleVersion": "codeql-bundle-v2.23.0",
+  "cliVersion": "2.23.0",
+  "priorBundleVersion": "codeql-bundle-v2.22.4",
+  "priorCliVersion": "2.22.4"
 }

lib/init-action-post.js

@@ -28149,11 +28149,11 @@ var require_out = __commonJS({
       async.read(path19, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports2.stat = stat;
-    function statSync3(path19, optionsOrSettings) {
+    function statSync2(path19, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path19, settings);
     }
-    exports2.statSync = statSync3;
+    exports2.statSync = statSync2;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -32287,17 +32287,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -32313,7 +32312,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -32340,7 +32339,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -32353,7 +32352,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -34391,7 +34390,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -73132,7 +73131,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -77941,18 +77940,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77971,10 +77963,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -77991,8 +77979,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78098,18 +78084,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78128,10 +78107,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -78148,8 +78123,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78913,7 +78886,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core18 = __importStar4(require_core());
     var path19 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -78921,6 +78894,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants10();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -78938,14 +78912,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError2;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79217,6 +79183,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core18.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core18.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79228,10 +79197,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core18.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -79248,9 +79214,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core18.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -79260,8 +79223,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError2.name) {
             core18.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core18.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core18.error(`Failed to save: ${typedError.message}`);
@@ -128337,9 +128298,6 @@ function getWorkflowRunAttempt() {
 function isSelfHostedRunner() {
   return process.env.RUNNER_ENVIRONMENT === "self-hosted";
 }
-function isDefaultSetup() {
-  return getWorkflowEventName() === "dynamic";
-}
 function prettyPrintInvocation(cmd, args) {
   return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
 }
@@ -128405,30 +128363,6 @@ var restoreInputs = function() {
     }
   }
 };
-var qualityCategoryMapping = {
-  "c#": "csharp",
-  cpp: "c-cpp",
-  c: "c-cpp",
-  "c++": "c-cpp",
-  java: "java-kotlin",
-  javascript: "javascript-typescript",
-  typescript: "javascript-typescript",
-  kotlin: "java-kotlin"
-};
-function fixCodeQualityCategory(logger, category) {
-  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
-    const language = category.substring("/language:".length);
-    const mappedLanguage = qualityCategoryMapping[language];
-    if (mappedLanguage) {
-      const newCategory = `/language:${mappedLanguage}`;
-      logger.info(
-        `Adjusted category for Code Quality from '${category}' to '${newCategory}'.`
-      );
-      return newCategory;
-    }
-  }
-  return category;
-}
 
 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -128462,6 +128396,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -128469,7 +128406,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -128483,14 +128421,6 @@ function getApiDetails() {
 function getApiClient() {
   return createApiClientWithDetails(getApiDetails());
 }
-function getAuthorizationHeaderFor(logger, apiDetails, url2) {
-  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug(`Providing an authorization token.`);
-    return `token ${apiDetails.auth}`;
-  }
-  logger.debug(`Not using an authorization token.`);
-  return void 0;
-}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
   if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -128561,18 +128491,6 @@ function computeAutomationID(analysis_key, environment) {
   }
   return automationID;
 }
-async function listActionsCaches(key, ref) {
-  const repositoryNwo = getRepositoryNwo();
-  return await getApiClient().paginate(
-    "GET /repos/{owner}/{repo}/actions/caches",
-    {
-      owner: repositoryNwo.owner,
-      repo: repositoryNwo.repo,
-      key,
-      ref
-    }
-  );
-}
 function wrapApiConfigurationError(e) {
   if (isHTTPError(e)) {
     if (e.message.includes("API rate limit exceeded for installation") || e.message.includes("commit not found") || e.message.includes("Resource not accessible by integration") || /ref .* not found in this repository/.test(e.message)) {
@@ -128586,9 +128504,6 @@ function wrapApiConfigurationError(e) {
   return e;
 }
 
-// src/caching-utils.ts
-var core6 = __toESM(require_core());
-
 // src/codeql.ts
 var fs13 = __toESM(require("fs"));
 var path13 = __toESM(require("path"));
@@ -128849,7 +128764,6 @@ var CodeScanning = {
   target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
   sarifExtension: ".sarif",
   sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
-  fixCategory: (_2, category) => category,
   sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
 };
 var CodeQuality = {
@@ -128858,10 +128772,12 @@ var CodeQuality = {
   target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
   sarifExtension: ".quality.sarif",
   sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
-  fixCategory: fixCodeQualityCategory,
   sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
 };
 
+// src/caching-utils.ts
+var core6 = __toESM(require_core());
+
 // src/config/db-config.ts
 var semver2 = __toESM(require_semver2());
 var PACK_IDENTIFIER_PATTERN = (function() {
@@ -128881,8 +128797,8 @@ var path8 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.2";
-var cliVersion = "2.23.2";
+var bundleVersion = "codeql-bundle-v2.23.0";
+var cliVersion = "2.23.0";
 
 // src/overlay-database-utils.ts
 var fs6 = __toESM(require("fs"));
@@ -129112,7 +129028,7 @@ function formatDuration(durationMs) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -129343,11 +129259,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -130250,6 +130161,17 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       toolsVersion: "local"
     };
   }
+  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
+  if (forceShippedTools) {
+    logger.info(
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+    );
+    if (toolsInput === "latest") {
+      logger.warning(
+        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
+      );
+    }
+  }
   let cliVersion2;
   let tagName;
   let url2;
@@ -130259,18 +130181,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
     );
     toolsInput = await getNightlyToolsUrl(logger);
   }
-  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
   if (forceShippedTools) {
     cliVersion2 = cliVersion;
     tagName = bundleVersion;
-    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
-    );
-    if (toolsInput === "latest") {
-      logger.warning(
-        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
-      );
-    }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
     url2 = toolsInput;
@@ -130420,12 +130333,11 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
   let authorization = void 0;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
+  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug("Providing an authorization token to download CodeQL tools.");
+    authorization = `token ${apiDetails.auth}`;
   } else {
-    authorization = getAuthorizationHeaderFor(
-      logger,
-      apiDetails,
-      codeqlURL
-    );
+    logger.debug("Downloading CodeQL tools without an authorization token.");
   }
   const toolcacheInfo = getToolcacheDestinationInfo(
     maybeBundleVersion,
@@ -131210,22 +131122,6 @@ var core11 = __toESM(require_core());
 // src/dependency-caching.ts
 var actionsCache3 = __toESM(require_cache3());
 var glob = __toESM(require_glob3());
-var CODEQL_DEPENDENCY_CACHE_PREFIX = "codeql-dependencies";
-async function getDependencyCacheUsage(logger) {
-  try {
-    const caches = await listActionsCaches(CODEQL_DEPENDENCY_CACHE_PREFIX);
-    const totalSize = caches.reduce(
-      (acc, cache) => acc + (cache.size_in_bytes ?? 0),
-      0
-    );
-    return { count: caches.length, size_bytes: totalSize };
-  } catch (err) {
-    logger.warning(
-      `Unable to retrieve information about dependency cache usage: ${getErrorMessage(err)}`
-    );
-  }
-  return void 0;
-}
 
 // src/analyze.ts
 function dbIsFinalized(config, language, logger) {
@@ -131599,9 +131495,6 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
     logger.warning(
       `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
     );
-    if (isInTestMode()) {
-      throw e;
-    }
     return void 0;
   }
 }
@@ -133193,7 +133086,6 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
   const gitHubVersion = await getGitHubVersion();
   let sarif;
-  category = uploadTarget.fixCategory(logger, category);
   if (sarifPaths.length > 1) {
     for (const sarifPath of sarifPaths) {
       const parsedSarif = readSarifFile(sarifPath);
@@ -133779,7 +133671,6 @@ async function runWrapper() {
   const startedAt = /* @__PURE__ */ new Date();
   let config;
   let uploadFailedSarifResult;
-  let dependencyCachingUsage;
   try {
     restoreInputs();
     const gitHubVersion = await getGitHubVersion();
@@ -133807,9 +133698,6 @@ async function runWrapper() {
         features,
         logger
       );
-      if (await isAnalyzingDefaultBranch() && config.dependencyCachingEnabled !== "none" /* None */) {
-        dependencyCachingUsage = await getDependencyCacheUsage(logger);
-      }
     }
   } catch (unwrappedError) {
     const error2 = wrapError(unwrappedError);
@@ -133843,8 +133731,7 @@ async function runWrapper() {
     const statusReport = {
       ...statusReportBase,
       ...uploadFailedSarifResult,
-      job_status: getFinalJobStatus(),
-      dependency_caching_usage: dependencyCachingUsage
+      job_status: getFinalJobStatus()
     };
     logger.info("Sending status report for init-post step.");
     await sendStatusReport(statusReport);

lib/init-action.js

@@ -32287,17 +32287,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -32313,7 +32312,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -32340,7 +32339,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -32353,7 +32352,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -34391,7 +34390,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -73132,7 +73131,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -77941,18 +77940,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77971,10 +77963,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -77991,8 +77979,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78098,18 +78084,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78128,10 +78107,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -78148,8 +78123,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78913,7 +78886,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core14 = __importStar4(require_core());
     var path20 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -78921,6 +78894,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants10();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -78938,14 +78912,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError2;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79217,6 +79183,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core14.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core14.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79228,10 +79197,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core14.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -79248,9 +79214,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -79260,8 +79223,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError2.name) {
             core14.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core14.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core14.error(`Failed to save: ${typedError.message}`);
@@ -86068,6 +86029,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -86075,7 +86039,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -86092,14 +86057,6 @@ function getApiClient() {
 function getApiClientWithExternalAuth(apiDetails) {
   return createApiClientWithDetails(apiDetails, { allowExternal: true });
 }
-function getAuthorizationHeaderFor(logger, apiDetails, url) {
-  if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug(`Providing an authorization token.`);
-    return `token ${apiDetails.auth}`;
-  }
-  logger.debug(`Not using an authorization token.`);
-  return void 0;
-}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
   if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -86175,12 +86132,6 @@ function computeAutomationID(analysis_key, environment) {
   }
   return automationID;
 }
-async function getRepositoryProperties(repositoryNwo) {
-  return getApiClient().request("GET /repos/:owner/:repo/properties/values", {
-    owner: repositoryNwo.owner,
-    repo: repositoryNwo.repo
-  });
-}
 
 // src/caching-utils.ts
 var core6 = __toESM(require_core());
@@ -86276,9 +86227,6 @@ function getConfigFileFormatInvalidMessage(configFile) {
 function getConfigFileDirectoryGivenMessage(configFile) {
   return `The configuration file "${configFile}" looks like a directory, not a file`;
 }
-function getEmptyCombinesError() {
-  return `A '+' was used to specify that you want to add extra arguments to the configuration, but no extra arguments were specified. Please either remove the '+' or specify some extra arguments.`;
-}
 function getConfigFilePropertyError(configFile, property, error2) {
   if (configFile === void 0) {
     return `The workflow property "${property}" is invalid: ${error2}`;
@@ -86286,9 +86234,6 @@ function getConfigFilePropertyError(configFile, property, error2) {
     return `The configuration file "${configFile}" is invalid: property "${property}" ${error2}`;
   }
 }
-function getRepoPropertyError(propertyName, error2) {
-  return `The repository property "${propertyName}" is invalid: ${error2}`;
-}
 function getPacksStrInvalid(packStr, configFile) {
   return configFile ? getConfigFilePropertyError(
     configFile,
@@ -86303,52 +86248,6 @@ function getUnknownLanguagesError(languages) {
   return `Did not recognize the following languages: ${languages.join(", ")}`;
 }
 
