fix(ci): set up Java before Kotlin in PR checks

Add workflow to comment on a PR when it was dequeued

.github/workflows/__all-platform-bundle.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   all-platform-bundle:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__analysis-kinds.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analysis-kinds-${{github.ref}}
+  group: analysis-kinds-${{github.ref}}-${{inputs.java-version}}
 jobs:
   analysis-kinds:
     strategy:
@@ -68,6 +78,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__analyze-ref-input.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   analyze-ref-input:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__autobuild-action.yml

@@ -25,6 +25,11 @@ on:
         description: The version of .NET to install
         required: false
         default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -32,12 +37,17 @@ on:
         description: The version of .NET to install
         required: false
         default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}
+  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.java-version}}
 jobs:
   autobuild-action:
     strategy:
@@ -64,6 +74,11 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__autobuild-working-dir.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-working-dir-${{github.ref}}
+  group: autobuild-working-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
   autobuild-working-dir:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-autobuild.yml

@@ -63,7 +63,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin

.github/workflows/__build-mode-manual.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   build-mode-manual:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-none.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-none-${{github.ref}}
+  group: build-mode-none-${{github.ref}}-${{inputs.java-version}}
 jobs:
   build-mode-none:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__build-mode-rollback.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-rollback-${{github.ref}}
+  group: build-mode-rollback-${{github.ref}}-${{inputs.java-version}}
 jobs:
   build-mode-rollback:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__bundle-from-nightly.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-nightly-${{github.ref}}
+  group: bundle-from-nightly-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-from-nightly:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__bundle-from-toolcache.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-toolcache-${{github.ref}}
+  group: bundle-from-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-from-toolcache:
     strategy:
@@ -46,6 +56,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -53,31 +77,20 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
       - name: Check toolcache contains CodeQL
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            if (allCodeqlVersions.length === 0) {
-              throw new Error(`CodeQL could not be found in the toolcache`);
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed
+
       - id: setup-codeql
         uses: ./../action/setup-codeql
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-            if (allCodeqlVersions.length === 0) {
-              throw new Error('CodeQL not found in toolcache');
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__bundle-toolcache.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-toolcache-${{github.ref}}
+  group: bundle-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
   bundle-toolcache:
     strategy:
@@ -50,6 +60,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -58,47 +82,30 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-            fs.rmdirSync(codeqlPath, { recursive: true });
-      - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts clear
+
       - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            if (allCodeqlVersions.length !== 0) {
-              throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
-            }
-            console.log('No versions of CodeQL found in the toolcache');
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts absent
+
       - id: init
         uses: ./../action/init
         with:
           # Request multiple languages so this check uses the combined bundle.
           languages: javascript,python
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+
       - uses: ./../action/analyze
         with:
           output: ${{ runner.temp }}/results
           upload-database: false
+
       - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-            if (allCodeqlVersions.length === 0) {
-              throw new Error('CodeQL not found in toolcache');
-            }
-            if (allCodeqlVersions.length > 1) {
-              throw new Error('Multiple CodeQL versions found in toolcache');
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed -n 1
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cleanup-db-cluster-dir-${{github.ref}}
+  group: cleanup-db-cluster-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cleanup-db-cluster-dir:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__config-export.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-export-${{github.ref}}
+  group: config-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
   config-export:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__config-input.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-input-${{github.ref}}
+  group: config-input-${{github.ref}}-${{inputs.java-version}}
 jobs:
   config-input:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__cpp-deptrace-disabled.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-disabled-${{github.ref}}
+  group: cpp-deptrace-disabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-disabled:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-on-macos-${{github.ref}}
+  group: cpp-deptrace-enabled-on-macos-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-enabled-on-macos:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__cpp-deptrace-enabled.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-${{github.ref}}
+  group: cpp-deptrace-enabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
   cpp-deptrace-enabled:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__diagnostics-export.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-export-${{github.ref}}
+  group: diagnostics-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
   diagnostics-export:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__diagnostics-without-db.yml

@@ -0,0 +1,158 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Diagnostic export without database
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+  workflow_call:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: diagnostics-without-db-${{github.ref}}-${{inputs.java-version}}
+jobs:
+  diagnostics-without-db:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Diagnostic export without database
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      # We deliberately need to make this step fail before the database is initialised, but after
+      # some diagnostic has been produced. The simplest way to do that right now is to:
+      #
+      # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
+      #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
+      # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
+      #
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Initialise failing analysis
+        id: init
+        uses: ./../action/init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_FORCE_NIGHTLY: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        uses: ./analyze
+        # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
+        # above, we manually disable it with an `if` condition. Having this step is required
+        # for the init post-action because it checks the workflow definition for e.g. the
+        # `category` input. Without this step, that part of the init post-action would fail.
+        if: false
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+
+      - name: Check diagnostics appear on disk
+        env:
+          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
+        run: |
+          cd ../action
+          npx tsx ./pr-checks/diagnostics-without-db.ts
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  diagnostics-without-db-validation:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - diagnostics-without-db
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
+          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__export-file-baseline-information.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   export-file-baseline-information:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -91,6 +106,11 @@ jobs:
         with:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+          # To balance speed and coverage, analyze only JavaScript but use the combined bundle so
+          # baseline information is reported for every language in the multi-language repository. A
+          # custom configuration prevents per-language bundles from being used.
+          config: |
+            paths-ignore: []
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
@@ -124,5 +144,4 @@ jobs:
     env:
       CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
       CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__extractor-ram-threads.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: extractor-ram-threads-${{github.ref}}
+  group: extractor-ram-threads-${{github.ref}}-${{inputs.java-version}}
 jobs:
   extractor-ram-threads:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-custom-queries.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-custom-queries:
     strategy:
@@ -77,6 +87,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround-diagnostic:
     strategy:
@@ -61,6 +71,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround-no-file-program:
     strategy:
@@ -61,6 +71,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-indirect-tracing-workaround:
     strategy:
@@ -61,6 +71,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-tracing-autobuilder.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-autobuilder:
     strategy:
@@ -81,6 +91,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-custom-build-steps:
     strategy:
@@ -81,6 +91,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -25,6 +25,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       go-version:
@@ -32,12 +37,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   go-tracing-legacy-workflow:
     strategy:
@@ -81,6 +91,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__go.yml

@@ -20,6 +20,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 jobs:
   go-custom-queries:
     name: 'Go: Custom queries'
@@ -30,6 +35,7 @@ jobs:
     with:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround-diagnostic:
     name: 'Go: diagnostic when Go is changed after init step'
     permissions:
@@ -38,6 +44,7 @@ jobs:
     uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround-no-file-program:
     name: 'Go: diagnostic when `file` is not installed'
     permissions:
@@ -46,6 +53,7 @@ jobs:
     uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-indirect-tracing-workaround:
     name: 'Go: workaround for indirect tracing'
     permissions:
@@ -54,6 +62,7 @@ jobs:
     uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-autobuilder:
     name: 'Go: tracing with autobuilder step'
     permissions:
@@ -62,6 +71,7 @@ jobs:
     uses: ./.github/workflows/__go-tracing-autobuilder.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-custom-build-steps:
     name: 'Go: tracing with custom build steps'
     permissions:
@@ -70,6 +80,7 @@ jobs:
     uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
   go-tracing-legacy-workflow:
     name: 'Go: tracing with legacy workflow'
     permissions:
@@ -78,3 +89,4 @@ jobs:
     uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
     with:
       go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}

.github/workflows/__init-with-registries.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: init-with-registries-${{github.ref}}
+  group: init-with-registries-${{github.ref}}-${{inputs.java-version}}
 jobs:
   init-with-registries:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__javascript-source-root.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: javascript-source-root-${{github.ref}}
+  group: javascript-source-root-${{github.ref}}-${{inputs.java-version}}
 jobs:
   javascript-source-root:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__job-run-uuid-sarif.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: job-run-uuid-sarif-${{github.ref}}
+  group: job-run-uuid-sarif-${{github.ref}}-${{inputs.java-version}}
 jobs:
   job-run-uuid-sarif:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__language-aliases.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: language-aliases-${{github.ref}}
+  group: language-aliases-${{github.ref}}-${{inputs.java-version}}
 jobs:
   language-aliases:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__linux-arm64.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   linux-arm64:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__local-bundle.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   local-bundle:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__multi-language-autodetect.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   multi-language-autodetect:
     strategy:
@@ -109,6 +119,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__overlay-init-fallback.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: overlay-init-fallback-${{github.ref}}
+  group: overlay-init-fallback-${{github.ref}}-${{inputs.java-version}}
 jobs:
   overlay-init-fallback:
     strategy:
@@ -48,6 +58,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-codescanning-config-inputs-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__packaging-config-inputs-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-config-inputs-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__packaging-config-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-config-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__packaging-inputs-js.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   packaging-inputs-js:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

.github/workflows/__per-language-bundle-validation.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}
+  group: per-language-bundle-validation-${{github.ref}}-${{inputs.java-version}}
 jobs:
   per-language-bundle-validation:
     strategy:
@@ -36,40 +46,40 @@ jobs:
         include:
           - language: actions
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
             expected-extractors: actions javascript
           - language: cpp
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
             build-mode: manual
             build-command: gcc -o main main.c
           - language: csharp
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
             build-mode: none
           - language: go
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
             build-mode: autobuild
           - language: java
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
             build-mode: none
           - language: javascript
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
           - language: python
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
           - language: ruby
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
           - language: rust
             os: ubuntu-latest
-            version: nightly-latest
+            version: linked
           - language: swift
             os: macos-latest-xlarge
-            version: nightly-latest
+            version: linked
             build-mode: autobuild
     name: Per-language bundles
     if: github.triggering_actor != 'dependabot[bot]'
@@ -81,6 +91,20 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -88,6 +112,10 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Remove CodeQL from toolcache
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts clear
       - uses: ./../action/init
         id: init
         with:
@@ -128,9 +156,8 @@ jobs:
           CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
         run: |
           # A bundle that is missing most of its extractors must never be left in the toolcache,
-          # where a later job analyzing a different language could pick it up. The runner image
-          # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-          # rather than whether the toolcache contains CodeQL at all.
+          # where a later job analyzing a different language could pick it up. Per-language bundles
+          # must instead be extracted under the runner's temporary directory.
           echo "CodeQL is at $CODEQL_PATH"
           if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
             echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
@@ -160,5 +187,4 @@ jobs:
           fi
           echo "Created a ${LANGUAGE} database at ${database}."
     env:
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__remote-config.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   remote-config:
     strategy:
@@ -77,6 +87,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__resolve-environment-action.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: resolve-environment-action-${{github.ref}}
+  group: resolve-environment-action-${{github.ref}}-${{inputs.java-version}}
 jobs:
   resolve-environment-action:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__rubocop-multi-language.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}
+  group: rubocop-multi-language-${{github.ref}}-${{inputs.java-version}}
 jobs:
   rubocop-multi-language:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -54,7 +69,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__ruby.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ruby-${{github.ref}}
+  group: ruby-${{github.ref}}-${{inputs.java-version}}
 jobs:
   ruby:
     strategy:
@@ -56,6 +66,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__rust.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rust-${{github.ref}}
+  group: rust-${{github.ref}}-${{inputs.java-version}}
 jobs:
   rust:
     strategy:
@@ -54,6 +64,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__split-workflow.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   split-workflow:
     strategy:
@@ -85,6 +95,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__start-proxy.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: start-proxy-${{github.ref}}
+  group: start-proxy-${{github.ref}}-${{inputs.java-version}}
 jobs:
   start-proxy:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__submit-sarif-failure.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: submit-sarif-failure-${{github.ref}}
+  group: submit-sarif-failure-${{github.ref}}-${{inputs.java-version}}
 jobs:
   submit-sarif-failure:
     strategy:
@@ -50,6 +60,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -71,7 +86,9 @@ jobs:
         run: exit 1
       - uses: ./analyze
         # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-        # above, we manually disable it with an `if` condition.
+        # above, we manually disable it with an `if` condition. Having this step is required
+        # for the init post-action because it checks the workflow definition for e.g. the
+        # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
           category: '/test-codeql-version:${{ matrix.version }}'