-// src/feature-flags/properties.ts
-var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
-  RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
-  return RepositoryPropertyName2;
-})(RepositoryPropertyName || {});
-async function loadPropertiesFromApi(gitHubVersion, logger, repositoryNwo) {
-  if (gitHubVersion.type === 1 /* GHES */) {
-    return {};
-  }
-  try {
-    const response = await getRepositoryProperties(repositoryNwo);
-    const remoteProperties = response.data;
-    if (!Array.isArray(remoteProperties)) {
-      throw new Error(
-        `Expected repository properties API to return an array, but got: ${JSON.stringify(response.data)}`
-      );
-    }
-    logger.debug(
-      `Retrieved ${remoteProperties.length} repository properties: ${remoteProperties.map((p) => p.property_name).join(", ")}`
-    );
-    const knownProperties = new Set(Object.values(RepositoryPropertyName));
-    const properties = {};
-    for (const property of remoteProperties) {
-      if (property.property_name === void 0) {
-        throw new Error(
-          `Expected property object to have a 'property_name', but got: ${JSON.stringify(property)}`
-        );
-      }
-      if (knownProperties.has(property.property_name)) {
-        properties[property.property_name] = property.value;
-      }
-    }
-    logger.debug("Loaded the following values for the repository properties:");
-    for (const [property, value] of Object.entries(properties).sort(
-      ([nameA], [nameB]) => nameA.localeCompare(nameB)
-    )) {
-      logger.debug(`  ${property}: ${value}`);
-    }
-    return properties;
-  } catch (e) {
-    throw new Error(
-      `Encountered an error while trying to determine repository properties: ${e}`
-    );
-  }
-}
-
 // src/config/db-config.ts
 function shouldCombine(inputValue) {
   return !!inputValue?.trim().startsWith("+");
@@ -86441,7 +86340,7 @@ function parsePacksFromInput(rawPacksInput, languages, packsInputCombines) {
     }, [])
   };
 }
-async function calculateAugmentation(rawPacksInput, rawQueriesInput, repositoryProperties, languages) {
+async function calculateAugmentation(rawPacksInput, rawQueriesInput, languages) {
   const packsInputCombines = shouldCombine(rawPacksInput);
   const packsInput = parsePacksFromInput(
     rawPacksInput,
@@ -86453,38 +86352,19 @@ async function calculateAugmentation(rawPacksInput, rawQueriesInput, repositoryP
     rawQueriesInput,
     queriesInputCombines
   );
-  const repoExtraQueries = repositoryProperties["github-codeql-extra-queries" /* EXTRA_QUERIES */];
-  const repoExtraQueriesCombines = shouldCombine(repoExtraQueries);
-  const repoPropertyQueries = {
-    combines: repoExtraQueriesCombines,
-    input: parseQueriesFromInput(
-      repoExtraQueries,
-      repoExtraQueriesCombines,
-      new ConfigurationError(
-        getRepoPropertyError(
-          "github-codeql-extra-queries" /* EXTRA_QUERIES */,
-          getEmptyCombinesError()
-        )
-      )
-    )
-  };
   return {
     packsInputCombines,
     packsInput: packsInput?.[languages[0]],
     queriesInput,
-    queriesInputCombines,
-    repoPropertyQueries
+    queriesInputCombines
   };
 }
-function parseQueriesFromInput(rawQueriesInput, queriesInputCombines, errorToThrow) {
+function parseQueriesFromInput(rawQueriesInput, queriesInputCombines) {
   if (!rawQueriesInput) {
     return void 0;
   }
   const trimmedInput = queriesInputCombines ? rawQueriesInput.trim().slice(1).trim() : rawQueriesInput?.trim() ?? "";
   if (queriesInputCombines && trimmedInput.length === 0) {
-    if (errorToThrow) {
-      throw errorToThrow;
-    }
     throw new ConfigurationError(
       getConfigFilePropertyError(
         void 0,
@@ -86495,43 +86375,17 @@ function parseQueriesFromInput(rawQueriesInput, queriesInputCombines, errorToThr
   }
   return trimmedInput.split(",").map((query) => ({ uses: query.trim() }));
 }
-function combineQueries(logger, config, augmentationProperties) {
-  const result = [];
-  if (augmentationProperties.repoPropertyQueries && augmentationProperties.repoPropertyQueries.input) {
-    logger.info(
-      `Found query configuration in the repository properties (${"github-codeql-extra-queries" /* EXTRA_QUERIES */}): ${augmentationProperties.repoPropertyQueries.input.map((q) => q.uses).join(", ")}`
-    );
-    if (!augmentationProperties.repoPropertyQueries.combines) {
-      logger.info(
-        `The queries configured in the repository properties don't allow combining with other query settings. Any queries configured elsewhere will be ignored.`
-      );
-      return augmentationProperties.repoPropertyQueries.input;
-    } else {
-      result.push(...augmentationProperties.repoPropertyQueries.input);
-    }
-  }
-  if (augmentationProperties.queriesInput) {
-    if (!augmentationProperties.queriesInputCombines) {
-      return result.concat(augmentationProperties.queriesInput);
-    } else {
-      result.push(...augmentationProperties.queriesInput);
-    }
-  }
-  if (config.queries) {
-    result.push(...config.queries);
-  }
-  return result;
-}
-function generateCodeScanningConfig(logger, originalUserInput, augmentationProperties) {
+function generateCodeScanningConfig(originalUserInput, augmentationProperties) {
   const augmentedConfig = cloneObject(originalUserInput);
-  augmentedConfig.queries = combineQueries(
-    logger,
-    augmentedConfig,
-    augmentationProperties
-  );
-  logger.debug(
-    `Combined queries: ${augmentedConfig.queries?.map((q) => q.uses).join(",")}`
-  );
+  if (augmentationProperties.queriesInput) {
+    if (augmentationProperties.queriesInputCombines) {
+      augmentedConfig.queries = (augmentedConfig.queries || []).concat(
+        augmentationProperties.queriesInput
+      );
+    } else {
+      augmentedConfig.queries = augmentationProperties.queriesInput;
+    }
+  }
   if (augmentedConfig.queries?.length === 0) {
     delete augmentedConfig.queries;
   }
@@ -86563,8 +86417,8 @@ var path9 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.2";
-var cliVersion = "2.23.2";
+var bundleVersion = "codeql-bundle-v2.23.0";
+var cliVersion = "2.23.0";
 
 // src/overlay-database-utils.ts
 var crypto = __toESM(require("crypto"));
@@ -86773,7 +86627,7 @@ function formatDuration(durationMs) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -87133,11 +86987,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -87678,7 +87527,6 @@ async function initActionState({
   sourceRoot,
   githubVersion,
   features,
-  repositoryProperties,
   logger
 }, userConfig) {
   const analysisKinds = await parseAnalysisKinds(analysisKindsInput);
@@ -87702,18 +87550,8 @@ async function initActionState({
   const augmentationProperties = await calculateAugmentation(
     packsInput,
     queriesInput,
-    repositoryProperties,
     languages
   );
-  if (analysisKinds.length === 1 && analysisKinds.includes("code-quality" /* CodeQuality */) && augmentationProperties.repoPropertyQueries.input) {
-    logger.info(
-      `Ignoring queries configured in the repository properties, because query customisations are not supported for Code Quality analyses.`
-    );
-    augmentationProperties.repoPropertyQueries = {
-      combines: false,
-      input: void 0
-    };
-  }
   const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(
     trapCachingEnabled,
     codeql,
@@ -87721,7 +87559,6 @@ async function initActionState({
     logger
   );
   const computedConfig = generateCodeScanningConfig(
-    logger,
     userConfig,
     augmentationProperties
   );
@@ -87744,8 +87581,7 @@ async function initActionState({
     dependencyCachingEnabled: getCachingKind(dependencyCachingEnabled),
     extraQueryExclusions: [],
     overlayDatabaseMode: "none" /* None */,
-    useOverlayDatabaseCaching: false,
-    repositoryProperties
+    useOverlayDatabaseCaching: false
   };
 }
 async function downloadCacheWithTime(trapCachingEnabled, codeQL, languages, logger) {
@@ -88184,7 +88020,7 @@ async function makeGlobber(patterns) {
   return glob.create(patterns.join("\n"));
 }
 async function downloadDependencyCaches(languages, logger, minimizeJavaJars) {
-  const status = [];
+  const restoredCaches = [];
   for (const language of languages) {
     const cacheConfig = getDefaultCacheConfig()[language];
     if (cacheConfig === void 0) {
@@ -88195,7 +88031,6 @@ async function downloadDependencyCaches(languages, logger, minimizeJavaJars) {
     }
     const globber = await makeGlobber(cacheConfig.hash);
     if ((await globber.glob()).length === 0) {
-      status.push({ language, hit_kind: "no-hash" /* NoHash */ });
       logger.info(
         `Skipping download of dependency cache for ${language} as we cannot calculate a hash for the cache key.`
       );
@@ -88210,23 +88045,19 @@ async function downloadDependencyCaches(languages, logger, minimizeJavaJars) {
         ", "
       )}`
     );
-    const start = performance.now();
     const hitKey = await actionsCache3.restoreCache(
       cacheConfig.paths,
       primaryKey,
       restoreKeys
     );
-    const download_duration_ms = Math.round(performance.now() - start);
     if (hitKey !== void 0) {
       logger.info(`Cache hit on key ${hitKey} for ${language}.`);
-      const hit_kind = hitKey === primaryKey ? "exact" /* Exact */ : "partial" /* Partial */;
-      status.push({ language, hit_kind, download_duration_ms });
+      restoredCaches.push(language);
     } else {
-      status.push({ language, hit_kind: "miss" /* Miss */ });
       logger.info(`No suitable cache found for ${language}.`);
     }
   }
-  return status;
+  return restoredCaches;
 }
 async function cacheKey2(language, cacheConfig, minimizeJavaJars = false) {
   const hash = await glob.hashFiles(cacheConfig.hash.join("\n"));
@@ -89043,6 +88874,17 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       toolsVersion: "local"
     };
   }
+  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
+  if (forceShippedTools) {
+    logger.info(
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+    );
+    if (toolsInput === "latest") {
+      logger.warning(
+        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
+      );
+    }
+  }
   let cliVersion2;
   let tagName;
   let url;
@@ -89052,18 +88894,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
     );
     toolsInput = await getNightlyToolsUrl(logger);
   }
-  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
   if (forceShippedTools) {
     cliVersion2 = cliVersion;
     tagName = bundleVersion;
-    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
-    );
-    if (toolsInput === "latest") {
-      logger.warning(
-        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
-      );
-    }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
     url = toolsInput;
@@ -89213,12 +89046,11 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
   let authorization = void 0;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
+  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug("Providing an authorization token to download CodeQL tools.");
+    authorization = `token ${apiDetails.auth}`;
   } else {
-    authorization = getAuthorizationHeaderFor(
-      logger,
-      apiDetails,
-      codeqlURL
-    );
+    logger.debug("Downloading CodeQL tools without an authorization token.");
   }
   const toolcacheInfo = getToolcacheDestinationInfo(
     maybeBundleVersion,
@@ -90274,9 +90106,6 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
     logger.warning(
       `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
     );
-    if (isInTestMode()) {
-      throw e;
-    }
     return void 0;
   }
 }
@@ -90332,7 +90161,7 @@ async function sendStatusReport(statusReport) {
     );
   }
 }
-async function createInitWithConfigStatusReport(config, initStatusReport, configFile, totalCacheSize, overlayBaseDatabaseStats, dependencyCachingResults) {
+async function createInitWithConfigStatusReport(config, initStatusReport, configFile, totalCacheSize, overlayBaseDatabaseStats) {
   const languages = config.languages.join(",");
   const paths = (config.originalUserInput.paths || []).join(",");
   const pathsIgnore = (config.originalUserInput["paths-ignore"] || []).join(
@@ -90369,7 +90198,6 @@ async function createInitWithConfigStatusReport(config, initStatusReport, config
     trap_cache_download_duration_ms: Math.round(config.trapCacheDownloadTime),
     overlay_base_database_download_size_bytes: overlayBaseDatabaseStats?.databaseSizeBytes,
     overlay_base_database_download_duration_ms: overlayBaseDatabaseStats?.databaseDownloadDurationMs,
-    dependency_caching_restore_results: dependencyCachingResults,
     query_filters: JSON.stringify(
       config.originalUserInput["query-filters"] ?? []
     ),
@@ -90552,7 +90380,7 @@ async function getWorkflowAbsolutePath(logger) {
 }
 
 // src/init-action.ts
-async function sendCompletedStatusReport(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error2) {
+async function sendCompletedStatusReport(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, logger, error2) {
   const statusReportBase = await createStatusReportBase(
     "init" /* Init */,
     getActionsStatus(error2),
@@ -90589,8 +90417,7 @@ async function sendCompletedStatusReport(startedAt, config, configFile, toolsDow
       Math.round(
         await getTotalCacheSize(Object.values(config.trapCaches), logger)
       ),
-      overlayBaseDatabaseStats,
-      dependencyCachingResults
+      overlayBaseDatabaseStats
     );
     await sendStatusReport({
       ...initWithConfigStatusReport,
@@ -90628,10 +90455,6 @@ async function run() {
     getTemporaryDirectory(),
     logger
   );
-  const enableRepoProps = await features.getValue(
-    "use_repository_properties" /* UseRepositoryProperties */
-  );
-  const repositoryProperties = enableRepoProps ? await loadPropertiesFromApi(gitHubVersion, logger, repositoryNwo) : {};
   const jobRunUuid = v4_default();
   logger.info(`Job run UUID is ${jobRunUuid}.`);
   core13.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid);
@@ -90731,7 +90554,6 @@ async function run() {
       githubVersion: gitHubVersion,
       apiDetails,
       features,
-      repositoryProperties,
       logger
     });
     await checkInstallPython311(config.languages, codeql);
@@ -90754,7 +90576,6 @@ async function run() {
     return;
   }
   let overlayBaseDatabaseStats;
-  let dependencyCachingResults;
   try {
     if (config.overlayDatabaseMode === "overlay" /* Overlay */ && config.useOverlayDatabaseCaching) {
       overlayBaseDatabaseStats = await downloadOverlayBaseDatabaseFromCache(
@@ -90899,7 +90720,7 @@ exec ${goBinaryPath} "$@"`
       codeql
     );
     if (shouldRestoreCache(config.dependencyCachingEnabled)) {
-      dependencyCachingResults = await downloadDependencyCaches(
+      await downloadDependencyCaches(
         config.languages,
         logger,
         minimizeJavaJars
@@ -91004,7 +90825,6 @@ exec ${goBinaryPath} "$@"`
       toolsSource,
       toolsVersion,
       overlayBaseDatabaseStats,
-      dependencyCachingResults,
       logger,
       error2
     );
@@ -91022,7 +90842,6 @@ exec ${goBinaryPath} "$@"`
     toolsSource,
     toolsVersion,
     overlayBaseDatabaseStats,
-    dependencyCachingResults,
     logger
   );
 }

lib/resolve-environment-action.js

@@ -26438,17 +26438,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -26464,7 +26463,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -26491,7 +26490,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -26504,7 +26503,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -28542,7 +28541,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -67283,7 +67282,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -72092,18 +72091,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72122,10 +72114,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72142,8 +72130,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72249,18 +72235,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72279,10 +72258,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72299,8 +72274,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73064,7 +73037,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core13 = __importStar4(require_core());
     var path5 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -73072,6 +73045,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants7();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -73089,14 +73063,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73368,6 +73334,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core13.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core13.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73379,10 +73348,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core13.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -73399,9 +73365,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core13.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -73411,8 +73374,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError.name) {
             core13.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core13.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core13.error(`Failed to save: ${typedError.message}`);
@@ -77949,6 +77910,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -77956,7 +77920,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -78466,7 +78431,7 @@ function getActionsLogger() {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -78690,11 +78655,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -79499,9 +79459,6 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
     logger.warning(
       `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
     );
-    if (isInTestMode()) {
-      throw e;
-    }
     return void 0;
   }
 }

lib/start-proxy-action-post.js

@@ -26438,17 +26438,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -26464,7 +26463,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -26491,7 +26490,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -26504,7 +26503,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -28542,7 +28541,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -67283,7 +67282,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -72092,18 +72091,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72122,10 +72114,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72142,8 +72130,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -72249,18 +72235,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -72279,10 +72258,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -72299,8 +72274,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -73064,7 +73037,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core14 = __importStar4(require_core());
     var path2 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -73072,6 +73045,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants7();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -73089,14 +73063,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError2;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -73368,6 +73334,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core14.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core14.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -73379,10 +73348,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core14.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -73399,9 +73365,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -73411,8 +73374,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError2.name) {
             core14.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core14.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core14.error(`Failed to save: ${typedError.message}`);
@@ -117081,6 +117042,9 @@ var ConfigurationError = class extends Error {
     super(message);
   }
 };
+function isInTestMode() {
+  return process.env["CODEQL_ACTION_TEST_MODE" /* TEST_MODE */] === "true";
+}
 function getErrorMessage(error2) {
   return error2 instanceof Error ? error2.message : String(error2);
 }
@@ -117117,6 +117081,9 @@ var githubUtils = __toESM(require_utils4());
 var retry = __toESM(require_dist_node15());
 var import_console_log_level = __toESM(require_console_log_level());
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -117124,7 +117091,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -117205,7 +117173,7 @@ function getActionsLogger() {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
@@ -117370,11 +117338,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",

lib/upload-lib.js

@@ -29446,11 +29446,11 @@ var require_out = __commonJS({
       async.read(path15, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports2.stat = stat;
-    function statSync3(path15, optionsOrSettings) {
+    function statSync2(path15, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path15, settings);
     }
-    exports2.statSync = statSync3;
+    exports2.statSync = statSync2;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -33584,17 +33584,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -33610,7 +33609,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -33637,7 +33636,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -33650,7 +33649,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -35688,7 +35687,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -74429,7 +74428,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -79238,18 +79237,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -79268,10 +79260,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -79288,8 +79276,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -79395,18 +79381,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -79425,10 +79404,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -79445,8 +79420,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -80210,7 +80183,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core12 = __importStar4(require_core());
     var path15 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -80218,6 +80191,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants10();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -80235,14 +80209,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -80514,6 +80480,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core12.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core12.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -80525,10 +80494,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core12.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -80545,9 +80511,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core12.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -80557,8 +80520,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError.name) {
             core12.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core12.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core12.error(`Failed to save: ${typedError.message}`);
@@ -84821,7 +84782,6 @@ __export(upload_lib_exports, {
   InvalidSarifUploadError: () => InvalidSarifUploadError,
   buildPayload: () => buildPayload,
   findSarifFilesInDir: () => findSarifFilesInDir,
-  getGroupedSarifFilePaths: () => getGroupedSarifFilePaths,
   getSarifFilePaths: () => getSarifFilePaths,
   populateRunAutomationDetails: () => populateRunAutomationDetails,
   readSarifFile: () => readSarifFile,
@@ -88474,9 +88434,6 @@ function getWorkflowRunAttempt() {
   }
   return workflowRunAttempt;
 }
-function isDefaultSetup() {
-  return getWorkflowEventName() === "dynamic";
-}
 function prettyPrintInvocation(cmd, args) {
   return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
 }
@@ -88533,57 +88490,6 @@ async function runTool(cmd, args = [], opts = {}) {
   }
   return stdout;
 }
-var qualityCategoryMapping = {
-  "c#": "csharp",
-  cpp: "c-cpp",
-  c: "c-cpp",
-  "c++": "c-cpp",
-  java: "java-kotlin",
-  javascript: "javascript-typescript",
-  typescript: "javascript-typescript",
-  kotlin: "java-kotlin"
-};
-function fixCodeQualityCategory(logger, category) {
-  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
-    const language = category.substring("/language:".length);
-    const mappedLanguage = qualityCategoryMapping[language];
-    if (mappedLanguage) {
-      const newCategory = `/language:${mappedLanguage}`;
-      logger.info(
-        `Adjusted category for Code Quality from '${category}' to '${newCategory}'.`
-      );
-      return newCategory;
-    }
-  }
-  return category;
-}
-
-// src/analyses.ts
-var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
-  AnalysisKind2["CodeScanning"] = "code-scanning";
-  AnalysisKind2["CodeQuality"] = "code-quality";
-  return AnalysisKind2;
-})(AnalysisKind || {});
-var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
-var CodeScanning = {
-  kind: "code-scanning" /* CodeScanning */,
-  name: "code scanning",
-  target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
-  sarifExtension: ".sarif",
-  sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
-  fixCategory: (_, category) => category,
-  sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
-};
-var CodeQuality = {
-  kind: "code-quality" /* CodeQuality */,
-  name: "code quality",
-  target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
-  sarifExtension: ".quality.sarif",
-  sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
-  fixCategory: fixCodeQualityCategory,
-  sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
-};
-var SarifScanOrder = [CodeQuality, CodeScanning];
 
 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -88617,6 +88523,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -88624,7 +88533,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -88638,14 +88548,6 @@ function getApiDetails() {
 function getApiClient() {
   return createApiClientWithDetails(getApiDetails());
 }
-function getAuthorizationHeaderFor(logger, apiDetails, url2) {
-  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug(`Providing an authorization token.`);
-    return `token ${apiDetails.auth}`;
-  }
-  logger.debug(`Not using an authorization token.`);
-  return void 0;
-}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
   if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -88976,6 +88878,14 @@ function wrapCliConfigurationError(cliError) {
 var fs7 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
 
+// src/analyses.ts
+var AnalysisKind = /* @__PURE__ */ ((AnalysisKind2) => {
+  AnalysisKind2["CodeScanning"] = "code-scanning";
+  AnalysisKind2["CodeQuality"] = "code-quality";
+  return AnalysisKind2;
+})(AnalysisKind || {});
+var supportedAnalysisKinds = new Set(Object.values(AnalysisKind));
+
 // src/caching-utils.ts
 var core6 = __toESM(require_core());
 
@@ -88996,8 +88906,8 @@ var path8 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.2";
-var cliVersion = "2.23.2";
+var bundleVersion = "codeql-bundle-v2.23.0";
+var cliVersion = "2.23.0";
 