.github/workflows/__swift-autobuild.yml

@@ -19,15 +19,25 @@ on:
   schedule:
     - cron: '0 5 * * *'
   workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-autobuild-${{github.ref}}
+  group: swift-autobuild-${{github.ref}}-${{inputs.java-version}}
 jobs:
   swift-autobuild:
     strategy:
@@ -46,6 +56,11 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__swift-custom-build.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   swift-custom-build:
     strategy:
@@ -79,6 +89,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__unset-environment.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   unset-environment:
     strategy:
@@ -77,6 +87,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__upload-ref-sha-input.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   upload-ref-sha-input:
     strategy:
@@ -75,6 +85,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__upload-sarif.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   upload-sarif:
     strategy:
@@ -82,6 +92,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/__with-checkout-path.yml

@@ -30,6 +30,11 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
   workflow_call:
     inputs:
       dotnet-version:
@@ -42,12 +47,17 @@ on:
         description: The version of Go to install
         required: false
         default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
   run:
     shell: bash
 concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
   with-checkout-path:
     strategy:
@@ -76,6 +86,11 @@ jobs:
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test

.github/workflows/post-release-mergeback.yml

@@ -134,7 +134,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/pr-dequeued.yml

@@ -0,0 +1,28 @@
+name: PR dequeued
+
+on:
+  pull_request:
+    types:
+      - dequeued
+
+jobs:
+  notify:
+    name: Notify
+    runs-on: ubuntu-slim
+
+    if: github.event.pull_request.merged != true
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Notify that the PR was removed from the merge queue
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REASON: ${{ github.event.reason }}
+          USER: ${{ github.event.pull_request.user.login }}
+        run: |
+          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
+            "Please resolve any issues if required and enqueue the PR again." |
+            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

.github/workflows/rollback-release.yml

@@ -139,7 +139,7 @@ jobs:
 
       - name: Generate token
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/update-release-branch.yml

@@ -95,7 +95,7 @@ jobs:
       pull-requests: write # needed to create pull request
     steps:
     - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       id: app-token
       with:
         app-id: ${{ vars.AUTOMATION_APP_ID }}

CHANGELOG.md

@@ -6,6 +6,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 No user facing changes.
 
+## 4.39.1 - 21 Oct 2026
+
+- Update default CodeQL bundle version to [2.27.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#4256](https://github.com/github/codeql-action/pull/4256)
+
 ## 4.39.0 - 15 Oct 2026
 
 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)

init/action.yml

@@ -153,7 +153,10 @@ inputs:
     required: false
   trap-caching:
     description: >-
-      Explicitly enable or disable TRAP caching rather than respecting the feature flag for it.
+      Explicitly enable or disable TRAP caching instead of using the automatically determined default.
+      TRAP caching is disabled by default when improved incremental analysis is enabled,
+      because improved incremental analysis of a pull request only extracts changed files,
+      which rarely benefit from TRAP caching.
     required: false
   dependency-caching:
     description: >-

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.2",
-  "cliVersion": "2.27.2",
-  "priorBundleVersion": "codeql-bundle-v2.27.1",
-  "priorCliVersion": "2.27.1"
+  "bundleVersion": "codeql-bundle-v2.27.3",
+  "cliVersion": "2.27.3",
+  "priorBundleVersion": "codeql-bundle-v2.27.2",
+  "priorCliVersion": "2.27.2"
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.39.1",
+  "version": "4.39.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.39.1",
+      "version": "4.39.2",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -36,7 +36,7 @@
         "node-forge": "^1.4.0",
         "semver": "^7.8.5",
         "undici": "^6.28.0",
-        "uuid": "^14.0.2"
+        "uuid": "^14.0.3"
       },
       "devDependencies": {
         "@ava/typescript": "6.0.0",
@@ -57,14 +57,14 @@
         "eslint-import-resolver-typescript": "^4.4.5",
         "eslint-plugin-github": "^6.1.2",
         "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.2.0",
+        "eslint-plugin-jsdoc": "^65.3.4",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^13.0.6",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
         "sinon": "^22.1.0",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.1"
+        "typescript-eslint": "^8.71.2"
       }
     },
     "node_modules/@aashutoshrathi/word-wrap": {
@@ -2702,17 +2702,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz",
-      "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
+      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/type-utils": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/type-utils": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -2725,7 +2725,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.1",
+        "@typescript-eslint/parser": "^8.71.2",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -2741,16 +2741,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz",
-      "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
+      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2784,14 +2784,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz",
-      "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
+      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.1",
-        "@typescript-eslint/types": "^8.71.1",
+        "@typescript-eslint/tsconfig-utils": "^8.71.2",
+        "@typescript-eslint/types": "^8.71.2",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2824,14 +2824,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz",
-      "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
+      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1"
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2842,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz",
-      "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
+      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2859,15 +2859,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz",
-      "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
+      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -2902,9 +2902,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz",
-      "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
+      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2916,16 +2916,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz",
-      "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
+      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.71.1",
-        "@typescript-eslint/tsconfig-utils": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/project-service": "8.71.2",
+        "@typescript-eslint/tsconfig-utils": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -3001,16 +3001,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz",
-      "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
+      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1"
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3025,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz",
-      "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
+      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -5365,9 +5365,9 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz",
-      "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==",
+      "version": "65.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
+      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -9981,16 +9981,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz",
-      "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
+      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.1",
-        "@typescript-eslint/parser": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1"
+        "@typescript-eslint/eslint-plugin": "8.71.2",
+        "@typescript-eslint/parser": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10167,9 +10167,9 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
-      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.3.tgz",
+      "integrity": "sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -10484,6 +10484,7 @@
       "dependencies": {
         "@actions/core": "^2.0.3",
         "@actions/github": "^8.0.1",
+        "@actions/tool-cache": "^3.0.1",
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.39.1",
+  "version": "4.39.2",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -44,7 +44,7 @@
     "node-forge": "^1.4.0",
     "semver": "^7.8.5",
     "undici": "^6.28.0",
-    "uuid": "^14.0.2"
+    "uuid": "^14.0.3"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
@@ -65,14 +65,14 @@
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^65.3.4",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.71.2"
   },
   "overrides": {
     "@actions/tool-cache": {

pr-checks/check-diagnostics.ts

@@ -4,16 +4,32 @@ import * as core from "@actions/core";
 
 import * as sarif from "../src/sarif";
 
-function checkStatusPageNotification(n) {
-  const expectedMessage = "Plaintext message";
-  if (n.message.text !== expectedMessage) {
-    core.setFailed(
-      `Expected the status page diagnostic to have the message '${expectedMessage}', but found '${n.message.text}'.`,
-    );
+const DIAGNOSTIC_ID =
+  process.env["DIAGNOSTIC_ID"] ?? "lang/diagnostics/example";
+const DIAGNOSTIC_NAME = process.env["DIAGNOSTIC_NAME"] ?? "Diagnostic name";
+const EXPECTED_MESSAGE = process.env["EXPECTED_MESSAGE"] ?? "Plaintext message";
+const EXPECTED_LOCATIONS = Number.parseInt(
+  process.env["EXPECTED_LOCATIONS"] ?? "1",
+);
+
+function checkStatusPageNotification(n: sarif.Notification) {
+  const expectedMessage = EXPECTED_MESSAGE.trim();
+  if (!n.message.text?.includes(expectedMessage)) {
+    if (n.message.text !== undefined) {
+      core.setFailed(
+        `Expected the status page diagnostic to contain the message '${expectedMessage}', but found '${n.message.text.replaceAll("\n", "\\n")}'.`,
+      );
+    } else {
+      core.setFailed(
+        `Expected the status page diagnostic to contain the message '${expectedMessage}', but found nothing.`,
+      );
+    }
   }
-  if (n.locations.length !== 1) {
+
+  const locationCount = n.locations?.length ?? 0;
+  if (locationCount !== EXPECTED_LOCATIONS) {
     core.setFailed(
-      `Expected the status page diagnostic to have exactly 1 location, but found ${n.locations.length}.`,
+      `Expected the status page diagnostic to have exactly ${EXPECTED_LOCATIONS} location(s), but found ${locationCount}.`,
     );
   }
 }
@@ -40,8 +56,7 @@ if (toolExecutionNotifications === undefined) {
 
 const statusPageNotifications = toolExecutionNotifications.filter(
   (n) =>
-    n.descriptor?.id === "lang/diagnostics/example" &&
-    n.properties?.visibility?.statusPage,
+    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
 );
 if (statusPageNotifications.length !== 1) {
   core.setFailed(
@@ -61,9 +76,9 @@ if (notifications === undefined) {
 
 const diagnosticNotification = notifications.filter(
   (n) =>
-    n.id === "lang/diagnostics/example" &&
-    n.name === "lang/diagnostics/example" &&
-    n.fullDescription?.text === "Diagnostic name",
+    n.id === DIAGNOSTIC_ID &&
+    n.name === DIAGNOSTIC_ID &&
+    n.fullDescription?.text === DIAGNOSTIC_NAME,
 );
 if (diagnosticNotification.length !== 1) {
   core.setFailed(

pr-checks/checks/bundle-from-toolcache.yml

@@ -2,30 +2,20 @@ name: "Bundle: From toolcache"
 description: "The CodeQL bundle should be cached within the toolcache"
 versions:
   - toolcache
+installNode: true
 steps:
-  - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache@3
   - name: Check toolcache contains CodeQL
     continue-on-error: true
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        if (allCodeqlVersions.length === 0) {
-          throw new Error(`CodeQL could not be found in the toolcache`);
-        }
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts installed
+
   - id: setup-codeql
     uses: ./../action/setup-codeql
     with:
       tools: ${{ steps.prepare-test.outputs.tools-url }}
+
   - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-        if (allCodeqlVersions.length === 0) {
-          throw new Error('CodeQL not found in toolcache');
-        }
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts installed