 // src/overlay-database-utils.ts
 var fs5 = __toESM(require("fs"));
@@ -89216,7 +89126,7 @@ function formatDuration(durationMs) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -89441,11 +89351,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -90084,6 +89989,17 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       toolsVersion: "local"
     };
   }
+  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
+  if (forceShippedTools) {
+    logger.info(
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+    );
+    if (toolsInput === "latest") {
+      logger.warning(
+        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
+      );
+    }
+  }
   let cliVersion2;
   let tagName;
   let url2;
@@ -90093,18 +90009,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
     );
     toolsInput = await getNightlyToolsUrl(logger);
   }
-  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
   if (forceShippedTools) {
     cliVersion2 = cliVersion;
     tagName = bundleVersion;
-    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
-    );
-    if (toolsInput === "latest") {
-      logger.warning(
-        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
-      );
-    }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
     url2 = toolsInput;
@@ -90254,12 +90161,11 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
   let authorization = void 0;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
+  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug("Providing an authorization token to download CodeQL tools.");
+    authorization = `token ${apiDetails.auth}`;
   } else {
-    authorization = getAuthorizationHeaderFor(
-      logger,
-      apiDetails,
-      codeqlURL
-    );
+    logger.debug("Downloading CodeQL tools without an authorization token.");
   }
   const toolcacheInfo = getToolcacheDestinationInfo(
     maybeBundleVersion,
@@ -92438,54 +92344,6 @@ function getSarifFilePaths(sarifPath, isSarif) {
   }
   return sarifFiles;
 }
-async function getGroupedSarifFilePaths(logger, sarifPath) {
-  const stats = fs13.statSync(sarifPath, { throwIfNoEntry: false });
-  if (stats === void 0) {
-    throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
-  }
-  const results = {};
-  if (stats.isDirectory()) {
-    let unassignedSarifFiles = findSarifFilesInDir(
-      sarifPath,
-      (name) => path14.extname(name) === ".sarif"
-    );
-    logger.debug(
-      `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}`
-    );
-    for (const analysisConfig of SarifScanOrder) {
-      const filesForCurrentAnalysis = unassignedSarifFiles.filter(
-        analysisConfig.sarifPredicate
-      );
-      if (filesForCurrentAnalysis.length > 0) {
-        logger.debug(
-          `The following SARIF files are for ${analysisConfig.name}: ${filesForCurrentAnalysis.join(", ")}`
-        );
-        unassignedSarifFiles = unassignedSarifFiles.filter(
-          (name) => !analysisConfig.sarifPredicate(name)
-        );
-        results[analysisConfig.kind] = filesForCurrentAnalysis;
-      } else {
-        logger.debug(`Found no SARIF files for ${analysisConfig.name}`);
-      }
-    }
-    if (unassignedSarifFiles.length !== 0) {
-      logger.warning(
-        `Found files in ${sarifPath} which do not belong to any analysis: ${unassignedSarifFiles.join(", ")}`
-      );
-    }
-  } else {
-    for (const analysisConfig of SarifScanOrder) {
-      if (analysisConfig.kind === "code-scanning" /* CodeScanning */ || analysisConfig.sarifPredicate(sarifPath)) {
-        logger.debug(
-          `Using '${sarifPath}' as a SARIF file for ${analysisConfig.name}.`
-        );
-        results[analysisConfig.kind] = [sarifPath];
-        break;
-      }
-    }
-  }
-  return results;
-}
 function countResultsInSarif(sarif) {
   let numResults = 0;
   const parsedSarif = JSON.parse(sarif);
@@ -92600,7 +92458,6 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
   const gitHubVersion = await getGitHubVersion();
   let sarif;
-  category = uploadTarget.fixCategory(logger, category);
   if (sarifPaths.length > 1) {
     for (const sarifPath of sarifPaths) {
       const parsedSarif = readSarifFile(sarifPath);
@@ -92846,7 +92703,6 @@ function filterAlertsByDiffRange(logger, sarif) {
   InvalidSarifUploadError,
   buildPayload,
   findSarifFilesInDir,
-  getGroupedSarifFilePaths,
   getSarifFilePaths,
   populateRunAutomationDetails,
   readSarifFile,

lib/upload-sarif-action-post.js

@@ -26438,17 +26438,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -26464,7 +26463,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -26491,7 +26490,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -26504,7 +26503,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -106366,7 +106365,7 @@ var require_brace_expansion3 = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -109985,7 +109984,7 @@ var require_package3 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -110568,18 +110567,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -110598,10 +110590,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -110618,8 +110606,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -110725,18 +110711,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -110755,10 +110734,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -110775,8 +110750,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -111540,7 +111513,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core14 = __importStar4(require_core());
     var path2 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -111548,6 +111521,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config2();
     var tar_1 = require_tar2();
+    var constants_1 = require_constants10();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -111565,14 +111539,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError2;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -111844,6 +111810,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core14.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core14.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -111855,10 +111824,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core14.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -111875,9 +111841,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -111887,8 +111850,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError2.name) {
             core14.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core14.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core14.error(`Failed to save: ${typedError.message}`);
@@ -117081,6 +117042,9 @@ var ConfigurationError = class extends Error {
     super(message);
   }
 };
+function isInTestMode() {
+  return process.env["CODEQL_ACTION_TEST_MODE" /* TEST_MODE */] === "true";
+}
 function getErrorMessage(error2) {
   return error2 instanceof Error ? error2.message : String(error2);
 }
@@ -117121,6 +117085,9 @@ var githubUtils = __toESM(require_utils4());
 var retry = __toESM(require_dist_node15());
 var import_console_log_level = __toESM(require_console_log_level());
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -117128,7 +117095,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -117364,7 +117332,7 @@ function withGroup(groupName, f) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 
@@ -117533,11 +117501,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -117619,7 +117582,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion
       if (fs.existsSync(baseTempDir)) {
         const outputDirs = fs.readdirSync(baseTempDir);
         for (const outputDir of outputDirs) {
-          const sarifFiles = fs.readdirSync(path.resolve(baseTempDir, outputDir)).filter((f) => path.extname(f) === ".sarif");
+          const sarifFiles = fs.readdirSync(path.resolve(baseTempDir, outputDir)).filter((f) => f.endsWith(".sarif"));
           for (const sarifFile of sarifFiles) {
             toUpload.push(path.resolve(baseTempDir, outputDir, sarifFile));
           }

lib/upload-sarif-action.js

@@ -185,7 +185,7 @@ var require_file_command = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.prepareKeyValueMessage = exports2.issueFileCommand = void 0;
     var crypto = __importStar4(require("crypto"));
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var os3 = __importStar4(require("os"));
     var utils_1 = require_utils();
     function issueFileCommand(command, message) {
@@ -193,10 +193,10 @@ var require_file_command = __commonJS({
       if (!filePath) {
         throw new Error(`Unable to find environment variable for file command ${command}`);
       }
-      if (!fs15.existsSync(filePath)) {
+      if (!fs16.existsSync(filePath)) {
         throw new Error(`Missing file at path: ${filePath}`);
       }
-      fs15.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os3.EOL}`, {
+      fs16.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os3.EOL}`, {
         encoding: "utf8"
       });
     }
@@ -18513,12 +18513,12 @@ var require_io_util = __commonJS({
     var _a;
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getCmdPath = exports2.tryGetExecutablePath = exports2.isRooted = exports2.isDirectory = exports2.exists = exports2.READONLY = exports2.UV_FS_O_EXLOCK = exports2.IS_WINDOWS = exports2.unlink = exports2.symlink = exports2.stat = exports2.rmdir = exports2.rm = exports2.rename = exports2.readlink = exports2.readdir = exports2.open = exports2.mkdir = exports2.lstat = exports2.copyFile = exports2.chmod = void 0;
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var path16 = __importStar4(require("path"));
-    _a = fs15.promises, exports2.chmod = _a.chmod, exports2.copyFile = _a.copyFile, exports2.lstat = _a.lstat, exports2.mkdir = _a.mkdir, exports2.open = _a.open, exports2.readdir = _a.readdir, exports2.readlink = _a.readlink, exports2.rename = _a.rename, exports2.rm = _a.rm, exports2.rmdir = _a.rmdir, exports2.stat = _a.stat, exports2.symlink = _a.symlink, exports2.unlink = _a.unlink;
+    _a = fs16.promises, exports2.chmod = _a.chmod, exports2.copyFile = _a.copyFile, exports2.lstat = _a.lstat, exports2.mkdir = _a.mkdir, exports2.open = _a.open, exports2.readdir = _a.readdir, exports2.readlink = _a.readlink, exports2.rename = _a.rename, exports2.rm = _a.rm, exports2.rmdir = _a.rmdir, exports2.stat = _a.stat, exports2.symlink = _a.symlink, exports2.unlink = _a.unlink;
     exports2.IS_WINDOWS = process.platform === "win32";
     exports2.UV_FS_O_EXLOCK = 268435456;
-    exports2.READONLY = fs15.constants.O_RDONLY;
+    exports2.READONLY = fs16.constants.O_RDONLY;
     function exists(fsPath) {
       return __awaiter4(this, void 0, void 0, function* () {
         try {
@@ -27907,8 +27907,8 @@ var require_utils7 = __commonJS({
     exports2.array = array;
     var errno = require_errno();
     exports2.errno = errno;
-    var fs15 = require_fs();
-    exports2.fs = fs15;
+    var fs16 = require_fs();
+    exports2.fs = fs16;
     var path16 = require_path();
     exports2.path = path16;
     var pattern = require_pattern();
@@ -28092,12 +28092,12 @@ var require_fs2 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createFileSystemAdapter = exports2.FILE_SYSTEM_ADAPTER = void 0;
-    var fs15 = require("fs");
+    var fs16 = require("fs");
     exports2.FILE_SYSTEM_ADAPTER = {
-      lstat: fs15.lstat,
-      stat: fs15.stat,
-      lstatSync: fs15.lstatSync,
-      statSync: fs15.statSync
+      lstat: fs16.lstat,
+      stat: fs16.stat,
+      lstatSync: fs16.lstatSync,
+      statSync: fs16.statSync
     };
     function createFileSystemAdapter(fsMethods) {
       if (fsMethods === void 0) {
@@ -28114,12 +28114,12 @@ var require_settings = __commonJS({
   "node_modules/@nodelib/fs.stat/out/settings.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    var fs15 = require_fs2();
+    var fs16 = require_fs2();
     var Settings = class {
       constructor(_options = {}) {
         this._options = _options;
         this.followSymbolicLink = this._getValue(this._options.followSymbolicLink, true);
-        this.fs = fs15.createFileSystemAdapter(this._options.fs);
+        this.fs = fs16.createFileSystemAdapter(this._options.fs);
         this.markSymbolicLink = this._getValue(this._options.markSymbolicLink, false);
         this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, true);
       }
@@ -28149,11 +28149,11 @@ var require_out = __commonJS({
       async.read(path16, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports2.stat = stat;
-    function statSync3(path16, optionsOrSettings) {
+    function statSync2(path16, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path16, settings);
     }
-    exports2.statSync = statSync3;
+    exports2.statSync = statSync2;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -28274,8 +28274,8 @@ var require_utils8 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.fs = void 0;
-    var fs15 = require_fs3();
-    exports2.fs = fs15;
+    var fs16 = require_fs3();
+    exports2.fs = fs16;
   }
 });
 
@@ -28470,14 +28470,14 @@ var require_fs4 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createFileSystemAdapter = exports2.FILE_SYSTEM_ADAPTER = void 0;
-    var fs15 = require("fs");
+    var fs16 = require("fs");
     exports2.FILE_SYSTEM_ADAPTER = {
-      lstat: fs15.lstat,
-      stat: fs15.stat,
-      lstatSync: fs15.lstatSync,
-      statSync: fs15.statSync,
-      readdir: fs15.readdir,
-      readdirSync: fs15.readdirSync
+      lstat: fs16.lstat,
+      stat: fs16.stat,
+      lstatSync: fs16.lstatSync,
+      statSync: fs16.statSync,
+      readdir: fs16.readdir,
+      readdirSync: fs16.readdirSync
     };
     function createFileSystemAdapter(fsMethods) {
       if (fsMethods === void 0) {
@@ -28496,12 +28496,12 @@ var require_settings2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     var path16 = require("path");
     var fsStat = require_out();
-    var fs15 = require_fs4();
+    var fs16 = require_fs4();
     var Settings = class {
       constructor(_options = {}) {
         this._options = _options;
         this.followSymbolicLinks = this._getValue(this._options.followSymbolicLinks, false);
-        this.fs = fs15.createFileSystemAdapter(this._options.fs);
+        this.fs = fs16.createFileSystemAdapter(this._options.fs);
         this.pathSegmentSeparator = this._getValue(this._options.pathSegmentSeparator, path16.sep);
         this.stats = this._getValue(this._options.stats, false);
         this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, true);
@@ -29762,16 +29762,16 @@ var require_settings4 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DEFAULT_FILE_SYSTEM_ADAPTER = void 0;
-    var fs15 = require("fs");
+    var fs16 = require("fs");
     var os3 = require("os");
     var CPU_COUNT = Math.max(os3.cpus().length, 1);
     exports2.DEFAULT_FILE_SYSTEM_ADAPTER = {
-      lstat: fs15.lstat,
-      lstatSync: fs15.lstatSync,
-      stat: fs15.stat,
-      statSync: fs15.statSync,
-      readdir: fs15.readdir,
-      readdirSync: fs15.readdirSync
+      lstat: fs16.lstat,
+      lstatSync: fs16.lstatSync,
+      stat: fs16.stat,
+      statSync: fs16.statSync,
+      readdir: fs16.readdir,
+      readdirSync: fs16.readdirSync
     };
     var Settings = class {
       constructor(_options = {}) {
@@ -32287,17 +32287,16 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "codeql",
-      version: "4.30.7",
+      version: "3.30.4",
       private: true,
       description: "CodeQL action",
       scripts: {
         _build_comment: "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-        build: "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+        build: "npm run transpile && node build.mjs",
         lint: "eslint --report-unused-disable-directives --max-warnings=0 .",
         "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
         "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-        ava: "npm run transpile && ava --serial --verbose",
-        test: "npm run ava -- src/",
+        test: "npm run transpile && ava src/ --serial --verbose",
         "test-debug": "npm run test -- --timeout=20m",
         transpile: "tsc --build --verbose"
       },
@@ -32313,7 +32312,7 @@ var require_package = __commonJS({
       dependencies: {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -32340,7 +32339,7 @@ var require_package = __commonJS({
       },
       devDependencies: {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -32353,7 +32352,7 @@ var require_package = __commonJS({
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         ava: "^6.4.1",
         esbuild: "^0.25.10",
@@ -34391,7 +34390,7 @@ var require_brace_expansion = __commonJS({
       var isSequence = isNumericSequence || isAlphaSequence;
       var isOptions = m.body.indexOf(",") >= 0;
       if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
+        if (m.post.match(/,.*\}/)) {
           str2 = m.pre + "{" + m.body + escClose + m.post;
           return expand(str2);
         }
@@ -35465,7 +35464,7 @@ var require_internal_globber = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DefaultGlobber = void 0;
     var core14 = __importStar4(require_core());
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var globOptionsHelper = __importStar4(require_internal_glob_options_helper());
     var path16 = __importStar4(require("path"));
     var patternHelper = __importStar4(require_internal_pattern_helper());
@@ -35517,7 +35516,7 @@ var require_internal_globber = __commonJS({
           for (const searchPath of patternHelper.getSearchPaths(patterns)) {
             core14.debug(`Search path '${searchPath}'`);
             try {
-              yield __await4(fs15.promises.lstat(searchPath));
+              yield __await4(fs16.promises.lstat(searchPath));
             } catch (err) {
               if (err.code === "ENOENT") {
                 continue;
@@ -35548,7 +35547,7 @@ var require_internal_globber = __commonJS({
                 continue;
               }
               const childLevel = item.level + 1;
-              const childItems = (yield __await4(fs15.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path16.join(item.path, x), childLevel));
+              const childItems = (yield __await4(fs16.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path16.join(item.path, x), childLevel));
               stack.push(...childItems.reverse());
             } else if (match & internal_match_kind_1.MatchKind.File) {
               yield yield __await4(item.path);
@@ -35583,7 +35582,7 @@ var require_internal_globber = __commonJS({
           let stats;
           if (options.followSymbolicLinks) {
             try {
-              stats = yield fs15.promises.stat(item.path);
+              stats = yield fs16.promises.stat(item.path);
             } catch (err) {
               if (err.code === "ENOENT") {
                 if (options.omitBrokenSymbolicLinks) {
@@ -35595,10 +35594,10 @@ var require_internal_globber = __commonJS({
               throw err;
             }
           } else {
-            stats = yield fs15.promises.lstat(item.path);
+            stats = yield fs16.promises.lstat(item.path);
           }
           if (stats.isDirectory() && options.followSymbolicLinks) {
-            const realPath = yield fs15.promises.realpath(item.path);
+            const realPath = yield fs16.promises.realpath(item.path);
             while (traversalChain.length >= item.level) {
               traversalChain.pop();
             }
@@ -36932,7 +36931,7 @@ var require_cacheUtils = __commonJS({
     var glob = __importStar4(require_glob());
     var io6 = __importStar4(require_io());
     var crypto = __importStar4(require("crypto"));
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var path16 = __importStar4(require("path"));
     var semver8 = __importStar4(require_semver3());
     var util = __importStar4(require("util"));
@@ -36962,7 +36961,7 @@ var require_cacheUtils = __commonJS({
     }
     exports2.createTempDirectory = createTempDirectory;
     function getArchiveFileSizeInBytes(filePath) {
-      return fs15.statSync(filePath).size;
+      return fs16.statSync(filePath).size;
     }
     exports2.getArchiveFileSizeInBytes = getArchiveFileSizeInBytes;
     function resolvePaths(patterns) {
@@ -37002,7 +37001,7 @@ var require_cacheUtils = __commonJS({
     exports2.resolvePaths = resolvePaths;
     function unlinkFile(filePath) {
       return __awaiter4(this, void 0, void 0, function* () {
-        return util.promisify(fs15.unlink)(filePath);
+        return util.promisify(fs16.unlink)(filePath);
       });
     }
     exports2.unlinkFile = unlinkFile;
@@ -37047,7 +37046,7 @@ var require_cacheUtils = __commonJS({
     exports2.getCacheFileName = getCacheFileName;
     function getGnuTarPathOnWindows() {
       return __awaiter4(this, void 0, void 0, function* () {
-        if (fs15.existsSync(constants_1.GnuTarPathOnWindows)) {
+        if (fs16.existsSync(constants_1.GnuTarPathOnWindows)) {
           return constants_1.GnuTarPathOnWindows;
         }
         const versionOutput = yield getVersion("tar");
@@ -48820,7 +48819,7 @@ var require_dist7 = __commonJS({
     var stream2 = require("stream");
     var coreLro = require_dist6();
     var events = require("events");
-    var fs15 = require("fs");
+    var fs16 = require("fs");
     var util = require("util");
     var buffer = require("buffer");
     function _interopNamespaceDefault(e) {
@@ -48843,7 +48842,7 @@ var require_dist7 = __commonJS({
     }
     var coreHttpCompat__namespace = /* @__PURE__ */ _interopNamespaceDefault(coreHttpCompat);
     var coreClient__namespace = /* @__PURE__ */ _interopNamespaceDefault(coreClient);
-    var fs__namespace = /* @__PURE__ */ _interopNamespaceDefault(fs15);
+    var fs__namespace = /* @__PURE__ */ _interopNamespaceDefault(fs16);
     var util__namespace = /* @__PURE__ */ _interopNamespaceDefault(util);
     var logger = logger$1.createClientLogger("storage-blob");
     var BaseRequestPolicy = class {
@@ -72691,7 +72690,7 @@ var require_downloadUtils = __commonJS({
     var http_client_1 = require_lib();
     var storage_blob_1 = require_dist7();
     var buffer = __importStar4(require("buffer"));
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var stream2 = __importStar4(require("stream"));
     var util = __importStar4(require("util"));
     var utils = __importStar4(require_cacheUtils());
@@ -72802,7 +72801,7 @@ var require_downloadUtils = __commonJS({
     exports2.DownloadProgress = DownloadProgress;
     function downloadCacheHttpClient(archiveLocation, archivePath) {
       return __awaiter4(this, void 0, void 0, function* () {
-        const writeStream = fs15.createWriteStream(archivePath);
+        const writeStream = fs16.createWriteStream(archivePath);
         const httpClient = new http_client_1.HttpClient("actions/cache");
         const downloadResponse = yield (0, requestUtils_1.retryHttpClientResponse)("downloadCache", () => __awaiter4(this, void 0, void 0, function* () {
           return httpClient.get(archiveLocation);
@@ -72828,7 +72827,7 @@ var require_downloadUtils = __commonJS({
     function downloadCacheHttpClientConcurrent(archiveLocation, archivePath, options) {
       var _a;
       return __awaiter4(this, void 0, void 0, function* () {
-        const archiveDescriptor = yield fs15.promises.open(archivePath, "w");
+        const archiveDescriptor = yield fs16.promises.open(archivePath, "w");
         const httpClient = new http_client_1.HttpClient("actions/cache", void 0, {
           socketTimeout: options.timeoutInMs,
           keepAlive: true
@@ -72945,7 +72944,7 @@ var require_downloadUtils = __commonJS({
         } else {
           const maxSegmentSize = Math.min(134217728, buffer.constants.MAX_LENGTH);
           const downloadProgress = new DownloadProgress(contentLength);
-          const fd = fs15.openSync(archivePath, "w");
+          const fd = fs16.openSync(archivePath, "w");
           try {
             downloadProgress.startDisplayTimer();
             const controller = new abort_controller_1.AbortController();
@@ -72963,12 +72962,12 @@ var require_downloadUtils = __commonJS({
                 controller.abort();
                 throw new Error("Aborting cache download as the download time exceeded the timeout.");
               } else if (Buffer.isBuffer(result)) {
-                fs15.writeFileSync(fd, result);
+                fs16.writeFileSync(fd, result);
               }
             }
           } finally {
             downloadProgress.stopDisplayTimer();
-            fs15.closeSync(fd);
+            fs16.closeSync(fd);
           }
         }
       });
@@ -73132,7 +73131,7 @@ var require_package2 = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "4.1.0",
+      version: "4.0.5",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -73267,7 +73266,7 @@ var require_cacheHttpClient = __commonJS({
     var core14 = __importStar4(require_core());
     var http_client_1 = require_lib();
     var auth_1 = require_auth();
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var url_1 = require("url");
     var utils = __importStar4(require_cacheUtils());
     var uploadUtils_1 = require_uploadUtils();
@@ -73405,7 +73404,7 @@ Other caches with similar key:`);
       return __awaiter4(this, void 0, void 0, function* () {
         const fileSize = utils.getArchiveFileSizeInBytes(archivePath);
         const resourceUrl = getCacheApiUrl(`caches/${cacheId.toString()}`);
-        const fd = fs15.openSync(archivePath, "r");
+        const fd = fs16.openSync(archivePath, "r");
         const uploadOptions = (0, options_1.getUploadOptions)(options);
         const concurrency = utils.assertDefined("uploadConcurrency", uploadOptions.uploadConcurrency);
         const maxChunkSize = utils.assertDefined("uploadChunkSize", uploadOptions.uploadChunkSize);
@@ -73419,7 +73418,7 @@ Other caches with similar key:`);
               const start = offset;
               const end = offset + chunkSize - 1;
               offset += maxChunkSize;
-              yield uploadChunk(httpClient, resourceUrl, () => fs15.createReadStream(archivePath, {
+              yield uploadChunk(httpClient, resourceUrl, () => fs16.createReadStream(archivePath, {
                 fd,
                 start,
                 end,
@@ -73430,7 +73429,7 @@ Other caches with similar key:`);
             }
           })));
         } finally {
-          fs15.closeSync(fd);
+          fs16.closeSync(fd);
         }
         return;
       });
@@ -77941,18 +77940,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 9
             /*ScalarType.STRING*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, signedUploadUrl: "", message: "" };
+        const message = { ok: false, signedUploadUrl: "" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -77971,10 +77963,6 @@ var require_cache2 = __commonJS({
             2:
               message.signedUploadUrl = reader.string();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -77991,8 +77979,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.signedUploadUrl !== "")
           writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78098,18 +78084,11 @@ var require_cache2 = __commonJS({
             kind: "scalar",
             T: 3
             /*ScalarType.INT64*/
-          },
-          {
-            no: 3,
-            name: "message",
-            kind: "scalar",
-            T: 9
-            /*ScalarType.STRING*/
           }
         ]);
       }
       create(value) {
-        const message = { ok: false, entryId: "0", message: "" };
+        const message = { ok: false, entryId: "0" };
         globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this });
         if (value !== void 0)
           (0, runtime_3.reflectionMergePartial)(this, message, value);
@@ -78128,10 +78107,6 @@ var require_cache2 = __commonJS({
             2:
               message.entryId = reader.int64().toString();
               break;
-            case /* string message */
-            3:
-              message.message = reader.string();
-              break;
             default:
               let u = options.readUnknownField;
               if (u === "throw")
@@ -78148,8 +78123,6 @@ var require_cache2 = __commonJS({
           writer.tag(1, runtime_1.WireType.Varint).bool(message.ok);
         if (message.entryId !== "0")
           writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId);
-        if (message.message !== "")
-          writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message);
         let u = options.writeUnknownFields;
         if (u !== false)
           (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -78913,7 +78886,7 @@ var require_cache3 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     var core14 = __importStar4(require_core());
     var path16 = __importStar4(require("path"));
     var utils = __importStar4(require_cacheUtils());
@@ -78921,6 +78894,7 @@ var require_cache3 = __commonJS({
     var cacheTwirpClient = __importStar4(require_cacheTwirpClient());
     var config_1 = require_config();
     var tar_1 = require_tar();
+    var constants_1 = require_constants10();
     var http_client_1 = require_lib();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
@@ -78938,14 +78912,6 @@ var require_cache3 = __commonJS({
       }
     };
     exports2.ReserveCacheError = ReserveCacheError;
-    var FinalizeCacheError = class _FinalizeCacheError extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "FinalizeCacheError";
-        Object.setPrototypeOf(this, _FinalizeCacheError.prototype);
-      }
-    };
-    exports2.FinalizeCacheError = FinalizeCacheError;
     function checkPaths(paths) {
       if (!paths || paths.length === 0) {
         throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
@@ -79217,6 +79183,9 @@ var require_cache3 = __commonJS({
           }
           const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
           core14.debug(`File Size: ${archiveFileSize}`);
+          if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) {
+            throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`);
+          }
           options.archiveSizeBytes = archiveFileSize;
           core14.debug("Reserving Cache");
           const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive);
@@ -79228,10 +79197,7 @@ var require_cache3 = __commonJS({
           try {
             const response = yield twirpClient.CreateCacheEntry(request);
             if (!response.ok) {
-              if (response.message) {
-                core14.warning(`Cache reservation failed: ${response.message}`);
-              }
-              throw new Error(response.message || "Response was not ok");
+              throw new Error("Response was not ok");
             }
             signedUploadUrl = response.signedUploadUrl;
           } catch (error2) {
@@ -79248,9 +79214,6 @@ var require_cache3 = __commonJS({
           const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest);
           core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`);
           if (!finalizeResponse.ok) {
-            if (finalizeResponse.message) {
-              throw new FinalizeCacheError(finalizeResponse.message);
-            }
             throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`);
           }
           cacheId = parseInt(finalizeResponse.entryId);
@@ -79260,8 +79223,6 @@ var require_cache3 = __commonJS({
             throw error2;
           } else if (typedError.name === ReserveCacheError.name) {
             core14.info(`Failed to save: ${typedError.message}`);
-          } else if (typedError.name === FinalizeCacheError.name) {
-            core14.warning(typedError.message);
           } else {
             if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) {
               core14.error(`Failed to save: ${typedError.message}`);
@@ -80643,7 +80604,7 @@ var require_manifest = __commonJS({
     var core_1 = require_core();
     var os3 = require("os");
     var cp = require("child_process");
-    var fs15 = require("fs");
+    var fs16 = require("fs");
     function _findMatch(versionSpec, stable, candidates, archFilter) {
       return __awaiter4(this, void 0, void 0, function* () {
         const platFilter = os3.platform();
@@ -80707,10 +80668,10 @@ var require_manifest = __commonJS({
       const lsbReleaseFile = "/etc/lsb-release";
       const osReleaseFile = "/etc/os-release";
       let contents = "";
-      if (fs15.existsSync(lsbReleaseFile)) {
-        contents = fs15.readFileSync(lsbReleaseFile).toString();
-      } else if (fs15.existsSync(osReleaseFile)) {
-        contents = fs15.readFileSync(osReleaseFile).toString();
+      if (fs16.existsSync(lsbReleaseFile)) {
+        contents = fs16.readFileSync(lsbReleaseFile).toString();
+      } else if (fs16.existsSync(osReleaseFile)) {
+        contents = fs16.readFileSync(osReleaseFile).toString();
       }
       return contents;
     }
@@ -80887,7 +80848,7 @@ var require_tool_cache = __commonJS({
     var core14 = __importStar4(require_core());
     var io6 = __importStar4(require_io());
     var crypto = __importStar4(require("crypto"));
-    var fs15 = __importStar4(require("fs"));
+    var fs16 = __importStar4(require("fs"));
     var mm = __importStar4(require_manifest());
     var os3 = __importStar4(require("os"));
     var path16 = __importStar4(require("path"));
@@ -80934,7 +80895,7 @@ var require_tool_cache = __commonJS({
     exports2.downloadTool = downloadTool2;
     function downloadToolAttempt(url2, dest, auth, headers) {
       return __awaiter4(this, void 0, void 0, function* () {
-        if (fs15.existsSync(dest)) {
+        if (fs16.existsSync(dest)) {
           throw new Error(`Destination file path ${dest} already exists`);
         }
         const http = new httpm.HttpClient(userAgent, [], {
@@ -80958,7 +80919,7 @@ var require_tool_cache = __commonJS({
         const readStream = responseMessageFactory();
         let succeeded = false;
         try {
-          yield pipeline(readStream, fs15.createWriteStream(dest));
+          yield pipeline(readStream, fs16.createWriteStream(dest));
           core14.debug("download complete");
           succeeded = true;
           return dest;
@@ -81170,11 +81131,11 @@ var require_tool_cache = __commonJS({
         arch2 = arch2 || os3.arch();
         core14.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core14.debug(`source dir: ${sourceDir}`);
-        if (!fs15.statSync(sourceDir).isDirectory()) {
+        if (!fs16.statSync(sourceDir).isDirectory()) {
           throw new Error("sourceDir is not a directory");
         }
         const destPath = yield _createToolPath(tool, version, arch2);
-        for (const itemName of fs15.readdirSync(sourceDir)) {
+        for (const itemName of fs16.readdirSync(sourceDir)) {
           const s = path16.join(sourceDir, itemName);
           yield io6.cp(s, destPath, { recursive: true });
         }
@@ -81189,7 +81150,7 @@ var require_tool_cache = __commonJS({
         arch2 = arch2 || os3.arch();
         core14.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core14.debug(`source file: ${sourceFile}`);
-        if (!fs15.statSync(sourceFile).isFile()) {
+        if (!fs16.statSync(sourceFile).isFile()) {
           throw new Error("sourceFile is not a file");
         }
         const destFolder = yield _createToolPath(tool, version, arch2);
@@ -81219,7 +81180,7 @@ var require_tool_cache = __commonJS({
         versionSpec = semver8.clean(versionSpec) || "";
         const cachePath = path16.join(_getCacheDirectory(), toolName, versionSpec, arch2);
         core14.debug(`checking cache: ${cachePath}`);
-        if (fs15.existsSync(cachePath) && fs15.existsSync(`${cachePath}.complete`)) {
+        if (fs16.existsSync(cachePath) && fs16.existsSync(`${cachePath}.complete`)) {
           core14.debug(`Found tool in cache ${toolName} ${versionSpec} ${arch2}`);
           toolPath = cachePath;
         } else {
@@ -81233,12 +81194,12 @@ var require_tool_cache = __commonJS({
       const versions = [];
       arch2 = arch2 || os3.arch();
       const toolPath = path16.join(_getCacheDirectory(), toolName);
-      if (fs15.existsSync(toolPath)) {
-        const children = fs15.readdirSync(toolPath);
+      if (fs16.existsSync(toolPath)) {
+        const children = fs16.readdirSync(toolPath);
         for (const child of children) {
           if (isExplicitVersion(child)) {
             const fullPath = path16.join(toolPath, child, arch2 || "");
-            if (fs15.existsSync(fullPath) && fs15.existsSync(`${fullPath}.complete`)) {
+            if (fs16.existsSync(fullPath) && fs16.existsSync(`${fullPath}.complete`)) {
               versions.push(child);
             }
           }
@@ -81312,7 +81273,7 @@ var require_tool_cache = __commonJS({
     function _completeToolPath(tool, version, arch2) {
       const folderPath = path16.join(_getCacheDirectory(), tool, semver8.clean(version) || version, arch2 || "");
       const markerPath = `${folderPath}.complete`;
-      fs15.writeFileSync(markerPath, "");
+      fs16.writeFileSync(markerPath, "");
       core14.debug("finished caching tool");
     }
     function isExplicitVersion(versionSpec) {
@@ -84816,6 +84777,7 @@ var require_sarif_schema_2_1_0 = __commonJS({
 });
 