pr-checks/checks/bundle-toolcache.yml

@@ -6,47 +6,31 @@ operatingSystems:
   - ubuntu
   - macos
   - windows
+installNode: true
 steps:
   - name: Remove CodeQL from toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const fs = require('fs');
-        const path = require('path');
-        const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-        fs.rmdirSync(codeqlPath, { recursive: true });
-  - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache@3
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts clear
+
   - name: Check toolcache does not contain CodeQL
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        if (allCodeqlVersions.length !== 0) {
-          throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
-        }
-        console.log('No versions of CodeQL found in the toolcache');
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts absent
+
   - id: init
     uses: ./../action/init
     with:
       # Request multiple languages so this check uses the combined bundle.
       languages: javascript,python
       tools: ${{ steps.prepare-test.outputs.tools-url }}
+
   - uses: ./../action/analyze
     with:
       output: ${{ runner.temp }}/results
       upload-database: false
+
   - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-        if (allCodeqlVersions.length === 0) {
-          throw new Error('CodeQL not found in toolcache');
-        }
-        if (allCodeqlVersions.length > 1) {
-          throw new Error('Multiple CodeQL versions found in toolcache');
-        }
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts installed -n 1

pr-checks/checks/diagnostics-without-db.yml

@@ -0,0 +1,72 @@
+name: "Diagnostic export without database"
+description: "Tests that temporary diagnostics are correctly included in the failed SARIF."
+versions:
+  # Overridden by the FF in the `init` step below.
+  - linked
+installNode: true
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  # We deliberately need to make this step fail before the database is initialised, but after
+  # some diagnostic has been produced. The simplest way to do that right now is to:
+  #
+  # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
+  #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
+  # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
+  #
+  - name: Initialise failing analysis
+    id: init
+    uses: ./../action/init
+    continue-on-error: true
+    env:
+      CODEQL_ACTION_FORCE_NIGHTLY: true
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    uses: ./analyze
+    # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
+    # above, we manually disable it with an `if` condition. Having this step is required
+    # for the init post-action because it checks the workflow definition for e.g. the
+    # `category` input. Without this step, that part of the init post-action would fail.
+    if: false
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+  - name: Check diagnostics appear on disk
+    env:
+      DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
+    run: |
+      cd ../action
+      npx tsx ./pr-checks/diagnostics-without-db.ts
+validationJobs:
+  diagnostics-without-db-validation:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
+          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
+        run: npx tsx ./pr-checks/check-diagnostics.ts

pr-checks/checks/export-file-baseline-information.yml

@@ -11,16 +11,17 @@ installDotNet: true
 env:
   CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
   CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-  # To balance speed and coverage, we analyze only a single language (JavaScript), but use the
-  # combined bundle so we can test that baseline information is reported for each language in the
-  # multi-language source directory.
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
 steps:
   - uses: ./../action/init
     id: init
     with:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
+      # To balance speed and coverage, analyze only JavaScript but use the combined bundle so
+      # baseline information is reported for every language in the multi-language repository. A
+      # custom configuration prevents per-language bundles from being used.
+      config: |
+        paths-ignore: []
   - name: Build code
     run: ./build.sh
   - uses: ./../action/analyze

pr-checks/checks/per-language-bundle-validation.yml

@@ -1,49 +1,51 @@
 name: Per-language bundles
 description: Validates extraction and analysis using each per-language CodeQL bundle.
-# TODO: Use a released bundle once releases include per-language bundles.
 matrix:
   include:
     - language: actions
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
       # Actions also needs the JavaScript extractor.
       expected-extractors: actions javascript
     - language: cpp
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
       build-mode: manual
       build-command: gcc -o main main.c
     - language: csharp
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
       build-mode: none
     - language: go
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
       build-mode: autobuild
     - language: java
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
       build-mode: none
     - language: javascript
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
     - language: python
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
     - language: ruby
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
     - language: rust
       os: ubuntu-latest
-      version: nightly-latest
+      version: linked
     - language: swift
       os: macos-latest-xlarge
-      version: nightly-latest
+      version: linked
       build-mode: autobuild
-env:
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
+installNode: true
 steps:
+  - name: Remove CodeQL from toolcache
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts clear
   - uses: ./../action/init
     id: init
     with:
@@ -84,9 +86,8 @@ steps:
       CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
     run: |
       # A bundle that is missing most of its extractors must never be left in the toolcache,
-      # where a later job analyzing a different language could pick it up. The runner image
-      # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-      # rather than whether the toolcache contains CodeQL at all.
+      # where a later job analyzing a different language could pick it up. Per-language bundles
+      # must instead be extracted under the runner's temporary directory.
       echo "CodeQL is at $CODEQL_PATH"
       if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
         echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

pr-checks/checks/submit-sarif-failure.yml

@@ -35,7 +35,9 @@ steps:
     run: exit 1
   - uses: ./analyze
     # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-    # above, we manually disable it with an `if` condition.
+    # above, we manually disable it with an `if` condition. Having this step is required
+    # for the init post-action because it checks the workflow definition for e.g. the
+    # `category` input. Without this step, that part of the init post-action would fail.
     if: false
     with:
       category: "/test-codeql-version:${{ matrix.version }}"

pr-checks/diagnostics-without-db.ts

@@ -0,0 +1,48 @@
+import * as fs from "fs";
+import * as path from "path";
+
+import * as core from "@actions/core";
+
+import type * as diagnostics from "../src/diagnostics";
+
+const DIAGNOSTIC_ID = "codeql-action/forced-nightly-cli";
+const diagnosticDirectory = process.env["DIAGNOSTICS_DIR"];
+
+if (diagnosticDirectory === undefined) {
+  throw new Error("DIAGNOSTICS_DIR is undefined.");
+}
+
+const paths = fs
+  .readdirSync(diagnosticDirectory, {
+    recursive: true,
+    encoding: "utf-8",
+  })
+  .filter((p) => p.endsWith(".json"));
+
+core.info(`Found ${paths.length} paths in '${diagnosticDirectory}'.`);
+core.info(`Searching for a diagnostic with id '${DIAGNOSTIC_ID}'...`);
+
+let found = false;
+for (const diagnosticPath of paths) {
+  if (path.extname(diagnosticPath) !== ".json") {
+    core.info(`Skipping ${diagnosticPath}.`);
+    continue;
+  }
+  core.info(`Found ${diagnosticPath}.`);
+
+  const contents = JSON.parse(
+    fs.readFileSync(path.resolve(diagnosticDirectory, diagnosticPath), "utf-8"),
+  ) as diagnostics.DiagnosticMessage;
+
+  if (contents.source.id === DIAGNOSTIC_ID) {
+    core.info(
+      `Found '${DIAGNOSTIC_ID}' in '${diagnosticPath}'. Skipping remaining files.`,
+    );
+    found = true;
+    break;
+  }
+}
+
+if (!found) {
+  throw new Error(`Didn't find '${DIAGNOSTIC_ID}' diagnostic.`);
+}

pr-checks/excluded.yml

@@ -20,3 +20,7 @@ is:
   - "Release info"
   - "Upload results"
   - "Update release branch"
+  # These checks are known not to run on every PR (for example, some release
+  # PRs), so requiring them would block the PRs they don't run on.
+  - "github-advanced-security"
+  - "License compliance check"

pr-checks/package.json

@@ -5,6 +5,7 @@
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@actions/github": "^8.0.1",
+    "@actions/tool-cache": "^3.0.1",
     "@octokit/core": "^7.0.8",
     "@octokit/plugin-paginate-rest": ">=16.0.0",
     "@octokit/plugin-rest-endpoint-methods": "^18.0.0",

pr-checks/sync.ts

@@ -90,7 +90,7 @@ interface Specification extends JobSpecification {
   services?: any;
 
   /** Additional jobs to run after the main PR check job. */
-  validationJobs?: Record<string, JobSpecification>;
+  validationJobs?: Record<string, ValidationJobSpecification>;
 
   /** If set, this check is part of a named collection that gets its own caller workflow. */
   collection?: string;
@@ -122,6 +122,10 @@ interface JobSpecification {
   installYq?: boolean;
 }
 
+type ValidationJobSpecification = JobSpecification & {
+  checkout?: boolean;
+};
+
 /** Describes language/framework-specific steps and inputs. */
 interface LanguageSetup {
   specProperty: keyof JobSpecification;
@@ -263,8 +267,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Java",
         uses: pinnedUses(
           "actions/setup-java",
-          "de7274f081f381c8f8158605e0321c36c376e2e6",
-          "v6.0.1",
+          "b843ebf9b913146b38da2eaa7aeddf76074ae1ad",
+          "v6.1.0",
         ),
         with: {
           "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -462,6 +466,20 @@ function generateJobMatrix(
   return matrix;
 }
 
+/**
+ * Gets the `actions/checkout` step.
+ */
+function getCheckoutStep(): Step {
+  return {
+    name: "Check out repository",
+    uses: pinnedUses(
+      "actions/checkout",
+      "3d3c42e5aac5ba805825da76410c181273ba90b1",
+      "v7.0.1",
+    ),
+  };
+}
+
 /**
  * Retrieves setup steps and additional input definitions based on specific languages or frameworks
  * that are requested by the `checkSpecification`.
@@ -525,20 +543,17 @@ function generateJob(
     ? checkSpecification.useAllPlatformBundle
     : "false";
 
-  // Determine which languages or frameworks have to be installed.
-  const setupInfo = getSetupSteps(checkSpecification);
+  // Kotlin requires a compatible JDK rather than the runner image's default.
+  const setupInfo = getSetupSteps({
+    ...checkSpecification,
+    installJava:
+      checkSpecification.installJava ?? !("container" in checkSpecification),
+  });
   const workflowInputs = setupInfo.inputs;
 
   // Construct the workflow steps needed for this check.
   const steps: Step[] = [
-    {
-      name: "Check out repository",
-      uses: pinnedUses(
-        "actions/checkout",
-        "3d3c42e5aac5ba805825da76410c181273ba90b1",
-        "v7.0.1",
-      ),
-    },
+    getCheckoutStep(),
     ...setupInfo.steps,
     {
       name: "Prepare test",
@@ -609,13 +624,16 @@ function generateJob(
 /** Generates a validation job. */
 function generateValidationJob(
   specDocument: yaml.Document,
-  jobSpecification: JobSpecification,
+  jobSpecification: ValidationJobSpecification,
   checkName: string,
   name: string,
 ) {
   // Determine which languages or frameworks have to be installed.
   const { inputs, steps } = getSetupSteps(jobSpecification);
 
+  // Construct a checkout step if requested.
+  const checkoutStep = jobSpecification.checkout ? [getCheckoutStep()] : [];
+
   // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
   const specSteps = specDocument.getIn([
     "validationJobs",
@@ -624,7 +642,7 @@ function generateValidationJob(
   ]) as yaml.YAMLSeq;
 
   // Add the generated steps in front of the ones from the specification.
-  specSteps.items.unshift(...steps);
+  specSteps.items.unshift(...checkoutStep, ...steps);
 
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
@@ -635,7 +653,7 @@ function generateValidationJob(
       "security-events": "read",
     },
     "timeout-minutes": 5,
-    "runs-on": "ubuntu-slim",
+    "runs-on": "ubuntu-latest",
     steps: specSteps,
   };
 

pr-checks/toolcache.ts

@@ -0,0 +1,94 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Provides utility commands for working with the Actions toolcache in PR checks.
+ */
+
+import fs from "fs";
+import { parseArgs } from "node:util";
+import path from "path";
+
+import * as core from "@actions/core";
+import * as toolcache from "@actions/tool-cache";
+
+function removeCodeQLFromToolcache() {
+  const toolcachePath = process.env["RUNNER_TOOL_CACHE"];
+
+  if (toolcachePath === undefined) {
+    throw new Error("Expected RUNNER_TOOL_CACHE to be defined");
+  }
+
+  const codeqlPath = path.join(toolcachePath, "CodeQL");
+  fs.rmSync(codeqlPath, { recursive: true });
+
+  core.info(`Removed '${codeqlPath}' from the toolcache.`);
+}
+
+function findCodeQL() {
+  return toolcache.findAllVersions("CodeQL");
+}
+
+function checkNoCodeQLInToolcache() {
+  const allCodeqlVersions = findCodeQL();
+  if (allCodeqlVersions.length !== 0) {
+    throw new Error(
+      `CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`,
+    );
+  }
+  core.info("No versions of CodeQL found in the toolcache");
+}
+
+function hasCodeQLInToolcache(expectedNumber?: string) {
+  const expected =
+    expectedNumber !== undefined
+      ? Number.parseInt(expectedNumber, 10)
+      : undefined;
+
+  const allCodeqlVersions = findCodeQL();
+  if (allCodeqlVersions.length === 0) {
+    throw new Error("CodeQL not found in toolcache");
+  }
+
+  core.info(`Found CodeQL versions: ${allCodeqlVersions.join(", ")}`);
+  if (expected !== undefined && allCodeqlVersions.length !== expected) {
+    throw new Error(
+      `Expected ${expected} versions of CodeQL in the toolcache, but found ${allCodeqlVersions.length}`,
+    );
+  }
+}
+
+function main() {
+  const { positionals, values } = parseArgs({
+    options: {
+      // The number of expected versions in the toolcache.
+      "expected-version-count": { type: "string", short: "n" },
+    },
+    allowPositionals: true,
+  });
+
+  if (positionals.length < 1) {
+    throw new Error("Command not specified.");
+  }
+
+  const cmd = positionals[0];
+
+  switch (cmd.trim().toLowerCase()) {
+    case "clear":
+      removeCodeQLFromToolcache();
+      return;
+    case "absent":
+      checkNoCodeQLInToolcache();
+      return;
+    case "installed":
+      hasCodeQLInToolcache(values["expected-version-count"]);
+      return;
+    default:
+      throw new Error(`Unknown command '${cmd}'.`);
+  }
+}
+
+try {
+  main();
+} catch (err) {
+  core.setFailed(err instanceof Error ? err.message : String(err));
+}

src/actions-util.test.ts

@@ -11,7 +11,6 @@ import {
 } from "./actions-util";
 import { computeAutomationID } from "./api-client";
 import { EnvVar } from "./environment";
-import { getRunnerLogger } from "./logging";
 import { RecordingLogger, setupTests } from "./testing-utils";
 import { initializeEnvironment, withTmpDir } from "./util";
 
@@ -238,7 +237,7 @@ test.serial("fixCodeQualityCategory", (t) => {
       GITHUB_EVENT_NAME: "dynamic",
     },
     () => {
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
 
       // Categories that should get adjusted.
       t.is(fixCodeQualityCategory(logger, "/language:c#"), "/language:csharp");

src/analyses.test.ts

@@ -15,7 +15,6 @@ import {
   supportedAnalysisKinds,
 } from "./analyses";
 import { EnvVar } from "./environment";
-import { getRunnerLogger } from "./logging";
 import {
   createFeatures,
   RecordingLogger,
@@ -65,7 +64,7 @@ test.serial(
       .withArgs("analysis-kinds")
       .returns("code-scanning,code-quality");
     const result = await getAnalysisKinds(
-      getRunnerLogger(true),
+      new RecordingLogger(),
       features,
       true,
     );
@@ -139,7 +138,7 @@ test.serial(
     const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
     optionalInputStub.withArgs("quality-queries").returns("code-quality");
     const result = await getAnalysisKinds(
-      getRunnerLogger(true),
+      new RecordingLogger(),
       features,
       true,
     );
@@ -155,7 +154,7 @@ test.serial(
     const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
     requiredInputStub.withArgs("analysis-kinds").returns("no-such-thing");
     await t.throwsAsync(
-      getAnalysisKinds(getRunnerLogger(true), features, true),
+      getAnalysisKinds(new RecordingLogger(), features, true),
     );
   },
 );
@@ -181,7 +180,7 @@ for (let i = 0; i < analysisKinds.length; i++) {
             .withArgs("analysis-kinds")
             .returns([analysisKind, otherAnalysis].join(","));
           const result = await getAnalysisKinds(
-            getRunnerLogger(true),
+            new RecordingLogger(),
             features,
             true,
           );
@@ -199,7 +198,7 @@ for (let i = 0; i < analysisKinds.length; i++) {
             .withArgs("analysis-kinds")
             .returns([analysisKind, otherAnalysis].join(","));
           await t.throwsAsync(
-            getAnalysisKinds(getRunnerLogger(true), features, true),
+            getAnalysisKinds(new RecordingLogger(), features, true),
             {
               instanceOf: ConfigurationError,
               message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,

src/analyze-action.ts

@@ -50,9 +50,8 @@ import {
   StatusReportBase,
 } from "./status-report";
 import {
-  cleanupTrapCaches,
-  TrapCacheCleanupStatusReport,
   uploadTrapCaches,
+  warnIfTrapCacheCleanupEnvVarIsSet,
 } from "./trap-caching";
 import * as uploadLib from "./upload-lib";
 import { UploadResult } from "./upload-lib";
@@ -86,7 +85,6 @@ async function sendStatusReport(
   trapCacheUploadTime: number | undefined,
   dbCreationTimings: DatabaseCreationTimings | undefined,
   didUploadTrapCaches: boolean,
-  trapCacheCleanup: TrapCacheCleanupStatusReport | undefined,
   dependencyCacheResults: DependencyCacheUploadStatusReport | undefined,
   databaseUploadResults: DatabaseUploadResult[],
   logger: Logger,
@@ -107,7 +105,6 @@ async function sendStatusReport(
       ...statusReportBase,
       ...(stats || {}),
       ...(dbCreationTimings || {}),
-      ...(trapCacheCleanup || {}),
       dependency_caching_upload_results: dependencyCacheResults,
       database_upload_results: databaseUploadResults,
     };
@@ -229,8 +226,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
     | undefined = undefined;
   let runStats: QueriesStatusReport | undefined = undefined;
   let config: Config | undefined = undefined;
-  let trapCacheCleanupTelemetry: TrapCacheCleanupStatusReport | undefined =
-    undefined;
   let trapCacheUploadTime: number | undefined = undefined;
   let dbCreationTimings: DatabaseCreationTimings | undefined = undefined;
   let didUploadTrapCaches = false;
@@ -278,6 +273,8 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       );
     }
 
+    warnIfTrapCacheCleanupEnvVarIsSet(action);
+
     const apiDetails = getApiDetails();
     const outputDir = actionsUtil.getRequiredInput("output");
     action.env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
@@ -361,6 +358,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       uploadResults = await postProcessAndUploadSarif(
         logger,
         features,
+        config,
         uploadKind,
         checkoutPath,
         outputDir,
@@ -415,13 +413,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
     didUploadTrapCaches = await uploadTrapCaches(codeql, config, logger);
     trapCacheUploadTime = performance.now() - trapCacheUploadStartTime;
 
-    // Clean up TRAP caches
-    trapCacheCleanupTelemetry = await cleanupTrapCaches(
-      config,
-      features,
-      logger,
-    );
-
     // Store dependency cache(s) if dependency caching is enabled.
     if (shouldStoreCache(config.dependencyCachingEnabled)) {
       dependencyCacheResults = await uploadDependencyCaches(
@@ -433,8 +424,10 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
     }
 
     // We don't upload results in test mode, so don't wait for processing
-    if (util.isInTestMode()) {
-      logger.debug("In test mode. Waiting for processing is disabled.");
+    if (util.shouldSkipSarifUpload()) {
+      logger.debug(
+        "SARIF upload is disabled and nothing was uploaded, so we do not need to wait for processing to finish.",
+      );
     } else if (
       uploadResults?.[analyses.AnalysisKind.CodeScanning] !== undefined &&
       actionsUtil.getRequiredInput("wait-for-processing") === "true"
@@ -471,7 +464,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       trapCacheUploadTime,
       dbCreationTimings,
       didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
       dependencyCacheResults,
       databaseUploadResults,
       logger,
@@ -494,7 +486,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       trapCacheUploadTime,
       dbCreationTimings,
       didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
       dependencyCacheResults,
       databaseUploadResults,
       logger,
@@ -508,7 +499,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       trapCacheUploadTime,
       dbCreationTimings,
       didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
       dependencyCacheResults,
       databaseUploadResults,
       logger,
@@ -522,7 +512,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
       trapCacheUploadTime,
       dbCreationTimings,
       didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
       dependencyCacheResults,
       databaseUploadResults,
       logger,

src/analyze.test.ts

@@ -17,12 +17,12 @@ import { defaultSuites } from "./config/db-config";
 import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
-import { getRunnerLogger } from "./logging";
 import {
   setupTests,
   setupActionsVars,
   createFeatures,
   createTestConfig,
+  RecordingLogger,
   callee,
 } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
@@ -195,7 +195,7 @@ test.serial("status report fields", async (t) => {
         undefined,
         codeql,
         config,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         createFeatures([Feature.QaTelemetryEnabled]),
       );
       t.deepEqual(Object.keys(statusReport).sort(), [

src/api-client.ts

@@ -401,21 +401,6 @@ export async function listActionsCaches(
   );
 }
 
-/**
- * Delete an Actions cache item by its ID.
- *
- * See https://docs.github.com/en/rest/actions/cache#delete-a-github-actions-cache-for-a-repository-using-a-cache-id.
- */
-export async function deleteActionsCache(id: number) {
-  const repositoryNwo = getRepositoryNwo();
-
-  await getApiClient().rest.actions.deleteActionsCacheById({
-    owner: repositoryNwo.owner,
-    repo: repositoryNwo.repo,
-    cache_id: id,
-  });
-}
-
 /**
  * Retrieve all custom repository properties.
  *

src/artifact-scanner.test.ts

@@ -10,12 +10,12 @@ import {
   scanArtifactsForTokens,
   TokenType,
 } from "./artifact-scanner";
-import { getRunnerLogger } from "./logging";
 import {
   checkExpectedLogMessages,
   getRecordingLogger,
   LoggedMessage,
   makeTestToken,
+  RecordingLogger,
 } from "./testing-utils";
 
 test("makeTestToken", (t) => {
@@ -121,7 +121,7 @@ for (const { type, value, checkPattern } of testTokens) {
 }
 
 test("scanArtifactsForTokens handles files without tokens", async (t) => {
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "scanner-test-"));
 
   try {

src/cli/output-cache.test.ts

@@ -3,15 +3,14 @@ import path from "path";
 
 import test from "ava";
 
-import { getRunnerLogger } from "../logging";
-import { setupTests } from "../testing-utils";
+import { RecordingLogger, setupTests } from "../testing-utils";
 import * as util from "../util";
 
 import { getCachedCodeQlVersion } from "./output-cache";
 
 setupTests(test);
 