 // src/upload-sarif-action.ts
+var fs15 = __toESM(require("fs"));
 var core13 = __toESM(require_core());
 
 // src/actions-util.ts
@@ -85706,21 +85668,21 @@ async function getFolderSize(itemPath, options) {
 getFolderSize.loose = async (itemPath, options) => await core(itemPath, options);
 getFolderSize.strict = async (itemPath, options) => await core(itemPath, options, { strict: true });
 async function core(rootItemPath, options = {}, returnType = {}) {
-  const fs15 = options.fs || await import("node:fs/promises");
+  const fs16 = options.fs || await import("node:fs/promises");
   let folderSize = 0n;
   const foundInos = /* @__PURE__ */ new Set();
   const errors = [];
   await processItem(rootItemPath);
   async function processItem(itemPath) {
     if (options.ignore?.test(itemPath)) return;
-    const stats = returnType.strict ? await fs15.lstat(itemPath, { bigint: true }) : await fs15.lstat(itemPath, { bigint: true }).catch((error2) => errors.push(error2));
+    const stats = returnType.strict ? await fs16.lstat(itemPath, { bigint: true }) : await fs16.lstat(itemPath, { bigint: true }).catch((error2) => errors.push(error2));
     if (typeof stats !== "object") return;
     if (!foundInos.has(stats.ino)) {
       foundInos.add(stats.ino);
       folderSize += stats.size;
     }
     if (stats.isDirectory()) {
-      const directoryItems = returnType.strict ? await fs15.readdir(itemPath) : await fs15.readdir(itemPath).catch((error2) => errors.push(error2));
+      const directoryItems = returnType.strict ? await fs16.readdir(itemPath) : await fs16.readdir(itemPath).catch((error2) => errors.push(error2));
       if (typeof directoryItems !== "object") return;
       await Promise.all(
         directoryItems.map(
@@ -88590,11 +88552,6 @@ async function asyncSome(array, predicate) {
   const results = await Promise.all(array.map(predicate));
   return results.some((result) => result);
 }
-function unsafeEntriesInvariant(object) {
-  return Object.entries(object).filter(
-    ([_, val2]) => val2 !== void 0
-  );
-}
 