-const logger = getRunnerLogger(true);
+const logger = new RecordingLogger();
 
 test.serial(
   "getCachedCodeQlVersion reuses a version persisted by an earlier step",

src/codeql.test.ts

@@ -22,7 +22,6 @@ import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
 import { BuiltInLanguage } from "./languages";
-import { getRunnerLogger } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import {
   setupTests,
@@ -34,6 +33,8 @@ import {
   makeVersionInfo,
   createTestConfig,
   makeMacro,
+  getCodeQLForTesting,
+  RecordingLogger,
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
@@ -102,7 +103,7 @@ async function installIntoToolcache({
     undefined, // otherLanguagePacksReason
     false, // useOverlayAwareDefaultCliVersion
     createFeatures([]),
-    getRunnerLogger(true),
+    new RecordingLogger(),
     false,
   );
 }
@@ -140,7 +141,7 @@ function mockApiDetails(apiDetails: Required<GitHubApiDetails>) {
 }
 
 async function stubCodeql(): Promise<codeql.CodeQL> {
-  const codeqlObject = await codeql.getCodeQLForTesting();
+  const codeqlObject = await getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
   sinon
     .stub(codeqlObject, "isTracedLanguage")
@@ -176,7 +177,7 @@ test.serial(
           undefined, // otherLanguagePacksReason
           false, // useOverlayAwareDefaultCliVersion
           features,
-          getRunnerLogger(true),
+          new RecordingLogger(),
           false,
         );
 
@@ -212,7 +213,7 @@ test.serial(
         undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         false,
       );
 
@@ -252,7 +253,7 @@ test.serial(
         undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         false,
       );
       t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
@@ -362,7 +363,7 @@ for (const {
           undefined, // otherLanguagePacksReason
           false, // useOverlayAwareDefaultCliVersion
           features,
-          getRunnerLogger(true),
+          new RecordingLogger(),
           false,
         );
         t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
@@ -405,7 +406,7 @@ for (const toolcacheVersion of [
           undefined, // otherLanguagePacksReason
           false, // useOverlayAwareDefaultCliVersion
           features,
-          getRunnerLogger(true),
+          new RecordingLogger(),
           false,
         );
         t.is(
@@ -450,7 +451,7 @@ test.serial(
         undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         false,
       );
       t.deepEqual(result.toolsVersion, "0.0.0-20200601");
@@ -497,7 +498,7 @@ test.serial(
         undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         false,
       );
       t.deepEqual(result.toolsVersion, defaults.cliVersion);
@@ -537,7 +538,7 @@ test.serial(
         undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         false,
       );
       t.deepEqual(result.toolsVersion, defaults.cliVersion);
@@ -579,7 +580,7 @@ test.serial(
         undefined, // otherLanguagePacksReason
         false, // useOverlayAwareDefaultCliVersion
         features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
         false,
       );
 
@@ -664,7 +665,7 @@ const injectedConfigMacro = makeMacro({
         tempDir,
       };
       thisStubConfig.computedConfig = generateCodeScanningConfig(
-        getRunnerLogger(true),
+        new RecordingLogger(),
         thisStubConfig.originalUserInput,
         augmentationProperties,
       );
@@ -1039,7 +1040,7 @@ test.serial("runTool summarizes autobuilder errors", async (t) => {
     [2019-09-18 12:00:01] [autobuild] A non-error message
   `;
   stubToolRunnerConstructor(1, stderr);
-  const codeqlObject = await codeql.getCodeQLForTesting();
+  const codeqlObject = await getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
   sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
   // io throws because of the test CodeQL object.
@@ -1095,7 +1096,7 @@ test.serial("runTool recognizes fatal internal errors", async (t) => {
     com.semmle.util.exception.CatastrophicError: An error occurred while evaluating ControlFlowGraph::ControlFlow::Root.isRootOf/1#dispred#f610e6ed/2@86282cc8
     Severe disk cache trouble (corruption or out of space) at /home/runner/work/_temp/codeql_databases/go/db-go/default/cache/pages/28/33.pack: Failed to write item to disk`;
   stubToolRunnerConstructor(1, stderr);
-  const codeqlObject = await codeql.getCodeQLForTesting();
+  const codeqlObject = await getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
   sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
   // io throws because of the test CodeQL object.

src/codeql.ts

@@ -26,7 +26,7 @@ import {
 } from "./feature-flags";
 import { isAnalyzingDefaultBranch } from "./git-utils";
 import { Language } from "./languages";
-import { getRunnerLogger, Logger } from "./logging";
+import type { Logger } from "./logging";
 import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import * as setupCodeql from "./setup-codeql";
@@ -199,6 +199,7 @@ export interface CodeQL {
     sarifFile: string,
     automationDetailsId: string | undefined,
     config: ActionConfig<"tempDir">,
+    diagnosticDir: string | undefined,
   ): Promise<void>;
   /** Get the location of an extractor for the specified language. */
   resolveExtractor(language: Language): Promise<string>;
@@ -486,18 +487,6 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
   };
 }
 
-/**
- * Get a real, newly created CodeQL instance for testing. The instance refers to
- * a non-existent placeholder codeql command, so tests that use this function
- * should also stub the toolrunner.ToolRunner constructor.
- */
-export async function getCodeQLForTesting(
-  cmd = "codeql-for-testing",
-  logger: Logger = getRunnerLogger(true),
-): Promise<CodeQL> {
-  return getCodeQLForCmd(logger, cmd, false);
-}
-
 /**
  * Return a CodeQL object for CodeQL CLI access.
  *
@@ -506,7 +495,7 @@ export async function getCodeQLForTesting(
  *        version requirement. Must be set to true outside tests.
  * @returns A new CodeQL object
  */
-async function getCodeQLForCmd(
+export async function getCodeQLForCmd(
   logger: Logger,
   cmd: string,
   checkVersion: boolean,
@@ -915,15 +904,43 @@ async function getCodeQLForCmd(
       sarifFile: string,
       automationDetailsId: string | undefined,
       config: ActionConfig<"tempDir">,
+      diagnosticDir: string | undefined,
     ): Promise<void> {
+      // We may be exporting diagnostics for a failed SARIF, in which case the configuration
+      // file may not have been written to disk and there may not be a database. The CLI
+      // will produce a SARIF for diagnostics from `diagnosticDir` without it. Therefore,
+      // we check whether `configPath` exists and only provide it to the CLI if it does.
+      // Although not needed, the CLI will produce an error if it
+      // is provided with an argument to `--sarif-codescanning-config` that does not exist.
+      let configPath: string | undefined =
+        getGeneratedCodeScanningConfigPath(config);
+
+      if (!fs.existsSync(configPath)) {
+        // Warn if there is no configuration file, even though `config` claims that `init`
+        // was successful. This shouldn't be happening.
+        if (config.successfullyInitialised) {
+          logger.warning(
+            [
+              `Expected a configuration file at '${configPath}', which does not exist.`,
+              "Continuing with diagnostics export anyway, without a configuration file.",
+            ].join(" "),
+          );
+        }
+
+        configPath = undefined;
+      }
+
       const args = [
         "diagnostics",
         "export",
         "--format=sarif-latest",
         `--output=${sarifFile}`,
-        `--sarif-codescanning-config=${getGeneratedCodeScanningConfigPath(
-          config,
-        )}`,
+        ...(configPath !== undefined
+          ? [`--sarif-codescanning-config=${configPath}`]
+          : []),
+        ...(diagnosticDir !== undefined
+          ? [`--diagnostic-dir=${diagnosticDir}`]
+          : []),
         ...getExtraOptionsFromEnv(["diagnostics", "export"]),
       ];
       if (automationDetailsId !== undefined) {

src/config-utils.test.ts

@@ -21,7 +21,6 @@ import { RepositoryProperties } from "./feature-flags/properties";
 import * as gitUtils from "./git-utils";
 import { GitVersionInfo } from "./git-utils";
 import { BuiltInLanguage, Language } from "./languages";
-import { getRunnerLogger } from "./logging";
 import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
 import * as overlayDiagnostics from "./overlay/diagnostics";
 import { OverlayDisabledReason } from "./overlay/diagnostics";
@@ -42,6 +41,7 @@ import {
   callee,
   SAMPLE_DOTCOM_API_DETAILS,
   AssertableTarget,
+  RecordingLogger,
 } from "./testing-utils";
 import {
   GitHubVariant,
@@ -102,7 +102,7 @@ function createTestInitConfigInputs(
       features: createFeatures([]),
       repositoryProperties: {},
       enableFileCoverageInformation: true,
-      logger: getRunnerLogger(true),
+      logger: new RecordingLogger(),
     } satisfies configUtils.InitConfigInputs,
     overrides,
   );
@@ -150,7 +150,7 @@ function mockListLanguages(languages: string[]) {
 
 test.serial("load empty config", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
     const languages = "javascript,python";
 
     setupActionsVars(tempDir, tempDir);
@@ -196,7 +196,7 @@ test.serial("load empty config", async (t) => {
 
 test.serial("load code quality config", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
     const languages = "actions";
 
     setupActionsVars(tempDir, tempDir);
@@ -252,7 +252,7 @@ test.serial(
   "initActionState doesn't throw if there are queries configured in the repository properties",
   async (t) => {
     return await withTmpDir(async (tempDir) => {
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const languages = "javascript";
 
       setupActionsVars(tempDir, tempDir);
@@ -315,7 +315,7 @@ test.serial(
 
 test.serial("loading a saved config produces the same config", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -363,7 +363,7 @@ test.serial("loading a saved config produces the same config", async (t) => {
 
 test.serial("loading config with version mismatch throws", async (t) => {
   return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
 
     const codeql = createStubCodeQL({
       async resolveLanguages() {
@@ -788,12 +788,12 @@ test.serial("Unknown languages", async (t) => {
   });
 });
 
-const mockLogger = getRunnerLogger(true);
+const mockLogger = new RecordingLogger();
 
 test.serial("no generateRegistries when registries is undefined", async (t) => {
   return await withTmpDir(async (tmpDir) => {
     const registriesInput = undefined;
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
     const { registriesAuthTokens, qlconfigFile } =
       await configUtils.generateRegistries(registriesInput, tmpDir, logger);
 
@@ -814,7 +814,7 @@ test.serial(
           token: "not-a-token",
         },
       ]);
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const { registriesAuthTokens, qlconfigFile } =
         await configUtils.generateRegistries(registriesInput, tmpDir, logger);
 
@@ -2126,7 +2126,7 @@ test.serial("getPrimaryAnalysisConfig - Code Scanning + Code Quality", (t) => {
 });
 
 test.serial(
-  "isTrapCachingEnabled: explicit input true is respected",
+  "isTrapCachingEnabled: explicit true input overrides self-hosted default",
   async (t) => {
     return await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
@@ -2134,12 +2134,40 @@ test.serial(
         .stub(actionsUtil, "getOptionalInput")
         .withArgs("trap-caching")
         .returns("true");
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      t.true(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
+    });
+  },
+);
+
+test.serial(
+  "isTrapCachingEnabled: explicit true input overrides overlay defaults",
+  async (t) => {
+    return await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, path.join(tmpDir, "hostedtoolcache"));
+      sinon
+        .stub(actionsUtil, "getOptionalInput")
+        .withArgs("trap-caching")
+        .returns("true");
+      for (const overlayDatabaseMode of [
+        OverlayDatabaseMode.Overlay,
+        OverlayDatabaseMode.OverlayBase,
+      ]) {
+        t.true(configUtils.isTrapCachingEnabled(overlayDatabaseMode));
+      }
+    });
+  },
+);
+
+test.serial(
+  "isTrapCachingEnabled: explicit false input overrides hosted default",
+  async (t) => {
+    return await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, path.join(tmpDir, "hostedtoolcache"));
+      sinon
+        .stub(actionsUtil, "getOptionalInput")
+        .withArgs("trap-caching")
+        .returns("false");
+      t.false(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
     });
   },
 );
@@ -2153,18 +2181,13 @@ test.serial(
         .stub(actionsUtil, "getOptionalInput")
         .withArgs("trap-caching")
         .returns(undefined);
-      t.false(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      t.false(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
     });
   },
 );
 
 test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner by default",
+  "isTrapCachingEnabled: enabled on hosted runner without overlay analysis",
   async (t) => {
     return await withTmpDir(async (tmpDir) => {
       const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
@@ -2173,18 +2196,13 @@ test.serial(
         .stub(actionsUtil, "getOptionalInput")
         .withArgs("trap-caching")
         .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      t.true(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
     });
   },
 );
 
 test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner when overlay enabled but feature flag off",
+  "isTrapCachingEnabled: disabled on hosted runner with overlay analysis",
   async (t) => {
     return await withTmpDir(async (tmpDir) => {
       const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
@@ -2193,52 +2211,12 @@ test.serial(
         .stub(actionsUtil, "getOptionalInput")
         .withArgs("trap-caching")
         .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.Overlay,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: disabled on hosted runner when overlay enabled and feature flag on",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.false(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([Feature.OverlayAnalysisDisableTrapCaching]),
-          OverlayDatabaseMode.Overlay,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner when overlay is None even with feature flag on",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([Feature.OverlayAnalysisDisableTrapCaching]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      for (const overlayDatabaseMode of [
+        OverlayDatabaseMode.Overlay,
+        OverlayDatabaseMode.OverlayBase,
+      ]) {
+        t.false(configUtils.isTrapCachingEnabled(overlayDatabaseMode));
+      }
     });
   },
 );
@@ -2247,7 +2225,7 @@ test("applyIncrementalAnalysisSettings: no-op when mode is not Overlay and diff
   const config = createTestConfig({});
   config.overlayDatabaseMode = OverlayDatabaseMode.None;
   const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();
 
   await configUtils.applyIncrementalAnalysisSettings(
     config,
@@ -2265,7 +2243,7 @@ test("applyIncrementalAnalysisSettings: keeps overlay mode and adds exclusions w
     overlayDatabaseMode: OverlayDatabaseMode.Overlay,
   });
   const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();
 
   await configUtils.applyIncrementalAnalysisSettings(
     config,
@@ -2288,7 +2266,7 @@ test.serial(
     });
     config.useOverlayDatabaseCaching = true;
     const codeql = createStubCodeQL({});
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
     const addDiagnosticsStub = sinon
       .stub(overlayDiagnostics, "addOverlayDisablementDiagnostics")
       .resolves();
@@ -2320,7 +2298,7 @@ test.serial(
     config.useOverlayDatabaseCaching = false;
     config.overlayModeSetExplicitly = true;
     const codeql = createStubCodeQL({});
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
     const addDiagnosticsStub = sinon
       .stub(overlayDiagnostics, "addOverlayDisablementDiagnostics")
       .resolves();
@@ -2343,7 +2321,7 @@ test("applyIncrementalAnalysisSettings: adds exclusions for diff-informed-only r
   const config = createTestConfig({});
   config.overlayDatabaseMode = OverlayDatabaseMode.None;
   const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();
 
   await configUtils.applyIncrementalAnalysisSettings(
     config,
@@ -2557,7 +2535,7 @@ test("determineUserConfig - merges configs if FF is enabled in Default Setup", a
     // also check whether loading the configuration from disk that was written
     // by `determineUserConfig` matches our expectations.
     const loadedFromDisk = configUtils.getLocalConfig(
-      getRunnerLogger(true),
+      new RecordingLogger(),
       expectedConfigPath,
       false,
     );

src/config-utils.ts

@@ -465,6 +465,8 @@ export async function initActionState(
     overlayModeSetExplicitly: false,
     repositoryProperties,
     enableFileCoverageInformation,
+    // We don't set this to `true` until `init` is successful.
+    successfullyInitialised: false,
   };
 }
 
@@ -944,10 +946,14 @@ async function validateOverlayDatabaseMode(
   });
 }
 
-export async function isTrapCachingEnabled(
-  features: FeatureEnablement,
+/**
+ * Determines whether TRAP caching is enabled for the current run.
+ *
+ * @returns Whether TRAP caches should be downloaded and uploaded.
+ */
+export function isTrapCachingEnabled(
   overlayDatabaseMode: OverlayDatabaseMode,
-): Promise<boolean> {
+): boolean {
   // If the workflow specified something, always respect that.
   const trapCaching = getOptionalInput("trap-caching");
   if (trapCaching !== undefined) return trapCaching === "true";
@@ -955,12 +961,8 @@ export async function isTrapCachingEnabled(
   // On self-hosted runners which may have slow network access, disable TRAP caching by default.
   if (!looksLikeHostedRunner()) return false;
 
-  // If overlay analysis is enabled, then disable TRAP caching since overlay analysis supersedes it.
-  // This change is gated behind a feature flag.
-  if (
-    overlayDatabaseMode !== OverlayDatabaseMode.None &&
-    (await features.getValue(Feature.OverlayAnalysisDisableTrapCaching))
-  ) {
+  // Overlay analysis supersedes TRAP caching, so disable TRAP caching by default when it is active.
+  if (overlayDatabaseMode !== OverlayDatabaseMode.None) {
     return false;
   }
 
@@ -1302,7 +1304,7 @@ export async function initConfig(
     logger,
   );
 
-  if (await isTrapCachingEnabled(features, config.overlayDatabaseMode)) {
+  if (isTrapCachingEnabled(config.overlayDatabaseMode)) {
     const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(
       inputs.codeql,
       config.languages,

src/config/action-config.ts

@@ -130,6 +130,9 @@ export interface Config {
    * Whether to enable file coverage information.
    */
   enableFileCoverageInformation: boolean;
+
+  /** Whether the analysis was successfully initialised using the configuration. */
+  successfullyInitialised: boolean;
 }
 
 /** Properties available in `Config`. */

src/config/db-config.test.ts

@@ -2,15 +2,15 @@ import test, { ExecutionContext } from "ava";
 
 import { RepositoryProperties } from "../feature-flags/properties";
 import { BuiltInLanguage, Language } from "../languages";
-import { getRunnerLogger } from "../logging";
 import {
   checkExpectedLogMessages,
   getRecordingLogger,
   LoggedMessage,
   makeMacro,
   RecordingLogger,
+  setupActionsVars,
 } from "../testing-utils";
-import { ConfigurationError, prettyPrintPack } from "../util";
+import { ConfigurationError, prettyPrintPack, withTmpDir } from "../util";
 
 import * as dbConfig from "./db-config";
 
@@ -384,7 +384,7 @@ calculateAugmentationErrorMacro(
 
 test("parseUserConfig - successfully parses valid YAML", (t) => {
   const result = dbConfig.parseUserConfig(
-    getRunnerLogger(true),
+    new RecordingLogger(),
     "test",
     `
     paths-ignore:
@@ -410,7 +410,7 @@ test("parseUserConfig - throws a ConfigurationError if the file is not valid YAM
   t.throws(
     () =>
       dbConfig.parseUserConfig(
-        getRunnerLogger(true),
+        new RecordingLogger(),
         "test",
         `
         paths-ignore:
@@ -562,74 +562,89 @@ test("mergeDefaultSetupAndUserConfigs - keeps other properties from user-supplie
   t.deepEqual(result, configFile);
 });
 
-test("mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup", async (t) => {
-  const logger = new RecordingLogger();
-  const configFile: dbConfig.UserConfig = {
-    "query-filters": [{ exclude: { a: "b" } }],
-    "paths-ignore": ["path"],
-  };
+test.serial(
+  "mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup",
+  async (t) => {
+    const logger = new RecordingLogger();
+    const configFile: dbConfig.UserConfig = {
+      "query-filters": [{ exclude: { a: "b" } }],
+      "paths-ignore": ["path"],
+    };
 
-  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-    logger,
-    {
-      "default-setup": {
-        borg: [],
-        org: {
-          unknown: "foo",
-          "model-packs": [],
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+        logger,
+        {
+          "default-setup": {
+            borg: [],
+            org: {
+              unknown: "foo",
+              "model-packs": [],
+            },
+          } as unknown as dbConfig.DefaultSetupConfig,
+          "paths-ignore": ["other-path"],
         },
-      } as unknown as dbConfig.DefaultSetupConfig,
-      "paths-ignore": ["other-path"],
-    },
-    configFile,
-  );
+        configFile,
+      );
 
-  t.deepEqual(result, {
-    ...configFile,
-    "default-setup": { org: { "model-packs": [] } },
-  });
+      t.deepEqual(result, {
+        ...configFile,
+        "default-setup": { org: { "model-packs": [] } },
+      });
 
-  const expectedUnrecognisedKeys = [
-    ".default-setup.org.unknown",
-    ".default-setup.borg",
-    ".paths-ignore",
-  ].join(", ");
-  checkExpectedLogMessages(t, logger.messages, [
-    `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
-  ]);
-});
+      const expectedUnrecognisedKeys = [
+        ".default-setup.org.unknown",
+        ".default-setup.borg",
+        ".paths-ignore",
+      ].join(", ");
+      checkExpectedLogMessages(t, logger.messages, [
+        `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
+      ]);
+    });
+  },
+);
 
-test("mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup", async (t) => {
-  const logger = new RecordingLogger();
-  const configFile: dbConfig.UserConfig = {};
+test.serial(
+  "mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup",
+  async (t) => {
+    const logger = new RecordingLogger();
+    const configFile: dbConfig.UserConfig = {};
 
-  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-    logger,
-    {
-      "default-setup": {
-        org: {
-          "model-packs": [123],
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+
+      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+        logger,
+        {
+          "default-setup": {
+            org: {
+              "model-packs": [123],
+            },
+          } as unknown as dbConfig.DefaultSetupConfig,
         },
-      } as unknown as dbConfig.DefaultSetupConfig,
-    },
-    configFile,
-  );
+        configFile,
+      );
 
-  t.deepEqual(result, {
-    ...configFile,
-    "default-setup": { org: { "model-packs": [123] } },
-  });
+      t.deepEqual(result, {
+        ...configFile,
+        "default-setup": { org: { "model-packs": [123] } },
+      });
 
-  const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(", ");
-  checkExpectedLogMessages(t, logger.messages, [
-    `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
-  ]);
-});
+      const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(
+        ", ",
+      );
+      checkExpectedLogMessages(t, logger.messages, [
+        `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
+      ]);
+    });
+  },
+);
 