 // src/actions-util.ts
 var pkg = require_package();
@@ -88775,7 +88732,6 @@ var CodeScanning = {
   target: "PUT /repos/:owner/:repo/code-scanning/analysis" /* CODE_SCANNING */,
   sarifExtension: ".sarif",
   sarifPredicate: (name) => name.endsWith(CodeScanning.sarifExtension) && !CodeQuality.sarifPredicate(name),
-  fixCategory: (_, category) => category,
   sentinelPrefix: "CODEQL_UPLOAD_SARIF_"
 };
 var CodeQuality = {
@@ -88784,18 +88740,8 @@ var CodeQuality = {
   target: "PUT /repos/:owner/:repo/code-quality/analysis" /* CODE_QUALITY */,
   sarifExtension: ".quality.sarif",
   sarifPredicate: (name) => name.endsWith(CodeQuality.sarifExtension),
-  fixCategory: fixCodeQualityCategory,
   sentinelPrefix: "CODEQL_UPLOAD_QUALITY_SARIF_"
 };
-function getAnalysisConfig(kind) {
-  switch (kind) {
-    case "code-scanning" /* CodeScanning */:
-      return CodeScanning;
-    case "code-quality" /* CodeQuality */:
-      return CodeQuality;
-  }
-}
-var SarifScanOrder = [CodeQuality, CodeScanning];
 
 // src/api-client.ts
 var core5 = __toESM(require_core());
@@ -88829,6 +88775,9 @@ function parseRepositoryNwo(input) {
 
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+function getRetryConfig() {
+  return isInTestMode() ? { retries: 10, retryAfterBaseValue: 1e4 } : { retries: 3, retryAfterBaseValue: 1e3 };
+}
 function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
   const auth = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
@@ -88836,7 +88785,8 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
       userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: (0, import_console_log_level.default)({ level: "debug" })
+      log: (0, import_console_log_level.default)({ level: "debug" }),
+      retry: getRetryConfig()
     })
   );
 }
@@ -88850,14 +88800,6 @@ function getApiDetails() {
 function getApiClient() {
   return createApiClientWithDetails(getApiDetails());
 }
-function getAuthorizationHeaderFor(logger, apiDetails, url2) {
-  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
-    logger.debug(`Providing an authorization token.`);
-    return `token ${apiDetails.auth}`;
-  }
-  logger.debug(`Not using an authorization token.`);
-  return void 0;
-}
 var cachedGitHubVersion = void 0;
 async function getGitHubVersionFromApi(apiClient, apiDetails) {
   if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
@@ -88947,8 +88889,8 @@ var path8 = __toESM(require("path"));
 var semver3 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.23.2";
-var cliVersion = "2.23.2";
+var bundleVersion = "codeql-bundle-v2.23.0";
+var cliVersion = "2.23.0";
 
 // src/overlay-database-utils.ts
 var fs5 = __toESM(require("fs"));
@@ -89170,7 +89112,7 @@ function formatDuration(durationMs) {
 }
 
 // src/overlay-database-utils.ts
-var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.4";
+var CODEQL_OVERLAY_MINIMUM_VERSION = "2.22.3";
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 15e3;
 var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_BYTES = OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB * 1e6;
 async function writeBaseDatabaseOidsFile(config, sourceRoot) {
@@ -89397,11 +89339,6 @@ var featureConfig = {
     minimumVersion: void 0,
     toolsFeature: "pythonDefaultIsToNotExtractStdlib" /* PythonDefaultIsToNotExtractStdlib */
   },
-  ["use_repository_properties" /* UseRepositoryProperties */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_USE_REPOSITORY_PROPERTIES",
-    minimumVersion: void 0
-  },
   ["qa_telemetry_enabled" /* QaTelemetryEnabled */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_QA_TELEMETRY",
@@ -89910,9 +89847,6 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
     logger.warning(
       `Caught an exception while gathering information for telemetry: ${e}. Will skip sending status report.`
     );
-    if (isInTestMode()) {
-      throw e;
-    }
     return void 0;
   }
 }
@@ -90756,6 +90690,17 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
       toolsVersion: "local"
     };
   }
+  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
+  if (forceShippedTools) {
+    logger.info(
+      `'tools: ${toolsInput}' was requested, so using CodeQL version ${defaultCliVersion.cliVersion}, the version shipped with the Action.`
+    );
+    if (toolsInput === "latest") {
+      logger.warning(
+        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
+      );
+    }
+  }
   let cliVersion2;
   let tagName;
   let url2;
@@ -90765,18 +90710,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
     );
     toolsInput = await getNightlyToolsUrl(logger);
   }
-  const forceShippedTools = toolsInput && CODEQL_BUNDLE_VERSION_ALIAS.includes(toolsInput);
   if (forceShippedTools) {
     cliVersion2 = cliVersion;
     tagName = bundleVersion;
-    logger.info(
-      `'tools: ${toolsInput}' was requested, so using CodeQL version ${cliVersion2}, the version shipped with the Action.`
-    );
-    if (toolsInput === "latest") {
-      logger.warning(
-        "`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required."
-      );
-    }
   } else if (toolsInput !== void 0) {
     tagName = tryGetTagNameFromUrl(toolsInput, logger);
     url2 = toolsInput;
@@ -90926,12 +90862,11 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer
   let authorization = void 0;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
+  } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) {
+    logger.debug("Providing an authorization token to download CodeQL tools.");
+    authorization = `token ${apiDetails.auth}`;
   } else {
-    authorization = getAuthorizationHeaderFor(
-      logger,
-      apiDetails,
-      codeqlURL
-    );
+    logger.debug("Downloading CodeQL tools without an authorization token.");
   }
   const toolcacheInfo = getToolcacheDestinationInfo(
     maybeBundleVersion,
@@ -93093,54 +93028,6 @@ function findSarifFilesInDir(sarifPath, isSarif) {
   walkSarifFiles(sarifPath);
   return sarifFiles;
 }
-async function getGroupedSarifFilePaths(logger, sarifPath) {
-  const stats = fs14.statSync(sarifPath, { throwIfNoEntry: false });
-  if (stats === void 0) {
-    throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
-  }
-  const results = {};
-  if (stats.isDirectory()) {
-    let unassignedSarifFiles = findSarifFilesInDir(
-      sarifPath,
-      (name) => path15.extname(name) === ".sarif"
-    );
-    logger.debug(
-      `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}`
-    );
-    for (const analysisConfig of SarifScanOrder) {
-      const filesForCurrentAnalysis = unassignedSarifFiles.filter(
-        analysisConfig.sarifPredicate
-      );
-      if (filesForCurrentAnalysis.length > 0) {
-        logger.debug(
-          `The following SARIF files are for ${analysisConfig.name}: ${filesForCurrentAnalysis.join(", ")}`
-        );
-        unassignedSarifFiles = unassignedSarifFiles.filter(
-          (name) => !analysisConfig.sarifPredicate(name)
-        );
-        results[analysisConfig.kind] = filesForCurrentAnalysis;
-      } else {
-        logger.debug(`Found no SARIF files for ${analysisConfig.name}`);
-      }
-    }
-    if (unassignedSarifFiles.length !== 0) {
-      logger.warning(
-        `Found files in ${sarifPath} which do not belong to any analysis: ${unassignedSarifFiles.join(", ")}`
-      );
-    }
-  } else {
-    for (const analysisConfig of SarifScanOrder) {
-      if (analysisConfig.kind === "code-scanning" /* CodeScanning */ || analysisConfig.sarifPredicate(sarifPath)) {
-        logger.debug(
-          `Using '${sarifPath}' as a SARIF file for ${analysisConfig.name}.`
-        );
-        results[analysisConfig.kind] = [sarifPath];
-        break;
-      }
-    }
-  }
-  return results;
-}
 function countResultsInSarif(sarif) {
   let numResults = 0;
   const parsedSarif = JSON.parse(sarif);
@@ -93241,7 +93128,6 @@ async function uploadSpecifiedFiles(sarifPaths, checkoutPath, category, features
   logger.info(`Processing sarif files: ${JSON.stringify(sarifPaths)}`);
   const gitHubVersion = await getGitHubVersion();
   let sarif;
-  category = uploadTarget.fixCategory(logger, category);
   if (sarifPaths.length > 1) {
     for (const sarifPath of sarifPaths) {
       const parsedSarif = readSarifFile(sarifPath);
@@ -93483,30 +93369,31 @@ function filterAlertsByDiffRange(logger, sarif) {
   return sarif;
 }
 
-// src/upload-sarif.ts
-async function uploadSarif(logger, features, checkoutPath, sarifPath, category) {
-  const sarifGroups = await getGroupedSarifFilePaths(
-    logger,
-    sarifPath
-  );
-  const uploadResults = {};
-  for (const [analysisKind, sarifFiles] of unsafeEntriesInvariant(
-    sarifGroups
-  )) {
-    const analysisConfig = getAnalysisConfig(analysisKind);
-    uploadResults[analysisKind] = await uploadSpecifiedFiles(
+// src/upload-sarif-action.ts
+async function findAndUpload(logger, features, sarifPath, pathStats, checkoutPath, analysis, category) {
+  let sarifFiles;
+  if (pathStats.isDirectory()) {
+    sarifFiles = findSarifFilesInDir(
+      sarifPath,
+      analysis.sarifPredicate
+    );
+  } else if (pathStats.isFile() && analysis.sarifPredicate(sarifPath)) {
+    sarifFiles = [sarifPath];
+  } else {
+    return void 0;
+  }
+  if (sarifFiles.length !== 0) {
+    return await uploadSpecifiedFiles(
       sarifFiles,
       checkoutPath,
       category,
       features,
       logger,
-      analysisConfig
+      analysis
     );
   }
-  return uploadResults;
+  return void 0;
 }
-
-// src/upload-sarif-action.ts
 async function sendSuccessStatusReport(startedAt, uploadStats, logger) {
   const statusReportBase = await createStatusReportBase(
     "upload-sarif" /* UploadSarif */,
@@ -93553,37 +93440,57 @@ async function run() {
     const sarifPath = getRequiredInput("sarif_file");
     const checkoutPath = getRequiredInput("checkout_path");
     const category = getOptionalInput("category");
-    const uploadResults = await uploadSarif(
+    const pathStats = fs15.lstatSync(sarifPath, { throwIfNoEntry: false });
+    if (pathStats === void 0) {
+      throw new ConfigurationError(`Path does not exist: ${sarifPath}.`);
+    }
+    const sarifIds = [];
+    const uploadResult = await findAndUpload(
       logger,
       features,
-      checkoutPath,
       sarifPath,
+      pathStats,
+      checkoutPath,
+      CodeScanning,
       category
     );
-    if (Object.keys(uploadResults).length === 0) {
-      throw new ConfigurationError(
-        `No SARIF files found to upload in "${sarifPath}".`
-      );
+    if (uploadResult !== void 0) {
+      core13.setOutput("sarif-id", uploadResult.sarifID);
+      sarifIds.push({
+        analysis: "code-scanning" /* CodeScanning */,
+        id: uploadResult.sarifID
+      });
     }
-    const codeScanningResult = uploadResults["code-scanning" /* CodeScanning */];
-    if (codeScanningResult !== void 0) {
-      core13.setOutput("sarif-id", codeScanningResult.sarifID);
+    const qualityUploadResult = await findAndUpload(
+      logger,
+      features,
+      sarifPath,
+      pathStats,
+      checkoutPath,
+      CodeQuality,
+      fixCodeQualityCategory(logger, category)
+    );
+    if (qualityUploadResult !== void 0) {
+      sarifIds.push({
+        analysis: "code-quality" /* CodeQuality */,
+        id: qualityUploadResult.sarifID
+      });
     }
-    core13.setOutput("sarif-ids", JSON.stringify(uploadResults));
+    core13.setOutput("sarif-ids", JSON.stringify(sarifIds));
     if (isInTestMode()) {
       core13.debug("In test mode. Waiting for processing is disabled.");
     } else if (getRequiredInput("wait-for-processing") === "true") {
-      if (codeScanningResult !== void 0) {
+      if (uploadResult !== void 0) {
         await waitForProcessing(
           getRepositoryNwo(),
-          codeScanningResult.sarifID,
+          uploadResult.sarifID,
           logger
         );
       }
     }
     await sendSuccessStatusReport(
       startedAt,
-      codeScanningResult?.statusReport || {},
+      uploadResult?.statusReport || {},
       logger
     );
   } catch (unwrappedError) {