 /** Parses `contents` as a configuration without validating it. */
 function parseUnvalidatedConfig(contents: string): dbConfig.UserConfig {
   return dbConfig.parseUserConfig(
-    getRunnerLogger(true),
+    new RecordingLogger(),
     "test",
     contents,
     false,

src/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.2",
-  "cliVersion": "2.27.2",
-  "priorBundleVersion": "codeql-bundle-v2.27.1",
-  "priorCliVersion": "2.27.1"
+  "bundleVersion": "codeql-bundle-v2.27.3",
+  "cliVersion": "2.27.3",
+  "priorBundleVersion": "codeql-bundle-v2.27.2",
+  "priorCliVersion": "2.27.2"
 }

src/diagnostics.test.ts

@@ -0,0 +1,165 @@
+import * as fs from "fs";
+import path from "path";
+
+import test, { type ExecutionContext } from "ava";
+
+import * as diagnostics from "./diagnostics";
+import { BuiltInLanguage } from "./languages";
+import {
+  checkExpectedLogMessages,
+  createTestConfig,
+  initAllState,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
+import { withTmpDir } from "./util";
+
+setupTests(test);
+
+const id = "codeql-action/test-diagnostic";
+const name = "Test title";
+
+test("makeDiagnostic - adds expected properties", (t) => {
+  const diagnostic = diagnostics.makeDiagnostic(id, name, {});
+
+  t.truthy(diagnostic.timestamp);
+  t.is(diagnostic.source.id, id);
+  t.is(diagnostic.source.name, name);
+});
+
+test("getLanguageDiagnosticsPath gets language-specific path", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    for (const language of Object.values(BuiltInLanguage)) {
+      t.is(
+        diagnostics.getLanguageDiagnosticsPath(tmpDir, language),
+        path.resolve(
+          tmpDir,
+          language,
+          ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+        ),
+      );
+    }
+  }));
+
+test("getTempLanguageDiagnosticsPath returns path without language", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    t.is(
+      diagnostics.getTempLanguageDiagnosticsPath(tmpDir),
+      path.resolve(
+        tmpDir,
+        diagnostics.TEMP_DIAGNOSTIC_DIR_NAME,
+        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+      ),
+    );
+  }));
+
+test("getTempLanguageDiagnosticsPath returns language-specific path if a language is provided", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    t.is(
+      diagnostics.getTempLanguageDiagnosticsPath(tmpDir, BuiltInLanguage.swift),
+      path.resolve(
+        tmpDir,
+        diagnostics.TEMP_DIAGNOSTIC_DIR_NAME,
+        BuiltInLanguage.swift,
+        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+      ),
+    );
+  }));
+
+test("getDatabaseDiagnosticsPath returns language-specific path", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    t.is(
+      diagnostics.getDatabaseDiagnosticsPath(
+        createTestConfig({ dbLocation: tmpDir }),
+        BuiltInLanguage.swift,
+      ),
+      path.resolve(
+        tmpDir,
+        BuiltInLanguage.swift,
+        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+      ),
+    );
+  }));
+
+/**
+ * Diagnostic files that are written to disk don't have deterministic names.
+ * This function recursively finds all `.json` files at {@link rootPath},
+ * asserts that there is exactly one, and that it matches {@link expected}.
+ *
+ * @param rootPath The path to start searching from.
+ */
+function assertSingleDiagnosticIn(
+  t: ExecutionContext<unknown>,
+  rootPath: string,
+  expected: diagnostics.DiagnosticMessage,
+) {
+  // Find all `.json` files in `rootPath` and check that there is exactly one.
+  const filePaths = fs
+    .readdirSync(rootPath, {
+      recursive: true,
+      encoding: "utf-8",
+    })
+    .filter((p) => p.endsWith(".json"));
+
+  t.is(filePaths.length, 1);
+
+  // Check that the written diagnostic matches the one we added.
+  const contents = fs.readFileSync(
+    path.resolve(rootPath, filePaths[0]),
+    "utf-8",
+  );
+
+  const readDiagnostic = JSON.parse(contents) as diagnostics.DiagnosticMessage;
+  t.deepEqual(readDiagnostic, expected);
+}
+
+test("addDiagnostic writes temporary diagnostics and flushDiagnostics moves them to the database", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+
+    const tempDiagDir = path.resolve(tmpDir, "temp");
+    const testDbDir = path.resolve(tmpDir, "test", "database");
+    const diagnostic = diagnostics.makeDiagnostic(id, name, {});
+
+    // Write the diagnostic. The path provided for `dbLocation` doesn't exist,
+    // so the diagnostic will be written to a temporary location.
+    t.notThrows(() => {
+      diagnostics.addDiagnostic(
+        createTestConfig({ tempDir: tempDiagDir, dbLocation: testDbDir }),
+        BuiltInLanguage.actions,
+        diagnostic,
+        logger,
+      );
+    });
+
+    // Check that `tempDiagDir` was created.
+    t.true(fs.existsSync(tempDiagDir));
+
+    // Check that the diagnostic exists under `tempDiagDir`.
+    assertSingleDiagnosticIn(t, tempDiagDir, diagnostic);
+
+    // Flush the diagnostics. This will cause the diagnostic we wrote previously to
+    // be moved to a location under `dbLocation`.
+    t.notThrows(() => {
+      diagnostics.flushDiagnostics(
+        initAllState({ logger }),
+        createTestConfig({
+          tempDir: tempDiagDir,
+          dbLocation: testDbDir,
+        }),
+      );
+    });
+
+    // Check that `testDbDir` was created.
+    t.true(fs.existsSync(testDbDir));
+
+    // Check that the diagnostic exists under `testDbDir`.
+    assertSingleDiagnosticIn(t, testDbDir, diagnostic);
+
+    // Check that we logged that the database directory doesn't exist yet
+    // and that we moved one diagnostic.
+    checkExpectedLogMessages(t, logger.messages, [
+      `but the database at ${path.join(testDbDir, "actions")} does not exist yet`,
+      "Moving 1 diagnostic(s) to their respective databases.",
+    ]);
+  }));

src/diagnostics.ts

@@ -1,10 +1,24 @@
-import { existsSync, mkdirSync, writeFileSync } from "fs";
+import * as fs from "fs";
 import path from "path";
 
+import type { ActionState } from "./action-common";
+import { getTemporaryDirectory } from "./actions-util";
 import type { Config } from "./config-utils";
 import { Language } from "./languages";
-import { getActionsLogger } from "./logging";
-import { getCodeQLDatabasePath } from "./util";
+import { getActionsLogger, type Logger } from "./logging";
+import {
+  getCodeQLDatabasePath,
+  getErrorMessage,
+  isErrnoException,
+} from "./util";
+
+/** The name of the directory we use to temporarily store diagnostics. */
+export const TEMP_DIAGNOSTIC_DIR_NAME = "codeql-action-temp-diagnostics";
+
+export const CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS = [
+  "diagnostic",
+  "codeql-action",
+];
 
 /**
  * Known tags for diagnostics. There is currently only "internal-error",
@@ -84,22 +98,16 @@ export type DiagnosticMessage = DiagnosticMessageOptions & {
   source: DiagnosticSource;
 };
 
-/** Represents a diagnostic message that has not yet been written to the database. */
-interface UnwrittenDiagnostic {
-  /** The diagnostic message that has not yet been written. */
-  diagnostic: DiagnosticMessage;
-  /** The language the diagnostic is for. */
-  language: Language;
+/** Represents a diagnostic message that has not yet been saved to the database. */
+interface TemporaryDiagnostic {
+  /** The path to which the diagnostic has temporarily been written to. */
+  path: string;
+  /** The language the diagnostic is for, if any. */
+  language?: Language;
 }
 
-/** A list of diagnostics which have not yet been written to disk. */
-let unwrittenDiagnostics: UnwrittenDiagnostic[] = [];
-
-/**
- * A list of diagnostics which have not yet been written to disk,
- * and where the language does not matter.
- */
-let unwrittenDefaultLanguageDiagnostics: DiagnosticMessage[] = [];
+/** A list of diagnostics which have not yet been saved to the database. */
+let temporaryDiagnostics: TemporaryDiagnostic[] = [];
 
 /**
  * Counter used to generate a unique suffix for each diagnostic filename, so that
@@ -128,6 +136,51 @@ export function makeDiagnostic(
   };
 }
 
+/**
+ * Gets a path relative to {@link basePath} where diagnostics for {@link language} should be stored at.
+ */
+export function getLanguageDiagnosticsPath(
+  basePath: string,
+  language: Language,
+) {
+  return path.resolve(
+    basePath,
+    language,
+    ...CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+  );
+}
+
+/**
+ * Gets a path relative to {@link tmpDir} where diagnostics should temporarily be stored
+ * until they can be moved to the database.
+ */
+export function getTempDiagnosticsRoot(tmpDir: string): string {
+  return path.resolve(tmpDir, TEMP_DIAGNOSTIC_DIR_NAME);
+}
+
+/**
+ * Gets a path relative to {@link tmpDir} where diagnostics for {@link language}
+ * can temporarily be stored at before the database is initialised. If {@link language}
+ * is `undefined`, then a non-language-specific path is returned.
+ */
+export function getTempLanguageDiagnosticsPath(
+  tmpDir: string,
+  language?: Language,
+) {
+  const root = getTempDiagnosticsRoot(tmpDir);
+
+  if (language !== undefined) {
+    return getLanguageDiagnosticsPath(root, language);
+  }
+
+  return path.resolve(root, ...CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS);
+}
+
+/** Gets the path where diagnostics for {@link language} should be stored in the database. */
+export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
+  return getLanguageDiagnosticsPath(config.dbLocation, language);
+}
+
 /**
  * Adds the given diagnostic to the database. If the database does not yet exist,
  * the diagnostic will be written to it once it has been created.
@@ -140,22 +193,23 @@ export function addDiagnostic(
   config: Config,
   language: Language,
   diagnostic: DiagnosticMessage,
+  logger: Logger = getActionsLogger(),
 ) {
-  const logger = getActionsLogger();
   const databasePath = language
     ? getCodeQLDatabasePath(config, language)
     : config.dbLocation;
 
   // Check that the database exists before writing to it. If the database does not yet exist,
-  // store the diagnostic in memory and write it later.
-  if (existsSync(databasePath)) {
-    writeDiagnostic(config, language, diagnostic);
+  // store the diagnostic in a temporary location and move it to the database later.
+  if (fs.existsSync(databasePath)) {
+    writeDiagnostic({ logger }, config, language, diagnostic);
   } else {
     logger.debug(
       `Writing a diagnostic for ${language}, but the database at ${databasePath} does not exist yet.`,
     );
 
-    unwrittenDiagnostics.push({ diagnostic, language });
+    // Write the diagnostic to a temporary location.
+    writeTemporaryDiagnosticFile(logger, config.tempDir, language, diagnostic);
   }
 }
 
@@ -163,6 +217,7 @@ export function addDiagnostic(
 export function addNoLanguageDiagnostic(
   config: Config | undefined,
   diagnostic: DiagnosticMessage,
+  logger: Logger = getActionsLogger(),
 ) {
   if (config !== undefined) {
     addDiagnostic(
@@ -173,10 +228,74 @@ export function addNoLanguageDiagnostic(
       diagnostic,
     );
   } else {
-    unwrittenDefaultLanguageDiagnostics.push(diagnostic);
+    logger.debug(
+      `Writing a diagnostic not associated with any language, but we have no configuration to tell us where the database is yet.`,
+    );
+
+    // Write the diagnostic to a temporary location.
+    writeTemporaryDiagnosticFile(
+      logger,
+      getTemporaryDirectory(),
+      undefined,
+      diagnostic,
+    );
   }
 }
 
+/**
+ * Writes {@link diagnostic} for an optional {@link language} to a subdirectory of {@link tempDir}
+ * and tracks it as a diagnostic that was written to a temporary location.
+ */
+function writeTemporaryDiagnosticFile(
+  logger: Logger,
+  tempDir: string,
+  language: Language | undefined,
+  diagnostic: DiagnosticMessage,
+) {
+  const tempDiagnosticsPath = getTempLanguageDiagnosticsPath(tempDir, language);
+
+  try {
+    // Write the diagnostic to a temporary location.
+    const diagnosticPath = writeDiagnosticFile(tempDiagnosticsPath, diagnostic);
+
+    // Track the temporary file.
+    temporaryDiagnostics.push({ path: diagnosticPath, language });
+  } catch (err) {
+    logger.warning(
+      `Unable to write temporary diagnostic to '${tempDiagnosticsPath}': ${getErrorMessage(err)}\n\n${JSON.stringify(diagnostic)}`,
+    );
+  }
+}
+
+/**
+ * Writes {@link diagnostic} to a file in {@link diagnosticsPath}.
+ */
+function writeDiagnosticFile(
+  diagnosticsPath: string,
+  diagnostic: DiagnosticMessage,
+): string {
+  // Create the directory if it doesn't exist yet.
+  fs.mkdirSync(diagnosticsPath, { recursive: true });
+
+  // Include a monotonically increasing suffix to avoid filename collisions
+  // between diagnostics produced within the same millisecond.
+  const uniqueSuffix = (diagnosticCounter++).toString();
+  // We should only need to remove colons, but to be defensive, only allow a restricted set of
+  // characters.
+  const sanitizedTimestamp = diagnostic.timestamp.replace(
+    /[^a-zA-Z0-9.-]/g,
+    "",
+  );
+  const jsonPath = path.resolve(
+    diagnosticsPath,
+    `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
+  );
+
+  fs.writeFileSync(jsonPath, JSON.stringify(diagnostic));
+
+  return jsonPath;
+}
+
 /**
  * Writes the given diagnostic to the database.
  *
@@ -185,78 +304,94 @@ export function addNoLanguageDiagnostic(
  * @param diagnostic The diagnostic message to add to the database.
  */
 function writeDiagnostic(
+  action: ActionState<["Logger"]>,
   config: Config,
-  language: Language | undefined,
+  language: Language,
   diagnostic: DiagnosticMessage,
 ) {
-  const logger = getActionsLogger();
-  const databasePath = language
-    ? getCodeQLDatabasePath(config, language)
-    : config.dbLocation;
-  const diagnosticsPath = path.resolve(
-    databasePath,
-    "diagnostic",
-    "codeql-action",
-  );
+  const diagnosticsPath = getDatabaseDiagnosticsPath(config, language);
 
   try {
-    // Create the directory if it doesn't exist yet.
-    mkdirSync(diagnosticsPath, { recursive: true });
-
-    // Include a monotonically increasing suffix to avoid filename collisions
-    // between diagnostics produced within the same millisecond.
-    const uniqueSuffix = (diagnosticCounter++).toString();
-    // We should only need to remove colons, but to be defensive, only allow a restricted set of
-    // characters.
-    const sanitizedTimestamp = diagnostic.timestamp.replace(
-      /[^a-zA-Z0-9.-]/g,
-      "",
-    );
-    const jsonPath = path.resolve(
-      diagnosticsPath,
-      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
-    );
-
-    writeFileSync(jsonPath, JSON.stringify(diagnostic));
+    writeDiagnosticFile(diagnosticsPath, diagnostic);
   } catch (err) {
-    logger.warning(`Unable to write diagnostic message to database: ${err}`);
-    logger.debug(JSON.stringify(diagnostic));
+    action.logger.warning(
+      `Unable to write diagnostic message to database: ${err}`,
+    );
+    action.logger.debug(JSON.stringify(diagnostic));
   }
 }
 
-/** Report if there are unwritten diagnostics and write them to the log. */
-export function logUnwrittenDiagnostics() {
-  const logger = getActionsLogger();
-  const num = unwrittenDiagnostics.length;
-  if (num > 0) {
-    logger.warning(
-      `${num} diagnostic(s) could not be written to the database and will not appear on the Tool Status Page.`,
+/** Report if there are temporary diagnostics and write them to the log. */
+export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
+  const num = temporaryDiagnostics.length;
+
+  if (num > 0 && action.logger.isDebug()) {
+    action.logger.startGroup("Diagnostics in temporary location");
+    action.logger.debug(
+      `${num} diagnostic(s) were not moved to the database and remain in the temporary directory.`,
     );
 
-    for (const unwritten of unwrittenDiagnostics) {
-      logger.debug(JSON.stringify(unwritten.diagnostic));
+    for (const temporary of temporaryDiagnostics) {
+      try {
+        action.logger.debug(fs.readFileSync(temporary.path, "utf-8"));
+      } catch (err) {
+        action.logger.debug(
+          `Failed to read diagnostics from temporary location at '${temporary.path}': ${getErrorMessage(err)}`,
+        );
+      }
+    }
+
+    action.logger.endGroup();
+  }
+}
+
+/** Relocates all temporary diagnostics to the respective databases. */
+export function flushDiagnostics(
+  action: ActionState<["Logger"]>,
+  config: Config,
+) {
+  const diagnosticsCount = temporaryDiagnostics.length;
+  action.logger.debug(
+    `Moving ${diagnosticsCount} diagnostic(s) to their respective databases.`,
+  );
+
+  const failedFlushDiagnostics: TemporaryDiagnostic[] = [];
+  for (const temporary of temporaryDiagnostics) {
+    // If `temporary.language` is `undefined`, then we didn't have a `config` at the time that
+    // `addNoLanguageDiagnostic` was called. In that case, we arbitrarily choose the first
+    // configured language here like we would have done in `addNoLanguageDiagnostic`.
+    const directory = getDatabaseDiagnosticsPath(
+      config,
+      temporary.language ?? config.languages[0],
+    );
+    const filename = path.basename(temporary.path);
+    const destination = path.join(directory, filename);
+
+    try {
+      fs.mkdirSync(directory, { recursive: true });
+      try {
+        fs.renameSync(temporary.path, destination);
+      } catch (renameErr: unknown) {
+        // Rethrow the error if it isn't an EXDEV one.
+        if (!isErrnoException(renameErr) || renameErr.code !== "EXDEV") {
+          throw renameErr;
+        }
+
+        // The error was an EXDEV one: try to copy the file and delete the temporary one.
+        fs.copyFileSync(temporary.path, destination);
+        fs.unlinkSync(temporary.path);
+      }
+    } catch (err) {
+      action.logger.warning(
+        `Failed to relocate '${temporary.path}' to '${destination}': ${getErrorMessage(err)}`,
+      );
+
+      failedFlushDiagnostics.push(temporary);
     }
   }
-}
 
-/** Writes all unwritten diagnostics to disk. */
-export function flushDiagnostics(config: Config) {
-  const logger = getActionsLogger();
-
-  const diagnosticsCount =
-    unwrittenDiagnostics.length + unwrittenDefaultLanguageDiagnostics.length;
-  logger.debug(`Writing ${diagnosticsCount} diagnostic(s) to database.`);
-
-  for (const unwritten of unwrittenDiagnostics) {
-    writeDiagnostic(config, unwritten.language, unwritten.diagnostic);
-  }
-  for (const unwritten of unwrittenDefaultLanguageDiagnostics) {
-    addNoLanguageDiagnostic(config, unwritten);
-  }
-
-  // Reset the unwritten diagnostics arrays.
-  unwrittenDiagnostics = [];
-  unwrittenDefaultLanguageDiagnostics = [];
+  // Reset the temporary diagnostics arrays.
+  temporaryDiagnostics = failedFlushDiagnostics;
 }
 
 /**

src/diff-informed-analysis-utils.test.ts

@@ -10,7 +10,6 @@ import {
   exportedForTesting,
 } from "./diff-informed-analysis-utils";
 import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
-import { getRunnerLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
 import {
   setupTests,
@@ -19,6 +18,7 @@ import {
   mockFeatureFlagApiEndpoint,
   setupActionsVars,
   makeMacro,
+  RecordingLogger,
 } from "./testing-utils";
 import { GitHubVariant, withTmpDir } from "./util";
 import type { GitHubVersion } from "./util";
@@ -55,7 +55,7 @@ const testShouldPerformDiffInformedAnalysis = makeMacro({
       setupActionsVars(tmpDir, tmpDir);
 
       const testCase = { ...defaultTestCase, ...partialTestCase };
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const codeql = mockCodeQLVersion(testCase.codeQLVersion);
 
       if (testCase.diffInformedQueriesEnvVar !== undefined) {
@@ -182,7 +182,7 @@ test.serial(
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const codeql = mockCodeQLVersion("2.21.0");
       const features = createFeatures([Feature.DiffInformedQueries]);
 
@@ -207,7 +207,7 @@ test.serial(
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const codeql = mockCodeQLVersion("2.21.0");
       // A features implementation whose getValue rejects, simulating an
       // unexpected failure when determining whether diff-informed analysis
@@ -237,7 +237,7 @@ test.serial(
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const codeql = mockCodeQLVersion("2.21.0");
       const features = createFeatures([Feature.DiffInformedQueries]);
 
@@ -274,7 +274,7 @@ test.serial(
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
       const codeql = mockCodeQLVersion("2.21.0");
       const features = createFeatures([Feature.DiffInformedQueries]);
 
@@ -313,7 +313,7 @@ function runGetDiffRanges(changes: number, patch: string[] | undefined): any {
       changes,
       patch: patch?.join("\n"),
     },
-    getRunnerLogger(true),
+    new RecordingLogger(),
   );
 }
 

src/doc-url.ts

@@ -3,7 +3,6 @@
  */
 
 export enum DocUrl {
-  ASSIGNING_PERMISSIONS_TO_JOBS = "https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs",
   AUTOMATIC_BUILD_FAILED = "https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed",
   CODEQL_BUILD_MODES = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes",
   DEFINE_ENV_VARIABLES = "https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow",

src/environment.ts

@@ -165,9 +165,21 @@ export enum EnvVar {
    */
   SARIF_DUMP_DIR = "CODEQL_ACTION_SARIF_DUMP_DIR",
 
+  /**
+   * Whether to skip generating a failed SARIF file. Intended for testing purposes.
+   * This setting is more specific than `CODEQL_ACTION_TEST_MODE` and
+   * `CODEQL_ACTION_SKIP_SARIF_UPLOAD`, which imply this option.
+   *
+   * Setting this to `false` takes precedence over `CODEQL_ACTION_TEST_MODE: true` or
+   * `CODEQL_ACTION_SKIP_SARIF_UPLOAD: true`.
+   */
+  SKIP_GENERATE_FAILED_SARIF = "CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF",
+
   /**
    * Whether to skip uploading SARIF results to GitHub. Intended for testing purposes.
    * This setting is more specific than `CODEQL_ACTION_TEST_MODE`, which implies this option.
+   *
+   * Setting this to `false` takes precedence over `CODEQL_ACTION_TEST_MODE: true`.
    */
   SKIP_SARIF_UPLOAD = "CODEQL_ACTION_SKIP_SARIF_UPLOAD",