package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "codeql",
-  "version": "4.30.7",
+  "version": "3.30.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.30.7",
+      "version": "3.30.4",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^2.3.1",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^4.1.0",
+        "@actions/cache": "^4.0.5",
         "@actions/core": "^1.11.1",
         "@actions/exec": "^1.1.1",
         "@actions/github": "^6.0.0",
@@ -38,7 +38,7 @@
       },
       "devDependencies": {
         "@ava/typescript": "6.0.0",
-        "@eslint/compat": "^1.4.0",
+        "@eslint/compat": "^1.3.2",
         "@eslint/eslintrc": "^3.3.1",
         "@eslint/js": "^9.36.0",
         "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -51,7 +51,7 @@
         "@types/node-forge": "^1.3.14",
         "@types/semver": "^7.7.1",
         "@types/sinon": "^17.0.4",
-        "@typescript-eslint/eslint-plugin": "^8.44.1",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
         "@typescript-eslint/parser": "^8.41.0",
         "ava": "^6.4.1",
         "esbuild": "^0.25.10",
@@ -284,9 +284,9 @@
       "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg=="
     },
     "node_modules/@actions/cache": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-4.1.0.tgz",
-      "integrity": "sha512-z3Opg+P4Y7baq+g1dODXgdtsvPLSewr3ZKpp3U0HQR1A/vWCoJFS52XSezjdngo4SIOdR5oHtyK3a3Arar+X9A==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-4.0.5.tgz",
+      "integrity": "sha512-RjLz1/vvntOfp3FpkY3wB0MjVRbLq7bfQEuQG9UUTKwdtcYmFrKVmuD+9B6ADbzbkSfHM+dM4sMjdr3R4XIkFg==",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.11.1",
@@ -1248,14 +1248,11 @@
       }
     },
     "node_modules/@eslint/compat": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.0.tgz",
-      "integrity": "sha512-DEzm5dKeDBPm3r08Ixli/0cmxr8LkRdwxMRUIJBlSCpAwSrvFEJpVBzV+66JhDxiaqKxnRzCXhtiMiczF7Hglg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.3.2.tgz",
+      "integrity": "sha512-jRNwzTbd6p2Rw4sZ1CgWRS8YMtqG15YyZf7zvb6gY2rB2u6n+2Z+ELW0GtL0fQgyl0pr4Y/BzBfng/BdsereRA==",
       "dev": true,
       "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.16.0"
-      },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -1268,19 +1265,6 @@
         }
       }
     },
-    "node_modules/@eslint/core": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.16.0.tgz",
-      "integrity": "sha512-nmC8/totwobIiFcGkDza3GIKfAw1+hLiYVrh3I1nIomQ8PEr5cxg34jnkmGawul/ep52wGRAcyeDCNtWKSOj4Q==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
     "node_modules/@eslint/eslintrc": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.1.tgz",
@@ -2647,13 +2631,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@types/json-schema": {
-      "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/json5": {
       "version": "0.0.29",
       "dev": true,
@@ -2712,17 +2689,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.44.1.tgz",
-      "integrity": "sha512-molgphGqOBT7t4YKCSkbasmu1tb1MgrZ2szGzHbclF7PNmOkSTQVHy+2jXOSnxvR3+Xe1yySHFZoqMpz3TfQsw==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.44.0.tgz",
+      "integrity": "sha512-EGDAOGX+uwwekcS0iyxVDmRV9HX6FLSM5kzrAToLTsr9OWCIKG/y3lQheCq18yZ5Xh78rRKJiEpP0ZaCs4ryOQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/type-utils": "8.44.1",
-        "@typescript-eslint/utils": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/type-utils": "8.44.0",
+        "@typescript-eslint/utils": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "graphemer": "^1.4.0",
         "ignore": "^7.0.0",
         "natural-compare": "^1.4.0",
@@ -2736,20 +2713,20 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.44.1",
+        "@typescript-eslint/parser": "^8.44.0",
         "eslint": "^8.57.0 || ^9.0.0",
         "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz",
-      "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz",
+      "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1"
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2760,9 +2737,9 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz",
+      "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2774,16 +2751,16 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz",
-      "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz",
+      "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.44.1",
-        "@typescript-eslint/tsconfig-utils": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/project-service": "8.44.0",
+        "@typescript-eslint/tsconfig-utils": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -2803,16 +2780,16 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.1.tgz",
-      "integrity": "sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.0.tgz",
+      "integrity": "sha512-nktOlVcg3ALo0mYlV+L7sWUD58KG4CMj1rb2HUVOO4aL3K/6wcD+NERqd0rrA5Vg06b42YhF6cFxeixsp9Riqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.7.0",
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1"
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2827,13 +2804,13 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz",
-      "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz",
+      "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
+        "@typescript-eslint/types": "8.44.0",
         "eslint-visitor-keys": "^4.2.1"
       },
       "engines": {
@@ -2906,16 +2883,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.44.1.tgz",
-      "integrity": "sha512-EHrrEsyhOhxYt8MTg4zTF+DJMuNBzWwgvvOYNj/zm1vnaD/IC5zCXFehZv94Piqa2cRFfXrTFxIvO95L7Qc/cw==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.44.0.tgz",
+      "integrity": "sha512-VGMpFQGUQWYT9LfnPcX8ouFojyrZ/2w3K5BucvxL/spdNehccKhB4jUyB1yBCXpr2XFm0jkECxgrpXBW2ipoAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "debug": "^4.3.4"
       },
       "engines": {
@@ -2931,14 +2908,14 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz",
-      "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz",
+      "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1"
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2949,9 +2926,9 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz",
+      "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2963,16 +2940,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz",
-      "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz",
+      "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.44.1",
-        "@typescript-eslint/tsconfig-utils": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/project-service": "8.44.0",
+        "@typescript-eslint/tsconfig-utils": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -2992,13 +2969,13 @@
       }
     },
     "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz",
-      "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz",
+      "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
+        "@typescript-eslint/types": "8.44.0",
         "eslint-visitor-keys": "^4.2.1"
       },
       "engines": {
@@ -3062,14 +3039,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.44.1.tgz",
-      "integrity": "sha512-ycSa60eGg8GWAkVsKV4E6Nz33h+HjTXbsDT4FILyL8Obk5/mx4tbvCNsLf9zret3ipSumAOG89UcCs/KRaKYrA==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.44.0.tgz",
+      "integrity": "sha512-ZeaGNraRsq10GuEohKTo4295Z/SuGcSq2LzfGlqiuEvfArzo/VRrT0ZaJsVPuKZ55lVbNk8U6FcL+ZMH8CoyVA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.44.1",
-        "@typescript-eslint/types": "^8.44.1",
+        "@typescript-eslint/tsconfig-utils": "^8.44.0",
+        "@typescript-eslint/types": "^8.44.0",
         "debug": "^4.3.4"
       },
       "engines": {
@@ -3084,9 +3061,9 @@
       }
     },
     "node_modules/@typescript-eslint/project-service/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz",
+      "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3116,9 +3093,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.44.1.tgz",
-      "integrity": "sha512-B5OyACouEjuIvof3o86lRMvyDsFwZm+4fBOqFHccIctYgBjqR3qT39FBYGN87khcgf0ExpdCBeGKpKRhSFTjKQ==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.44.0.tgz",
+      "integrity": "sha512-x5Y0+AuEPqAInc6yd0n5DAcvtoQ/vyaGwuX5HE9n6qAefk1GaedqrLQF8kQGylLUb9pnZyLf+iEiL9fr8APDtQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3133,15 +3110,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.44.1.tgz",
-      "integrity": "sha512-KdEerZqHWXsRNKjF9NYswNISnFzXfXNDfPxoTh7tqohU/PRIbwTmsjGK6V9/RTYWau7NZvfo52lgVk+sJh0K3g==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.44.0.tgz",
+      "integrity": "sha512-9cwsoSxJ8Sak67Be/hD2RNt/fsqmWnNE1iHohG8lxqLSNY8xNfyY7wloo5zpW3Nu9hxVgURevqfcH6vvKCt6yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1",
-        "@typescript-eslint/utils": "8.44.1",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0",
+        "@typescript-eslint/utils": "8.44.0",
         "debug": "^4.3.4",
         "ts-api-utils": "^2.1.0"
       },
@@ -3158,14 +3135,14 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz",
-      "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz",
+      "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1"
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3176,9 +3153,9 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz",
-      "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz",
+      "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3190,16 +3167,16 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz",
-      "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz",
+      "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.44.1",
-        "@typescript-eslint/tsconfig-utils": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/visitor-keys": "8.44.1",
+        "@typescript-eslint/project-service": "8.44.0",
+        "@typescript-eslint/tsconfig-utils": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -3219,16 +3196,16 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.1.tgz",
-      "integrity": "sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.0.tgz",
+      "integrity": "sha512-nktOlVcg3ALo0mYlV+L7sWUD58KG4CMj1rb2HUVOO4aL3K/6wcD+NERqd0rrA5Vg06b42YhF6cFxeixsp9Riqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.7.0",
-        "@typescript-eslint/scope-manager": "8.44.1",
-        "@typescript-eslint/types": "8.44.1",
-        "@typescript-eslint/typescript-estree": "8.44.1"
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3243,13 +3220,13 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.44.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz",
-      "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz",
+      "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.44.1",
+        "@typescript-eslint/types": "8.44.0",
         "eslint-visitor-keys": "^4.2.1"
       },
       "engines": {
@@ -4200,9 +4177,7 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.11",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",

package.json

@@ -1,16 +1,15 @@
 {
   "name": "codeql",
-  "version": "4.30.7",
+  "version": "3.30.4",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
     "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-    "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+    "build": "npm run transpile && node build.mjs",
     "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
     "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
     "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
-    "ava": "npm run transpile && ava --serial --verbose",
-    "test": "npm run ava -- src/",
+    "test": "npm run transpile && ava src/ --serial --verbose",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose"
   },
@@ -26,7 +25,7 @@
   "dependencies": {
     "@actions/artifact": "^2.3.1",
     "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^4.1.0",
+    "@actions/cache": "^4.0.5",
     "@actions/core": "^1.11.1",
     "@actions/exec": "^1.1.1",
     "@actions/github": "^6.0.0",
@@ -53,7 +52,7 @@
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
-    "@eslint/compat": "^1.4.0",
+    "@eslint/compat": "^1.3.2",
     "@eslint/eslintrc": "^3.3.1",
     "@eslint/js": "^9.36.0",
     "@microsoft/eslint-formatter-sarif": "^3.1.0",
@@ -66,7 +65,7 @@
     "@types/node-forge": "^1.3.14",
     "@types/semver": "^7.7.1",
     "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.44.1",
+    "@typescript-eslint/eslint-plugin": "^8.44.0",
     "@typescript-eslint/parser": "^8.41.0",
     "ava": "^6.4.1",
     "esbuild": "^0.25.10",

pr-checks/.gitignore

@@ -1,3 +1 @@
 env
-__pycache__/
-*.pyc